BUILD.gn

import("//brave/build/config.gni")
import("//build/config/mac/base_rules.gni")
import("//build/util/version.gni")
import("//chrome/common/features.gni")
import("//third_party/widevine/cdm/widevine.gni")

declare_args() {
  # find with `security find-identity -v -p codesigning`
  mac_signing_identifier = ""
  mac_installer_signing_identifier = ""
  mac_signing_keychain = "login"
  mac_signing_output_prefix = "signing"
  mac_signed_output_prefix = "signed"
  notary_user = ""
  notary_password = ""
  notarize = false
  notarize_argument = "False"
}

group("brave") {}

ds_store_file_name = "DS_Store"
dmg_icon_file_name = "dmg"

if (brave_channel != "") {
  ds_store_file_name = "DS_Store.$brave_channel"
  dmg_icon_file_name = "dmg-$brave_channel"
}
dmg_background_image = rebase_path("//brave/build/mac/dmg-background.png")
ds_store = rebase_path("//brave/build/mac/$ds_store_file_name")
dmg_icon = rebase_path("//brave/build/mac/$dmg_icon_file_name.icns")

if (skip_signing) {
  action("unsigned_dmg") {
    brave_app = "$root_build_dir/$brave_exe"
    output = "$root_out_dir/unsigned_dmg/$brave_dmg"
    script = "//build/gn_run_binary.py"
    shell_script = "//chrome/installer/mac/pkg-dmg"

    inputs = [
      script,
      shell_script,
    ]
    outputs = [ output ]
    args = [
      rebase_path(shell_script, root_build_dir),
      "--source", "/var/empty",
      "--target", "unsigned_dmg/$brave_dmg",
      "--format", "UDBZ",
      "--verbosity", "0",
      "--volname", "$chrome_product_full_name",
      "--copy", rebase_path(brave_app, root_build_dir),
      "--tempdir", "/tmp",
      "--mkdir", ".background",
      "--copy", "$dmg_background_image:/.background/dmg-background.png",
      "--copy", "$ds_store:/.DS_Store",
      "--icon", "$dmg_icon",
      "--symlink", "/Applications",
    ]

    deps = [
      "//brave:chrome_app",
      "//chrome/installer/mac"
    ]

    if (enable_widevine_cdm_host_verification) {
      deps += [ ":sign_chrome_framework_for_widevine" ]
    }
  }

  if (enable_widevine_cdm_host_verification) {
    action("sign_chrome_framework_for_widevine") {
      script = "//third_party/widevine/scripts/signature_generator.py"

      chrome_framework_name = chrome_product_full_name + " Framework"
      target_app_path = "$root_out_dir/$chrome_product_full_name.app"

      brave_version_path = "$target_app_path/Contents/Frameworks/$chrome_framework_name.framework/Versions/$chrome_version_full"
      framework_file = "$brave_version_path/$chrome_framework_name"
      signature_file = "$brave_version_path/Resources/$chrome_framework_name.sig"

      flags = 1  # blessed binary

      sources = [
        "$root_out_dir/$brave_exe"
      ]

      outputs = [
        signature_file,
      ]

      args = [
        "--input_file",
        rebase_path(framework_file, root_build_dir),
        "--output_file",
        rebase_path(signature_file, root_build_dir),
        "--flags",
        "$flags",
        "--certificate",
        getenv("SIGN_WIDEVINE_CERT"),
        "--private_key",
        getenv("SIGN_WIDEVINE_KEY"),
        "--private_key_passphrase",
        getenv("SIGN_WIDEVINE_PASSPHRASE"),
      ]

      deps = [ "//brave:chrome_app" ]
    }
  }
} else {
  packaging_dir = "$root_out_dir/" + string_replace("$chrome_product_full_name Packaging", " ", "_")
  target_sign_app_path = "$root_out_dir/$mac_signing_output_prefix/" + string_replace("$chrome_product_full_name", " ", "") + "-$chrome_version_full/$brave_exe"
  unsigned_pkg_path = "$root_out_dir/unsigned/$brave_pkg"
  keychain_db = getenv("HOME") + "/Library/Keychains/${mac_signing_keychain}.keychain-db"

  action("sign_app") {
    script = "//build/gn_run_binary.py"
    shell_script = "//brave/build/mac/sign_app.sh"

    deps = [
      "//brave:chrome_app",
      "//chrome/installer/mac",
      ":copies",
    ]

    if (is_official_build) {
      if (brave_channel == "") {
        provisioning_profile = "//brave/build/mac/release.provisionprofile"
      } else {
        provisioning_profile = "//brave/build/mac/${brave_channel}.provisionprofile"
      }
      is_development = "False"
    } else {
      # an empty dummy file just to simplify things
      provisioning_profile = "//brave/build/mac/dummy.provisionprofile"
      is_development = "True"
    }
    if (notarize) {
      notarize_argument = "True"
    }

    inputs = [
      script,
      shell_script,
      "$root_build_dir/$brave_exe",
      provisioning_profile,
      "$packaging_dir/app-entitlements.plist",
    ]
    outputs = [ target_sign_app_path ]
    args = [
      rebase_path(shell_script, root_out_dir),

      # Use absolute paths needed by codesign
      rebase_path(root_build_dir),
      rebase_path("$root_out_dir/$mac_signing_output_prefix"),
      rebase_path(packaging_dir),
      is_development,
      rebase_path(provisioning_profile, root_out_dir),
      keychain_db,
      mac_signing_identifier,
      notarize_argument,
      notary_user,
      notary_password
    ]
  }

  copy("copies") {
    visibility = [ ":sign_app" ]

    sources = [
      "//brave/app/helper-entitlements.plist",
    ]

    outputs = [
      "$packaging_dir/{{source_file_part}}"
    ]
  }

  action("create_pkg") {
    script = "//build/gn_run_binary.py"
    shell_script = "//brave/build/mac/create_pkg.sh"
    inputs = [
      script,
      target_sign_app_path,
      shell_script,
    ]
    outputs = [ unsigned_pkg_path ]
    args = [
      rebase_path(shell_script, root_build_dir),
      rebase_path(target_sign_app_path, root_build_dir),
      rebase_path("//brave/build/mac/pkg-scripts"),
      rebase_path("$root_out_dir/Brave Browser Component.plist"),
      "unsigned/$brave_pkg",
    ]

    deps = [":sign_app"]
  }

  action("sign_pkg") {
    script = "//build/gn_run_binary.py"
    shell_script = "sign_pkg.sh"
    inputs = [
      script,
      shell_script,
      unsigned_pkg_path,
    ]
    outputs = [ "${root_out_dir}/$mac_signed_output_prefix/$brave_pkg" ]
    args = [
      rebase_path(shell_script, root_build_dir),
      rebase_path(unsigned_pkg_path),
      rebase_path("$root_out_dir/$mac_signed_output_prefix/$brave_pkg"),
      keychain_db,
      mac_installer_signing_identifier,
    ]

    deps = [":create_pkg"]
  }

  unsigned_dmg = "$root_out_dir/unsigned/$brave_dmg"
  action("create_dmg") {
    script = "//build/gn_run_binary.py"
    shell_script = "//chrome/installer/mac/pkg-dmg"
    inputs = [
      script,
      shell_script,
      target_sign_app_path,
    ]
    outputs = [ unsigned_dmg ]
    args = [
      rebase_path(shell_script, root_build_dir),
      "--source", "/var/empty",
      "--target", "unsigned/$brave_dmg",
      "--format", "UDBZ",
      "--verbosity", "2",
      "--volname", "$chrome_product_full_name",
      "--copy", rebase_path(target_sign_app_path, root_build_dir),
      "--tempdir", "/tmp",
      "--mkdir", ".background",
      "--copy", "$dmg_background_image:/.background/dmg-background.png",
      "--copy", "$ds_store:/.DS_Store",
      "--icon", "$dmg_icon",
      "--symlink", "/Applications",
    ]

    deps = [":sign_app"]
  }

  action("sign_dmg") {
    script = "//build/gn_run_binary.py"
    shell_script = "sign_dmg.sh"
    inputs = [
      script,
      shell_script,
      unsigned_dmg,
    ]
    outputs = [ "${root_out_dir}/$mac_signed_output_prefix/$brave_dmg" ]
    args = [
      rebase_path(shell_script, root_build_dir),
      rebase_path(unsigned_dmg),
      rebase_path("$root_out_dir/$mac_signed_output_prefix/$brave_dmg"),
      keychain_db,
      mac_signing_identifier,
      "-r=designated => identifier \"$chrome_product_full_name\" and certificate leaf = H\"$mac_signing_identifier\"",
    ]

    deps = [":create_dmg"]
  }

  copy("copy_notarize_script") {

    sources = [ "notarize_dmg_pkg.py" ]

    outputs = [
      "$packaging_dir/{{source_file_part}}"
    ]

  }

  action("notarize_dmg_pkg") {
    if (notarize) {
      if (is_official_build) {
        development_arg = ""
        if (brave_channel == "") {
          provisioning_profile = "//brave/build/mac/release.provisionprofile"
        } else {
          provisioning_profile = "//brave/build/mac/${brave_channel}.provisionprofile"
        }
      } else {
        development_arg = "--development"
        provisioning_profile = "//brave/build/mac/dummy.provisionprofile"
      }

      script = "$packaging_dir/notarize_dmg_pkg.py"
      inputs = [
        script,
        "$root_out_dir/$mac_signed_output_prefix/$brave_dmg",
        "$root_out_dir/$mac_signed_output_prefix/$brave_pkg",
      ]
      outputs = [
        "$root_out_dir/$brave_dmg",
        "$root_out_dir/$brave_pkg",
      ]
      args = [
        "--keychain",
        keychain_db,
        "--identity",
        mac_signing_identifier,
        "--notary-user",
        notary_user,
        "--notary-password",
        notary_password,
        development_arg,
        "--dmg",
        rebase_path("$root_out_dir/$mac_signed_output_prefix/$brave_dmg"),
        "--pkg",
        rebase_path("$root_out_dir/$mac_signed_output_prefix/$brave_pkg"),
        "--signed",
        rebase_path("$root_out_dir/$mac_signed_output_prefix"),
        "--outdir",
        rebase_path("$root_out_dir"),
        "--pkgdir",
        rebase_path(packaging_dir),
        "--mac_provisioning_profile",
        rebase_path(provisioning_profile)
      ]
      deps = [
        ":sign_dmg",
        ":sign_pkg",
        ":copy_notarize_script"
      ]
    } else {
      print("Notarization of .dmg and .pkg not requested.")
    }
  }
}