Create separate archive of Mac packaging tools.

Create separate archive of Mac packaging tools.

This is in preparation for separating diff creation from signing,
similar to the Windows processing, and needed by the new signing
pipeline.

R=mark@chromium.org
BUG=b/31931170

Committed: https://crrev.com/24666393f4852f5d97b7b94ed750989dbf457e75
Cr-Commit-Position: refs/heads/master@{#426800}

[Mark Mentovai, 2016-10-21 03:24:56]

Diff creation needs to consume signed things and also produce signed things. It
sounds like that may mean that we have two distinct sign steps. Will that be a
problem?

[Michael Moss, 2016-10-21 03:41:48]

On 2016/10/21 03:24:56, Mark Mentovai wrote:
> Diff creation needs to consume signed things and also produce signed things.
It
> sounds like that may mean that we have two distinct sign steps. Will that be a
> problem?

Nope, that's exactly how Windows signing works. Sign the full installers. Create
one or more triggers indicating which signed installers you want to diff. Create
the diff(s). Sign the diff(s).

[Michael Moss, 2016-10-21 03:47:39]

On 2016/10/21 03:41:48, Michael Moss wrote:
> On 2016/10/21 03:24:56, Mark Mentovai wrote:
> > Diff creation needs to consume signed things and also produce signed things.
> It
> > sounds like that may mean that we have two distinct sign steps. Will that be
a
> > problem?
> 
> Nope, that's exactly how Windows signing works. Sign the full installers.
Create
> one or more triggers indicating which signed installers you want to diff.
Create
> the diff(s). Sign the diff(s).

This separation would also make it easier to setup a system to create diffs
against arbitrary versions, rather than just against the "latest" version, as
the scripts do now. This comes in quite handy for Windows, which creates diffs
against the 3 or 4 most used previous versions, thus allowing a much larger
percentage of users to upgrade with the diff rather than the full installer.

[Mark Mentovai, 2016-10-21 10:35:22]

Great. LGTM.

[Michael Moss, 2016-10-21 15:31:47]

The CQ bit was checked by mmoss@chromium.org

[commit-bot: I haz the power, 2016-10-21 15:32:02]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-10-21 15:50:02]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-10-21 16:04:45]

Description was changed from

==========
Create separate archive of Mac packaging tools.

This is in preparation for separating diff creation from signing,
similar to the Windows processing, and needed by the new signing
pipeline.

R=mark@chromium.org
BUG=b/31931170
==========

to

==========
Create separate archive of Mac packaging tools.

This is in preparation for separating diff creation from signing,
similar to the Windows processing, and needed by the new signing
pipeline.

R=mark@chromium.org
BUG=b/31931170

Committed: https://crrev.com/24666393f4852f5d97b7b94ed750989dbf457e75
Cr-Commit-Position: refs/heads/master@{#426800}
==========

[commit-bot: I haz the power, 2016-10-21 16:04:46]

Patchset 1 (id:??) landed as
https://crrev.com/24666393f4852f5d97b7b94ed750989dbf457e75
Cr-Commit-Position: refs/heads/master@{#426800}

[Mark Mentovai, 2016-10-21 16:16:33]

I don’t know what can and can’t happen on the new signing system, but we may
need to make it a 4-step, actually.

1. Sign inner components (once)
2. After sticking the signed inner components into channelized and branded apps,
sign each of those apps
3. Package the apps up into disk images, and sign the disk images
4. Build diffs given new signed disk images and previously-released signed disk
images, and then sign those

[Michael Moss, 2016-10-21 16:24:48]

On 2016/10/21 16:16:33, Mark Mentovai wrote:
> I don’t know what can and can’t happen on the new signing system, but we may
> need to make it a 4-step, actually.
> 
> 1. Sign inner components (once)
> 2. After sticking the signed inner components into channelized and branded
apps,
> sign each of those apps
> 3. Package the apps up into disk images, and sign the disk images
> 4. Build diffs given new signed disk images and previously-released signed
disk
> images, and then sign those

Those first 3 steps can happen all at once, and is what I referred to as "sign
the full installers". It's just the diffs that need to be separate because that
requires talking to omahaproxy and fetching old builds from cloud storage, but
the new signing system is much more restricted, so can't do those things.