Reauthorize Keychain to Replace Developer ID Certificate

chrome/installer/mac/sign_app.sh.in

 #!/bin/bash -p
 
 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Using codesign, sign the application. After signing, the signatures on the
 # inner bundle components are verified, and the application's own signature is
 # verified. Inner bundle components are expected to be signed before this
 # script is called. See sign_versioned_dir.sh.
@@ skipping 30 matching lines @@
 
 browser_app="${app_path}"
 framework="${versioned_dir}/@MAC_PRODUCT_NAME@ Framework.framework"
 notification_service="${framework}/XPCServices/AlertNotificationService.xpc"
 crashpad_handler="${framework}/Helpers/crashpad_handler"
 helper_app="${versioned_dir}/@MAC_PRODUCT_NAME@ Helper.app"
 
 requirement_string="\
 designated => \
 (identifier \"com.google.Chrome\" or identifier \"com.google.Chrome.canary\") \
-and certificate leaf = H\"85cee8254216185620ddc8851c7a9fc4dfe120ef\"\
+and (certificate leaf = H\"85cee8254216185620ddc8851c7a9fc4dfe120ef\" or \
+certificate leaf = H\"34f0bdf7f87d4f3a955862c351472e52250e4c2b\") \

[Mark Mentovai, 2017/03/02 02:59:32]

Verifying that 34f0bdf7f87d4f3a955862c351472e52250e4c2b is correct. That looks
like what you have here. The “new” one expires 2019-07-31.

[Greg K, 2017/03/02 18:54:14]

Acknowledged.

 "
 
 enforcement_flags="restrict"
 
 codesign --sign "${codesign_id}" --keychain "${codesign_keychain}" \
     "${browser_app}" --resource-rules "${browser_app_rules}" \
     -r="${requirement_string}" --options "${enforcement_flags}"
 
 # Show the signature.
 codesign --display -r- -vvvvvv "${browser_app}"
@@ skipping 17 matching lines @@
 
 cleanup() {
   set +e
   rm -rf "${temp_dir}"
 }
 trap cleanup EXIT
 
 temp_browser_app="${temp_dir}/$(basename "${browser_app}")"
 rsync -a "${browser_app}/" "${temp_browser_app}"
 spctl --assess -vv "${temp_browser_app}"