Document how to build Chromium for devices.

docs/ios_build_instructions.md

Index: docs/ios_build_instructions.md
diff --git a/docs/ios_build_instructions.md b/docs/ios_build_instructions.md
index b23138d1a7f5345e3bf760e1e3b2f6339fa11fc3..c28ffef0dae0768f19b7f65da04e246abd9edada 100644
--- a/docs/ios_build_instructions.md
+++ b/docs/ios_build_instructions.md
@@ -1,6 +1,6 @@
 # Checking out and building Chromium for iOS
 
-There are instructions for other platforms linked from the 
+There are instructions for other platforms linked from the
 [get the code](get_the_code.md) page.
 
 ## Instructions for Google Employees
@@ -16,10 +16,10 @@ Are you a Google employee? See
 * [Xcode](https://developer.apple.com/xcode) 8.0+.
 * The OS X 10.10 SDK. Run
 
-    ```shell  
+    ```shell
     $ ls `xcode-select -p`/Platforms/MacOSX.platform/Developer/SDKs
     ```
- 
+
   to check whether you have it.  Building with the 10.11 SDK works too, but
   the releases currently use the 10.10 SDK.
 * The current version of the JDK (required for the Closure compiler).
@@ -81,7 +81,7 @@ development and testing purposes.
 Since the iOS build is a bit more complicated than a desktop build, we provide
 `ios/build/tools/setup-gn.py`, which will create four appropriately configured
 build directories under `out` for Release and Debug device and simulator
-builds, and generates an appropriate Xcode workspace as well. 
+builds, and generates an appropriate Xcode workspace as well.
 
 This script is run automatically by fetch (as part of `gclient runhooks`).
 
@@ -101,10 +101,120 @@ Note: you need to run `setup-gn.py` script every time one of the `BUILD.gn`
 file is updated (either by you or after rebasing). If you forget to run it,
 the list of targets and files in the Xcode solution may be stale.
 
-You can also follow the manual instructions on the 
+You can also follow the manual instructions on the
 [Mac page](mac_build_instructions.md), but make sure you set the
 GN arg `target_os="ios"`.
 
+## Building for device
+
+To be able to build and run Chromium and the tests for devices, you need to
+have an Apple developer account (a free one will work) and the appropriate
+provisioning profiles, then configure the build to use them.
+
+### Code signing identity
+
+Please refer to Apple documentation on how to get a code signing identity

[marq (ping after 24h), 2017/02/22 14:51:21]

... to the Apple documentation ... 

[sdefresne, 2017/02/23 09:10:55]

Done.

+and certificates. You can check that you have a code signing correctly

[marq (ping after 24h), 2017/02/22 14:51:20]

 ... code signing identity ... 

[lody, 2017/02/22 14:52:31]

a code signing identity*

[sdefresne, 2017/02/23 09:10:54]

Done.

[sdefresne, 2017/02/23 09:10:54]

Done.

+installed by running the following command.
+
+```shell
+$ xcrun security find-identity -v -p codesigning
+  1) 0123456789ABCDEF0123456789ABCDEF01234567 "iPhone Developer: someone@example.com (XXXXXXXXXX)"
+     1 valid identities found
+```
+
+If the command output says you have zero valid identities, then you do not
+have a code signing identity installed and need to get one from Apple. If
+you have more than one identity, the build system may select the wrong one
+automatically, and you can use the `ios_code_signing_identity` gn variable
+to control which one to use by setting it to the identity hash, e.g. to
+`"0123456789ABCDEF0123456789ABCDEF01234567"`.
+
+### Mobile Provisioning Profiles

[marq (ping after 24h), 2017/02/22 14:51:21]

The rest of the document uses sentence case for section heads, so you should
follow that -- only capitalize the first word, unless the word is part of a
proper noun. ("provisioning profile" isn't a proper noun.)

[sdefresne, 2017/02/23 09:10:55]

Done.

+
+Once you have the code signing identity, you need to decide on a prefix
+for the application bundle identifier. This is controlled by the gn variable
+`ios_app_bundle_id_prefix` and usually corresponds to a reverted domain name

[marq (ping after 24h), 2017/02/22 14:51:21]

s/reverted/reversed/

[lody, 2017/02/22 14:52:30]

inverted? 

[sdefresne, 2017/02/23 09:10:54]

Done.

[sdefresne, 2017/02/23 09:10:55]

Used "reversed" as suggested by marq.

+(the default value is `"org.chromium"`).
+
+You then need to request from Apple provisioning profiles for your devices

[lody, 2017/02/22 14:52:30]

swap "from Apple" "provisioning profiles"

[sdefresne, 2017/02/23 09:10:54]

Done.

+for the following Bundle Identifiers to build and run Chromium with the

[marq (ping after 24h), 2017/02/22 14:51:20]

... with these application extensions:

[sdefresne, 2017/02/23 09:10:54]

Done.

+application extensions:
+
+-   `${prefix}.chrome.ios.herebedragons`
+-   `${prefix}.chrome.ios.herebedragons.ShareExtension`
+-   `${prefix}.chrome.ios.herebedragons.TodayExtension`
+
+All those certificates need to have the "App Groups" capability enabled for

[marq (ping after 24h), 2017/02/22 14:51:21]

All these ...

[Olivier, 2017/02/23 09:05:34]

s/App groups/App groups (com.apple.security.application-groups)/

[sdefresne, 2017/02/23 09:10:55]

Done.

What's the difference between "these" and "those"?

[marq (ping after 24h), 2017/02/23 10:12:20]

In this case it's somewhat subtle. In general use, 'this' and 'these' are used
for things close to the speaker, and 'that' and 'those' are used for things
distant from the speaker. But 'distance' can be both relative and metaphorical;
for example you might use 'those' to refer to things that were finished or in
the past. Here I think 'these' sounds better because it emphasizes that the
reader is still doing things with the certificates in question.

+the `group.${prefix}.chrome` group.

[Olivier, 2017/02/23 09:05:34]

- group.${prefix}.chrome: This group is only shared between Chrome and its
extensions to share files and configurations.
- group.${prefix}.common: This group can be shared with other applications in
the same organization and can be used to send commands to Chrome.

+
+### Mobile Provisioning Profiles for tests
+
+In addition to that, you need provisioning profiles for the individual test
+suites that you want to run. Their Bundle Identifier depends on whether the
+gn variable `ios_automatically_manage_certs` is set to true (the default)
+or false.
+
+If set to true, then you just need a provisioning profile for the Bundle
+Identifier `${prefix}.gtest.generic-unit-test` but you can only have a
+single test application installed on the device (all the test application
+will share the same Bundle Identifier).
+
+If set to false, then you need a different provisioning profile for each
+test application. Those provisioning profile will have a Bundle Identifier
+matching the following pattern `${prefix}.gtest.${test-suite-name}` where
+`${test-suite-name}` is the name of the test suite with underscores changed
+to dashes (e.g. `base_unittests` app will use `${prefix}.gest.base-unittests`
+as Bundle Identifier).
+
+To be able to run the EarlGrey tests on a device, you'll need two provisioning
+profile for EarlGrey and OCHamcrest frameworks:

[marq (ping after 24h), 2017/02/22 14:51:21]

profiles

[lody, 2017/02/22 14:52:30]

profiles

[sdefresne, 2017/02/23 09:10:54]

Done.

[sdefresne, 2017/02/23 09:10:55]

Done.

+
+-   `${prefix}.test.OCHamcrest`
+-   `${prefix}.test.EarlGrey`
+
+In addition to that, the you'll need one additional Provisioning Profile for

[marq (ping after 24h), 2017/02/22 14:51:20]

No caps on provisioning profile

[lody, 2017/02/22 14:52:30]

remove the

[sdefresne, 2017/02/23 09:10:54]

It was supposed to be "then".

[sdefresne, 2017/02/23 09:10:55]

Done.

+the xctest module too. This module Bundle Identifier depends on whether the

[marq (ping after 24h), 2017/02/22 14:51:20]

No caps on bundle identifier.

[marq (ping after 24h), 2017/02/22 14:51:21]

XCTest?

[sdefresne, 2017/02/23 09:10:55]

Done.

[sdefresne, 2017/02/23 09:10:55]

Done.

+gn variable `ios_automatically_manage_certs` is set to true or false. If set
+to true, then `${prefix}.test.gtest.generic-unit-test.generic-unit-test-module`
+will be used, otherwise it will match the following pattern:
+`${prefix}.test.${test-suite-name}.${test-suite-name}-module`.
+
+### Other applications
+
+Other applications like `ios_web_shell` usually will require Mobile Provisioning
+Profiles with a Bundle Identifier that may usually match the following pattern
+`${prefix}.${application-name}` and may require specific capabilities.
+
+Generally, if the Mobile Provisioning is missing then the code signing step
+will fails and will print the Bundle Identifier of the bundle the could not

[marq (ping after 24h), 2017/02/22 14:51:21]

... will fail ... 
... bundle that could not be ...

[lody, 2017/02/22 14:52:30]

will fail

[lody, 2017/02/22 14:52:30]

the = that?

[sdefresne, 2017/02/23 09:10:54]

Done.

[sdefresne, 2017/02/23 09:10:55]

Done.

[sdefresne, 2017/02/23 09:10:55]

Done.

+be signed on the command line, e.g.:
+
+```shell
+$ ninja -C out/Debug-iphoneos ios_web_shell
+ninja: Entering directory `out/Debug-iphoneos'
+FAILED: ios_web_shell.app/ios_web_shell ios_web_shell.app/_CodeSignature/CodeResources ios_web_shell.app/embedded.mobileprovision
+python ../../build/config/ios/codesign.py code-sign-bundle -t=iphoneos -i=0123456789ABCDEF0123456789ABCDEF01234567 -e=../../build/config/ios/entitlements.plist -b=obj/ios/web/shell/ios_web_shell ios_web_shell.app
+Error: no mobile provisioning profile found for "org.chromium.ios-web-shell".
+ninja: build stopped: subcommand failed.
+```
+
+Here, the build is failing because there are no Mobile Provisioning Profile

[marq (ping after 24h), 2017/02/22 14:51:21]

mobile provisioning profiles (no caps, plural)

[sdefresne, 2017/02/23 09:10:54]

Done.

+installed that could sign the `ios_web_shell.app` bundle with the identity
+`0123456789ABCDEF0123456789ABCDEF01234567`. To fix the build, you'll need to
+request from Apple such a Mobile Provisioning Profile.

[marq (ping after 24h), 2017/02/22 14:51:20]

... request such a mobile provisioning profile from Apple.

[sdefresne, 2017/02/23 09:10:54]

Done.

+
+You can inspect the file passed via the `-e` flag to the `codesign.py` script
+to check which capabilites are required for the Mobile Provisioning Profile

[marq (ping after 24h), 2017/02/22 14:51:21]

no caps on mobile provisioning profile, here and below.

[sdefresne, 2017/02/23 09:10:55]

Done.

+(e.g. `src/build/config/ios/entitlements.plist` for the above build error,
+remember that the path are relative to the build directory, not to the source

[marq (ping after 24h), 2017/02/22 14:51:21]

... the path is ... (or, if this is plural, "the paths are").

[lody, 2017/02/22 14:52:30]

the path is, paths are

[sdefresne, 2017/02/23 09:10:54]

Done.

[sdefresne, 2017/02/23 09:10:55]

Done.

+directory).
+
+If the required capabilities are not enabled on the Mobile Provisioning Profile,
+then it will be impossible to install the application on a device (Xcode will

[marq (ping after 24h), 2017/02/22 14:51:21]

XCode

[sdefresne, 2017/02/23 09:10:55]

Apple uses "Xcode", see for example https://developer.apple.com/xcode/.

+print an error stating that "The application was signed with invalid

[marq (ping after 24h), 2017/02/22 14:51:21]

print -> display

[sdefresne, 2017/02/23 09:10:55]

Done.

+entitlements").
+
 ## Running apps from the commandline
 
 Any target that is built and runs on the bots (see [below](#Troubleshooting))