Record Code Signature of Downloaded DMG files

chrome/browser/safe_browsing/download_protection_service.cc

Index: chrome/browser/safe_browsing/download_protection_service.cc
diff --git a/chrome/browser/safe_browsing/download_protection_service.cc b/chrome/browser/safe_browsing/download_protection_service.cc
index aad28a885aeaddde13df3128d920789a185c623b..8dd5ba6a65bbb8c8f36d49049ecabea86a102d97 100644
--- a/chrome/browser/safe_browsing/download_protection_service.cc
+++ b/chrome/browser/safe_browsing/download_protection_service.cc
@@ -350,6 +350,10 @@ class DownloadProtectionService::CheckClientDownloadRequest
         tab_referrer_url_(item->GetTabReferrerUrl()),
         archived_executable_(false),
         archive_is_valid_(ArchiveValid::UNSET),
+#if defined(OS_MACOSX)
+        disk_image_signature_length_(0),
+        disk_image_signature_(nullptr),
+#endif
         callback_(callback),
         service_(service),
         binary_feature_extractor_(binary_feature_extractor),
@@ -785,6 +789,16 @@ class DownloadProtectionService::CheckClientDownloadRequest
     if (!service_)
       return;
 
+#if defined(OS_MACOSX)
+    disk_image_signature_length_ = results.signature_blob.size();
+    if (disk_image_signature_length_ > 0) {
+      disk_image_signature_ =
+          std::unique_ptr<uint8_t[]>(new uint8_t[disk_image_signature_length_]);
+      memcpy(disk_image_signature_.get(), results.signature_blob.data(),
+             disk_image_signature_length_);
+    }
+#endif
+
     // Even if !results.success, some of the DMG may have been parsed.
     archive_is_valid_ =
         (results.success ? ArchiveValid::VALID : ArchiveValid::INVALID);
@@ -1036,6 +1050,14 @@ class DownloadProtectionService::CheckClientDownloadRequest
           referrer_chain_data->GetReferrerChain());
     }
 
+// TODO(mortonm): add UMA stats to keep track of % of DMG use new format
+#if defined(OS_MACOSX)
+    if (disk_image_signature_length_ > 0) {
+      request.set_udif_code_signature(disk_image_signature_.get(),
+                                      disk_image_signature_length_);
+    }
+#endif
+
     if (archive_is_valid_ != ArchiveValid::UNSET)
       request.set_archive_valid(archive_is_valid_ == ArchiveValid::VALID);
     request.mutable_signature()->CopyFrom(signature_info_);
@@ -1231,6 +1253,11 @@ class DownloadProtectionService::CheckClientDownloadRequest
   bool archived_executable_;
   ArchiveValid archive_is_valid_;
 
+#if defined(OS_MACOSX)
+  uint64_t disk_image_signature_length_;
+  std::unique_ptr<uint8_t[]> disk_image_signature_;
+#endif
+
   ClientDownloadRequest_SignatureInfo signature_info_;
   std::unique_ptr<ClientDownloadRequest_ImageHeaders> image_headers_;
   google::protobuf::RepeatedPtrField<ClientDownloadRequest_ArchivedBinary>