tree 03fa15c84eb2ac18e9a43ff9ec58952eb2544840
parent fc813ef31ad1290946da9a8e9e127b98da3751f7
author Mark Rowe <markrowe@chromium.org> 1707427340 +0000
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> 1707427340 +0000

Add a helper tool to copy web app shims to their final destination

When using ad-hoc signing for web app shims, the final app shim must be
written to disk by this helper tool. This separate helper tool exists so
that binary authorization tools, such as Santa, can transitively trust
app shims that it creates without trusting all files written by Chrome.
This allows app shims to be trusted by the binary authorization tool
despite having only ad-hoc code signatures.

Care is taken to ensure that the helper tool is only invoked by a
program signed with the same code signing identity as the Chromium
framework to ensure that the helper tool cannot be used to arbitrarily
bypass binary authorization tools.

Bug: 1465647
Change-Id: I6fc993ca3cf74add2f68ba6e837007ec1ef0e7ba
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5080017
Reviewed-by: Daniel Murphy <dmurph@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Mark Rowe <markrowe@chromium.org>
Reviewed-by: Marijn Kruisselbrink <mek@chromium.org>
Reviewed-by: Dirk Pranke <dpranke@google.com>
Cr-Commit-Position: refs/heads/main@{#1258161}