Activate keychain reauthorization.

chrome/installer/mac/sign_app.sh.in

 #!/bin/bash -p
 
 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Using codesign, sign the application. After signing, the signatures on the
 # inner bundle components are verified, and the application's own signature is
 # verified. Inner bundle components are expected to be signed before this
 # script is called. See sign_versioned_dir.sh.
@@ skipping 29 matching lines @@
 versioned_dir="${app_path}/Contents/Versions/@VERSION@"
 
 browser_app="${app_path}"
 framework="${versioned_dir}/@MAC_PRODUCT_NAME@ Framework.framework"
 notification_service="${framework}/XPCServices/AlertNotificationService.xpc"
 crashpad_handler="${framework}/Helpers/crashpad_handler"
 helper_app="${versioned_dir}/@MAC_PRODUCT_NAME@ Helper.app"
 
 requirement_string="\
 designated => \
 (identifier \"com.google.Chrome\" or identifier \"com.google.Chrome.canary\") \

[Mark Mentovai, 2017/03/10 00:56:46]

Since we’ve got to do the reauthorization now anyway, let’s expand this a bit to
avoid a potential reauthorization in the future, for when we split other
channels out for side-by-side installation (if we do that).

(identifier \"com.google.Chrome\" or \
identifier \"com.google.Chrome.beta\" or \
identifier \"com.google.Chrome.dev\" or \
identifier \"com.google.Chrome.canary\") and \
(certificate leaf = H\"85cee8254216185620ddc8851c7a9fc4dfe120ef\" or \
certificate leaf = H\"c9a99324ca3fcb23dbcc36bd5fd4f9753305130a\")

[Greg K, 2017/03/10 18:06:29]

Done.

 and (certificate leaf = H\"85cee8254216185620ddc8851c7a9fc4dfe120ef\" or \
-certificate leaf = H\"34f0bdf7f87d4f3a955862c351472e52250e4c2b\") \
+certificate leaf = H\"c9a99324ca3fcb23dbcc36bd5fd4f9753305130a\") \
 "
 
 enforcement_flags="restrict"
 
 codesign --sign "${codesign_id}" --keychain "${codesign_keychain}" \
     "${browser_app}" --resource-rules "${browser_app_rules}" \
     -r="${requirement_string}" --options "${enforcement_flags}"
 
 # Show the signature.
 codesign --display -r- -vvvvvv "${browser_app}"
@@ skipping 17 matching lines @@
 
 cleanup() {
   set +e
   rm -rf "${temp_dir}"
 }
 trap cleanup EXIT
 
 temp_browser_app="${temp_dir}/$(basename "${browser_app}")"
 rsync -a "${browser_app}/" "${temp_browser_app}"
 spctl --assess -vv "${temp_browser_app}"