GitLab

Update rules2 in app_resource_rules.plist.in to a set of rules that ought to work on 10.9.5 and 10.10, with the latest Gatekeeper policy changes.

This removes the “nested” tag from the live versioned directory, so that
it will be treated as data instead of code. There are problems with
“nested” validation of unversioned frameworks. There are other problems
with “nested” allowing components to be replaced, although these can be
overcome by creatively applying designated requirements to the nested
components. The non-“nested” version allows us to not version the
frameworks, which would introduce symbolic links and weaken v1 code
signature validation as done by pre-10.9 systems because v1 code
signatures do not consider symbolic links. This non-“nested” version is
also the simplest change to the existing set of resource rules that
works. The v2 rules2 dictionary is now identical to the v1 rules
dictionary.

In order for rules2 to be honored and for a v2 signature to be produced,
the app must be signed on 10.9 or later. (This will also produce a v1
signature to be validated on pre-10.9 systems.)

BUG=399276
R=rsesek@chromium.org

Review URL: https://codereview.chromium.org/533943003

Cr-Commit-Position: refs/heads/master@{#293142}