Reauthorize Keychain to Replace Developer ID Certificate

chrome/browser/mac/keychain_reauthorize.h

Index: chrome/browser/mac/keychain_reauthorize.h
diff --git a/chrome/browser/mac/keychain_reauthorize.h b/chrome/browser/mac/keychain_reauthorize.h
new file mode 100644
index 0000000000000000000000000000000000000000..3a5184376b201964559f1cb85933da19b588b40a
--- /dev/null
+++ b/chrome/browser/mac/keychain_reauthorize.h
@@ -0,0 +1,37 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_MAC_KEYCHAIN_REAUTHORIZE_H_
+#define CHROME_BROWSER_MAC_KEYCHAIN_REAUTHORIZE_H_
+
+#ifdef __OBJC__
+@class NSString;
+#else
+class NSString;
+#endif
+
+namespace chrome {
+
+// Calls KeychainReauthorize, but only if it's determined that it's necessary.

[Mark Mentovai, 2017/03/02 02:59:32]

KeychainReauthorize is a hidden function, an implementation detail of the other
file. It doesn’t make any sense out here. We shouldn’t talk about it here, but
its name comes up in this comment a few times.

[Greg K, 2017/03/02 18:54:14]

Done.

+// pref_key is looked up in the system's standard user defaults (preferences)
+// and if its integer value is less than max_tries, KeychainReauthorize is
+// attempted. Before the attempt, the preference is incremented, allowing a
+// finite number of incomplete attempts at performing the KeychainReauthorize
+// operation. When the step completes successfully, the preference is set to
+// max_tries to prevent further attempts, and the preference name with the

[Mark Mentovai, 2017/03/02 02:59:32]

It doesn’t set it to max_tries, it just sets the success one, which is also
checked before jumping into the reauthorization.

[Greg K, 2017/03/02 18:54:14]

Done.

+// word "Success" appended is also stored with a boolean value of YES,
+// disambiguating between the cases where the step completed successfully and
+// the step completed unsuccessfully while reaching the maximum number of
+// tries.
+//
+// The system's standard user defaults for the application are used
+// (~/Library/Preferences/com.google.Chrome.plist,
+// com.google.Chrome.canary.plist, etc.) instead of Chrome preferences because
+// Keychain access is tied more closely to the bundle identifier and signed
+// product than it is to any specific profile (--user-data-dir).
+void KeychainReauthorizeIfNeeded(NSString* pref_key, int max_tries);
+
+}  // namespace chrome
+
+#endif  // CHROME_BROWSER_MAC_KEYCHAIN_REAUTHORIZE_H_