Google Git
Sign in
chromium / chromium / src / ce54860c90a34590b5295addf82f6863e444a63f / . / chrome / installer / mac / signing
tree: e77032edb9ac78886d883b6d9bd652f78569481d [path history] [tgz]
  1. .gitignore
  2. __init__.py
  3. build_props_config.py.in
  4. chromium_config.py
  5. commands.py
  6. commands_test.py
  7. config.py
  8. model.py
  9. model_test.py
  10. modification.py
  11. modification_test.py
  12. notarize.py
  13. notarize_test.py
  14. pipeline.py
  15. pipeline_test.py
  16. README.md
  17. run_mac_signing_tests.py
  18. signing.py
  19. signing_test.py
  20. test_common.py
  21. test_config.py
chrome/installer/mac/signing/README.md

Signing Scripts for Chrome on macOS

This directory contains Python modules that modify the Chrome application bundle for various release channels, sign the resulting bundle, package it into .dmg/.pkg files for distribution, and sign those resulting .dmg/.pkg files.

Invoking

The scripts are invoked using the driver located at //chrome/installer/mac/sign_chrome.py. In order to sign a binary, a signing identity is required. Googlers can use the internal development identity; otherwise you can create a self-signed identity.

A sample invocation to use during development would be:

$ ninja -C out/release chrome chrome/installer/mac
$ ./out/release/Chromium\ Packaging/sign_chrome.py --input out/release --output /tmp/signed --identity 'MacOS Developer' --development --disable-packaging

The --disable-packaging flag skips the creation of DMG and PKG files, which speeds up the signing process when one is only interested in a signed .app bundle. The --development flag skips over code signing requirements and checks that do not work without the official Google signing identity.

Chromium

The signing scripts do not work out-of-the-box with a Chromium build. Until https://crbug.com/1021255 is fixed, in order to have a working (i.e. launch-able), signed Chromium:

  1. Edit chrome/app/app-entitlements.plist and remove the following key/value pairs:
    • com.apple.application-identifier
    • keychain-access-groups
    • com.apple.developer.associated-domains.applinks.read-write
  2. touch out/<outdir>/Chromium\ Packaging/keystone_install.sh
  3. Run sign_chrome.py as documented above.

Note that the Chromium code sign config only produces one Distribution to sign just the .app. An is_chrome_build=true build produces several Distributions for the official release system.

Running Tests

Simply run the wrapper script at //chrome/installer/mac/signing/run_mac_signing_tests.py.

You can pass --coverage or -c to show coverage information. To generate a HTML coverage report and Python coverage package is available (via pip install coverage), run:

coverage3 run -m unittest discover -p '*_test.py'
coverage3 html

Formatting

The code is automatically formatted with YAPF. Run:

git cl format --python