provisioning profile and entitlement support on mac #319

RyanJarv · 2018-08-10T18:05:06Z

This was added upstream which ended up breaking the the signing scripts
and caused the osx build to not start.

We might be ok reverting the changes if necessary like in faed762 but i'd prefer to not worry about what that might break down the line.

Upstream signing changes:
https://chromium.googlesource.com/chromium/src.git/+/4d80b33e7c64069cb69041c4957ea77ecf6e14e8

Original more descriptive but reverted commit:
https://chromium.googlesource.com/chromium/src.git/+/b69d8c48da838196d9655402dd739e62227762a7

Submitter Checklist:

Submitted a ticket for my issue if one did not already exist.
Used Github auto-closing keywords in the commit message.
Added/updated tests for this change (for new code or code which already has tests).
Ran git rebase -i to squash commits (if needed).
Tagged reviewers and labelled the pull request as needed.
Request a security/privacy review as needed.

Test Plan:

Reviewer Checklist:

New files have MPL-2.0 license header.
Request a security/privacy review as needed.
Adequate test coverage exists to prevent regressions

RyanJarv · 2018-08-10T22:24:57Z

@simonhong

I ended up hard coding the MAC_TEAM_ID here since I wasn't sure what the right way to do it was. I don't think this is an issue but would be interested if you have any thoughts on it.

simonhong · 2018-08-12T00:11:34Z

BUILD.gn

@@ -348,7 +348,7 @@ if (is_mac) {
    info_plist_target = ":brave_app_plist"

    extra_substitutions = [
-      "CHROMIUM_BUNDLE_ID=$chrome_mac_bundle_id",
+      "CHROMIUM_BUNDLE_ID=$chrome_mac_bundle_id.$brave_channel",


Is this change needed w/o changes in below BRANDING.dev?
$chrome_mac_bundle_id comes from the value of MAC_BUNDLE_ID.

We should consider stable channel. In that case, id would be org.brave.Brave.
Last dot should be removed in stable channel.

I'll go ahead and open an issue for this if that works, have some changes for this but needs more testing.

simonhong · 2018-08-12T00:55:01Z

app/theme/brave/BRANDING.dev

@@ -5,6 +5,6 @@ PRODUCT_SHORTNAME=Brave
 PRODUCT_INSTALLER_FULLNAME=Brave Installer
 PRODUCT_INSTALLER_SHORTNAME=Brave Installer
 COPYRIGHT=Copyright 2016 The Brave Authors. All rights reserved.
-MAC_BUNDLE_ID=org.brave.Brave.dev
+MAC_BUNDLE_ID=org.brave.Brave


Hmm, to support multi channel install, we should have different bundle id.
Are there any reason why you should delete .dev from ID?

Ok meant to bring this up as well. I may need to dig back through why this was an issue but it came down to MAC_BUNDLE_ID set's the base for any other helper's that need to be signed as well.

Ran into issues when everything was prefixed by org.brave.Brave.dev (i.e org.brave.Brave.dev.BraveHelper). I also remembered seeing somewhere that chrome doesn't actually modify these during build time, always has them set to org.brave.Brave but then during signing changes it to the correct value (will try to find references to this). Then taking a look at the app id's in the chrome canary package it seems only the root app itself is using the channel postfix.

So this is mainly to match that behavior which resolved one of the signing issues I was running into with the update to 69.

I'm unsure if this is the ideal way of doing things but, currently having it updated here:
https://github.com/brave/brave-core/pull/319/files#diff-4eaebbcd1dc0da11e3a3ce488290bfc6R350

Would appreciate any thoughts you have here.

If this change doesn't affect multi channel install support, I'm fine with this PR.
I'll test it with this PR and share it.

With this PR and below change, I finished dev channel app signing.
However, I got code sign error when I run it after install.
Can you run installed app with this PR?

Also, I can't multi channel install test because I don't have other channel provision files.
I'm not sure but I need to create provision profile of my mac account and need different provisionprofile for each channel?

diff --git a/build/mac/BUILD.gn b/build/mac/BUILD.gn index 0dddf74..d29b69a 100644 --- a/build/mac/BUILD.gn +++ b/build/mac/BUILD.gn @@ -35,7 +35,7 @@ action("sign_app") { rebase_path(_packaging_dir), keychain_db, mac_signing_identifier, - provisioning_profile, + rebase_path(provisioning_profile), ] deps = [ "//brave:chrome_app",

Also, all other BRANDING files should be modified like this file.

simonhong · 2018-08-15T23:03:22Z

I think #319 (comment) should be addressed.
Current PR would make stable's id to org.brave.Brave.
I think it should be org.brave.Brave - last dot removed.

When I installed and run from dev channel dmg with this PR, I got code sign error.
Can you run it on your machine?

Also each channel's provision profile should be included to build dmg on local.
After provision profile is introduced, can we build dmg and use it on local?

This reverts commit 440b849, reversing changes made to 71dd3c9. Revert "Use the correct path for mac provisioning profile" This reverts commit 575a971. These reversions were made to remove some duplicate commits that accidentally got pushed in the 0.53.x branch during WIP PR: #319

RyanJarv · 2018-08-24T01:52:16Z

Sorry for the delay here, I'm going to set to wip till this is better tested.

simonhong · 2018-09-05T03:40:18Z

chromium_src/base/mac/foundation_util.mm should be checked, too.

const char* BaseBundleID() {
  if (base_bundle_id) {
    return base_bundle_id;
  }

#if !defined(OFFICIAL_BUILD)
  return "org.brave.Brave.development";
#else
  switch (chrome::GetChannel()) {
    case version_info::Channel::CANARY:
      return "org.brave.Brave.nightly";
    case version_info::Channel::DEV:
      return "org.brave.Brave.dev";
    case version_info::Channel::BETA:
      return "org.brave.Brave.beta";
    case version_info::Channel::STABLE:
    case version_info::Channel::UNKNOWN:
    default:
      return "org.brave.Brave";
  }
#endif
}

Fix dev app id on mac To beable to support provisioning profiles the main app id needs to be set as org.brave.Brave.dev with all the other frameworks/helper apps falling directly under org.brave.Brave.<whatever>. Checked upstream canary builds and this is how it is done there as well. (cherry picked from commit 8146e3c) provisioning profile and entitlement support on mac This was added upstream which ended up breaking the the signing scripts and caused the osx build to not start. We might be ok reverting the changes if necessary like in faed762 but i'd prefer to not worry about what that might break down the line. Upstream signing changes: https://chromium.googlesource.com/chromium/src.git/+/4d80b33e7c64069cb69041c4957ea77ecf6e14e8 Original more descriptive but reverted commit: https://chromium.googlesource.com/chromium/src.git/+/b69d8c48da838196d9655402dd739e62227762a7 (cherry picked from commit 43a9802) Use the correct path for mac provisioning profile (cherry picked from commit b344827) Update team_id for BRANDING.dev Update branding files to match dev This updates the branding files to match dev to support the recent provisoning and entitlement related changes. Update Apple app id's to use com.brave.Browser and add all profiles Needed because com.brave.Brave wasn't available for every release we needed. Update OSX signing requirements and BRANDING files Update mac app id in foundation_util.mm

RyanJarv · 2018-09-05T12:30:20Z

This can be merged. Will go ahead and open a ticket to address the app id concatenation for release, but would like to leave it as is for now since this is well tested and would like to get this merged.

…pdate2 Remaining NTP Updates

simonhong reviewed Aug 12, 2018

View reviewed changes

RyanJarv force-pushed the fix/osx-signing branch from 8728167 to 4132651 Compare August 15, 2018 19:00

RyanJarv force-pushed the fix/osx-signing branch from 4132651 to 9a28948 Compare August 17, 2018 18:19

NejcZdovc assigned RyanJarv Aug 23, 2018

RyanJarv added the pr/work-in-progress label Aug 24, 2018

RyanJarv changed the title ~~provisioning profile and entitlement support on mac~~ [WIP] provisioning profile and entitlement support on mac Aug 24, 2018

RyanJarv force-pushed the fix/osx-signing branch from 1b7e298 to 5e0749e Compare August 24, 2018 03:07

bbondy changed the title ~~[WIP] provisioning profile and entitlement support on mac~~ WIP: provisioning profile and entitlement support on mac Sep 3, 2018

RyanJarv closed this Sep 5, 2018

RyanJarv force-pushed the fix/osx-signing branch from 5e0749e to ebbd9f9 Compare September 5, 2018 12:19

RyanJarv reopened this Sep 5, 2018

RyanJarv force-pushed the fix/osx-signing branch from 5937cad to 1b2b1b6 Compare September 5, 2018 12:29

RyanJarv changed the title ~~WIP: provisioning profile and entitlement support on mac~~ provisioning profile and entitlement support on mac Sep 5, 2018

bbondy approved these changes Sep 5, 2018

View reviewed changes

RyanJarv mentioned this pull request Sep 5, 2018

Apple app ID incorrect on release builds brave/brave-browser#970

Closed

RyanJarv merged commit b205464 into master Sep 5, 2018

RyanJarv deleted the fix/osx-signing branch September 5, 2018 13:34

RyanJarv removed the pr/work-in-progress label Sep 5, 2018

RyanJarv mentioned this pull request Sep 5, 2018

Update mac app id in development build #401

Merged

petemill pushed a commit to petemill/brave-core that referenced this pull request Jul 5, 2019

Imported from brave-ui: Merge pull request brave#319 from brave/ntp-u…

cbd77c4

…pdate2 Remaining NTP Updates

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

provisioning profile and entitlement support on mac #319

provisioning profile and entitlement support on mac #319

RyanJarv commented Aug 10, 2018 •

edited

Loading

RyanJarv commented Aug 10, 2018 •

edited

Loading

simonhong Aug 12, 2018 •

edited

Loading

RyanJarv Sep 5, 2018

simonhong Aug 12, 2018 •

edited

Loading

RyanJarv Aug 13, 2018 •

edited

Loading

simonhong Aug 14, 2018

simonhong Aug 14, 2018 •

edited

Loading

simonhong Aug 14, 2018

RyanJarv Aug 15, 2018

simonhong commented Aug 15, 2018 •

edited

Loading

RyanJarv commented Aug 24, 2018

simonhong commented Sep 5, 2018

RyanJarv commented Sep 5, 2018 •

edited

Loading

provisioning profile and entitlement support on mac #319

provisioning profile and entitlement support on mac #319

Conversation

RyanJarv commented Aug 10, 2018 • edited Loading

Submitter Checklist:

Test Plan:

Reviewer Checklist:

RyanJarv commented Aug 10, 2018 • edited Loading

simonhong Aug 12, 2018 • edited Loading

Choose a reason for hiding this comment

RyanJarv Sep 5, 2018

Choose a reason for hiding this comment

simonhong Aug 12, 2018 • edited Loading

Choose a reason for hiding this comment

RyanJarv Aug 13, 2018 • edited Loading

Choose a reason for hiding this comment

simonhong Aug 14, 2018

Choose a reason for hiding this comment

simonhong Aug 14, 2018 • edited Loading

Choose a reason for hiding this comment

simonhong Aug 14, 2018

Choose a reason for hiding this comment

RyanJarv Aug 15, 2018

Choose a reason for hiding this comment

simonhong commented Aug 15, 2018 • edited Loading

RyanJarv commented Aug 24, 2018

simonhong commented Sep 5, 2018

RyanJarv commented Sep 5, 2018 • edited Loading

RyanJarv commented Aug 10, 2018 •

edited

Loading

RyanJarv commented Aug 10, 2018 •

edited

Loading

simonhong Aug 12, 2018 •

edited

Loading

simonhong Aug 12, 2018 •

edited

Loading

RyanJarv Aug 13, 2018 •

edited

Loading

simonhong Aug 14, 2018 •

edited

Loading

simonhong commented Aug 15, 2018 •

edited

Loading

RyanJarv commented Sep 5, 2018 •

edited

Loading