Do Keychain reauthorization at update time

chrome/browser/chrome_browser_main_mac.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chrome_browser_main_mac.h"
 
 #import <Cocoa/Cocoa.h>
 
 #include "base/command_line.h"
 #include "base/debug/debugger.h"
@@ skipping 37 matching lines @@
 }
 
 // ChromeBrowserMainPartsMac ---------------------------------------------------
 
 ChromeBrowserMainPartsMac::ChromeBrowserMainPartsMac(
     const content::MainFunctionParams& parameters)
     : ChromeBrowserMainPartsPosix(parameters) {
 }
 
 void ChromeBrowserMainPartsMac::PreEarlyInitialization() {
+  if (parsed_command_line().HasSwitch(switches::kKeychainReauthorize)) {
+    if (base::mac::AmIBundled()) {
+      LOG(FATAL) << "Inappropriate process type for Keychain reauthorization";
+    }
+
+    // Do Keychain reauthorization at the time of update installation. This
+    // gets three chances to run. If the first or second try doesn't complete
+    // successfully (crashes or is interrupted for any reason), there will be
+    // another chance. Once this step completes successfully, it should never
+    // have to run again.
+    //
+    // This is kicked off by a special stub executable during an automatic
+    // update. See chrome/installer/mac/keychain_reauthorize_main.cc. This is
+    // done during update installation in additon to browser app launch to
+    // help reauthorize Keychain items for users who never restart Chrome.
+    NSString* const keychain_reauthorize_pref =
+        @"KeychainReauthorizeAtUpdateMay2012";

[TVL, 2012/05/16 20:05:10]

comment on when this key should be updated/changed?

+    const int kKeychainReauthorizeMaxTries = 3;
+    chrome::browser::mac::KeychainReauthorizeIfNeeded(
+        keychain_reauthorize_pref, kKeychainReauthorizeMaxTries);
+
+    exit(0);
+  }
+
   ChromeBrowserMainPartsPosix::PreEarlyInitialization();
 
   if (base::mac::WasLaunchedAsHiddenLoginItem()) {
     CommandLine* singleton_command_line = CommandLine::ForCurrentProcess();
     singleton_command_line->AppendSwitch(switches::kNoStartupWindow);
   }
 }
 
 void ChromeBrowserMainPartsMac::PreMainMessageLoopStart() {
   ChromeBrowserMainPartsPosix::PreMainMessageLoopStart();
@@ skipping 62 matching lines @@
   // change this, you'll probably need to change the Valgrind suppression.
   [nib instantiateNibWithOwner:NSApp topLevelObjects:nil];
   // Make sure the app controller has been created.
   DCHECK([NSApp delegate]);
 
   // Prevent Cocoa from turning command-line arguments into
   // |-application:openFiles:|, since we already handle them directly.
   [[NSUserDefaults standardUserDefaults]
       setObject:@"NO" forKey:@"NSTreatUnknownArgumentsAsOpen"];
 
-  // Do Keychain reauthorization. This gets two chances to run. If the first
-  // try doesn't complete successfully (crashes or is interrupted for any
-  // reason), there will be a second chance. Once this step completes
-  // successfully, it should never have to run again.
+  // Do Keychain reauthorization at browser app launch. This gets two chances
+  // to run. If the first try doesn't complete successfully (crashes or is
+  // interrupted for any reason), there will be a second chance. Once this
+  // step completes successfully, it should never have to run again.
   NSString* const keychain_reauthorize_pref =
       @"KeychainReauthorizeInAppMay2012";

[TVL, 2012/05/16 20:05:10]

same comment.  Might even make sense to move the constants up to the top of the
file to comment on how they differ?

   const int kKeychainReauthorizeMaxTries = 2;
 
   chrome::browser::mac::KeychainReauthorizeIfNeeded(
       keychain_reauthorize_pref, kKeychainReauthorizeMaxTries);
 }
 
 void ChromeBrowserMainPartsMac::DidEndMainMessageLoop() {
   AppController* appController = [NSApp delegate];
   [appController didEndMainMessageLoop];
 }