GitLab

For a given bundle ID, the inner framework is bit-for-bit identical, but
each attempt to sign it will result in a different code signature due to
at least the signature timestamp varying.

Binary diff updates rely on the framework being bit-for-bit identical,
including the code signature, for a given version and product ID. Builds
are produced that vary solely in parameters in the outer app bundle, not
the inner framework, such as the channel and brand code.

In particular, failing to have bit-for-bit identical frameworks in cases
where two copies should have varied only in brand code has resulted in
diff updaters that fail to apply to new installs the first time an
update is attempted.

By saving the first framework signed for a specific bundle ID and
recycling it for any subsequent attempts to sign the framework for that
same bundle ID, these new code signatures that only vary in their
timestamp can be avoided. This meets the bit-for-bit identical guarantee
for the framework.

Bug: 976827
Change-Id: I5326a05376c2a2e0aaa86c0e28c36409539b5352
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1687792Reviewed-by: Robert Sesek <rsesek@chromium.org>
Commit-Queue: Mark Mentovai <mark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#676644}