The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c83d846a78e4d291bee8681bab917af7b9e12faf

commit c83d846a78e4d291bee8681bab917af7b9e12faf
Author: rsesek <rsesek@chromium.org>
Date: Thu Jun 09 14:59:24 2016

[Mac/iOS/GN] copy_bundle_data.py should preserve symlinks.

Bundled directory structures use symlinks relative to other components in the
bundle, and those should be preserved as symlinks, rather than copying the
file contents.

BUG= 297668 , 604809 
R=sdefresne@chromium.org

Review-Url: https://codereview.chromium.org/2050963002
Cr-Commit-Position: refs/heads/master@{#398880}

[modify] https://crrev.com/c83d846a78e4d291bee8681bab917af7b9e12faf/build/toolchain/mac/copy_bundle_data.py

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/51dc7dae178061bfcc559f16d85e43f2695efacf

commit 51dc7dae178061bfcc559f16d85e43f2695efacf
Author: rsesek <rsesek@chromium.org>
Date: Thu Jun 09 15:13:31 2016

[Mac/GN] Add //build/config/mac/package_framework.py.

This moves another step performed by gyp-mac-tool into a standalone script. In
addition, support for more top-level bundle directories (e.g. Helpers, XPCServices,
etc.) is added.

BUG= 616813 , 604809 
R=sdefresne@chromium.org

Review-Url: https://codereview.chromium.org/2055673002
Cr-Commit-Position: refs/heads/master@{#398884}

[modify] https://crrev.com/51dc7dae178061bfcc559f16d85e43f2695efacf/build/config/mac/base_rules.gni
[add] https://crrev.com/51dc7dae178061bfcc559f16d85e43f2695efacf/build/config/mac/package_framework.py

Is this fixed now? I don't even really understand what this is asking for. Does it need to block shipping a GN-built Mac binary, or dropping GYP support?

More work to do but it doesn't block shipping Mac GN.

ack.

What more is there to do on this?

Changing how the framework is bundled.

How much work is that, and what is the ETA? I'm checking in with miguelg@ to see where they are with notifications, but obviously they are blocked until this change is made.

XPC services will require making the Chromium Framework versioned (as described here: https://docs.google.com/document/d/1h7eNZbdFyrM6r6taJxHuW-GQm34FJSFqmfwZkEj3eAA/edit), so filed  issue 648757  to track that work in GN.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5ebcfa81e37ff1ebb2ef4baf00096598631c5aa2

commit 5ebcfa81e37ff1ebb2ef4baf00096598631c5aa2
Author: rsesek <rsesek@chromium.org>
Date: Fri Sep 23 22:50:20 2016

[Mac/GN] Add a package_type option to mac_app_bundle.

The default is to produce a .app bundle. This CL also adds an option to produce
a .xpc bundle, which is a MH_EXECUTE-type bundle structure with a different
extension.

BUG= 604809 

Review-Url: https://codereview.chromium.org/2369583002
Cr-Commit-Position: refs/heads/master@{#420760}

[modify] https://crrev.com/5ebcfa81e37ff1ebb2ef4baf00096598631c5aa2/build/config/mac/rules.gni

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b233427ef84931c5ae089e5e6b13743ab597de9d

commit b233427ef84931c5ae089e5e6b13743ab597de9d
Author: rsesek <rsesek@chromium.org>
Date: Fri Oct 28 21:11:47 2016

[Mac] Version the Chromium Framework if enable_xpc_notifications is true.

This is to support XPCServices, which require that the framework directory
be versioned in order to locate the service.

BUG= 604809 

Review-Url: https://codereview.chromium.org/2459063002
Cr-Commit-Position: refs/heads/master@{#428491}

[modify] https://crrev.com/b233427ef84931c5ae089e5e6b13743ab597de9d/chrome/BUILD.gn

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5a1ebea8a247366ac822858e141983037a1f0059

commit 5a1ebea8a247366ac822858e141983037a1f0059
Author: rsesek <rsesek@chromium.org>
Date: Thu Feb 02 14:10:03 2017

[Mac] Version the //chrome:chrome_framework bundle.

BUG= 604809 , 662466 
TBR=dpranke@chromium.org

Review-Url: https://codereview.chromium.org/2484283003
Cr-Commit-Position: refs/heads/master@{#447763}

[modify] https://crrev.com/5a1ebea8a247366ac822858e141983037a1f0059/chrome/BUILD.gn

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/35483db6126d73c64f467503ece03c6a119d0a68

commit 35483db6126d73c64f467503ece03c6a119d0a68
Author: Robert Sesek <rsesek@chromium.org>
Date: Thu Feb 02 15:30:39 2017

[Merge to 2998 for test build] [Mac] Version the //chrome:chrome_framework bundle.

BUG= 604809 , 662466 
TBR=dpranke@chromium.org

Review-Url: https://codereview.chromium.org/2484283003
Cr-Commit-Position: refs/heads/master@{#447763}
(cherry picked from commit 5a1ebea8a247366ac822858e141983037a1f0059)

Review-Url: https://codereview.chromium.org/2676593003 .
Cr-Commit-Position: refs/branch-heads/2998@{#5}
Cr-Branched-From: 2a9afa9fbfc5d76d668f3aeb70894f83d4686886-refs/heads/master@{#447146}

[modify] https://crrev.com/35483db6126d73c64f467503ece03c6a119d0a68/chrome/BUILD.gn

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d46123678f9f8e22c6210134bdbcfdb3e49b3bf2

commit d46123678f9f8e22c6210134bdbcfdb3e49b3bf2
Author: rsesek <rsesek@chromium.org>
Date: Thu Feb 02 19:26:21 2017

Revert of [Mac] Version the //chrome:chrome_framework bundle. (patchset #1 id:1 of https://codereview.chromium.org/2484283003/ )

Reason for revert:
Failed to sign in the official test build on 2998 (see https://crbug.com/688076).

Original issue's description:
> [Mac] Version the //chrome:chrome_framework bundle.
>
> BUG= 604809 , 662466 
> TBR=dpranke@chromium.org
>
> Review-Url: https://codereview.chromium.org/2484283003
> Cr-Commit-Position: refs/heads/master@{#447763}
> Committed: https://chromium.googlesource.com/chromium/src/+/5a1ebea8a247366ac822858e141983037a1f0059

TBR=miguelg@google.com,miguelg@chromium.org,dpranke@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= 604809 , 662466 

Review-Url: https://codereview.chromium.org/2669213003
Cr-Commit-Position: refs/heads/master@{#447816}

[modify] https://crrev.com/d46123678f9f8e22c6210134bdbcfdb3e49b3bf2/chrome/BUILD.gn

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/66d62f64ba8e8b3408211546710dce9cb4f6545b

commit 66d62f64ba8e8b3408211546710dce9cb4f6545b
Author: Robert Sesek <rsesek@chromium.org>
Date: Thu Feb 16 20:01:20 2017

[Merge to 3012 for test build] [Mac] Version the //chrome:chrome_framework bundle.

BUG= 604809 , 662466 
TBR=dpranke@chromium.org

Review-Url: https://codereview.chromium.org/2484283003
Cr-Commit-Position: refs/heads/master@{#447763}
(cherry picked from commit 5a1ebea8a247366ac822858e141983037a1f0059)

Review-Url: https://codereview.chromium.org/2703653002 .
Cr-Commit-Position: refs/branch-heads/3012@{#10}
Cr-Branched-From: 66847e854d3acd13965764bcbc72d38f455c463c-refs/heads/master@{#450199}

[modify] https://crrev.com/66d62f64ba8e8b3408211546710dce9cb4f6545b/chrome/BUILD.gn

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/247dfa7270288b09ff4ff433e616408102b51755

commit 247dfa7270288b09ff4ff433e616408102b51755
Author: rsesek <rsesek@chromium.org>
Date: Fri Feb 17 02:07:45 2017

Reland of [Mac] Version the //chrome:chrome_framework bundle. (patchset #1 id:1 of https://codereview.chromium.org/2669213003/ )

Reason for revert:
Test build on 3012 passed.

Original issue's description:
> Revert of [Mac] Version the //chrome:chrome_framework bundle. (patchset #1 id:1 of https://codereview.chromium.org/2484283003/ )
>
> Reason for revert:
> Failed to sign in the official test build on 2998 (see https://crbug.com/688076).
>
> Original issue's description:
> > [Mac] Version the //chrome:chrome_framework bundle.
> >
> > BUG= 604809 , 662466 
> > TBR=dpranke@chromium.org
> >
> > Review-Url: https://codereview.chromium.org/2484283003
> > Cr-Commit-Position: refs/heads/master@{#447763}
> > Committed: https://chromium.googlesource.com/chromium/src/+/5a1ebea8a247366ac822858e141983037a1f0059
>
> TBR=miguelg@google.com,miguelg@chromium.org,dpranke@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG= 604809 , 662466 
>
> Review-Url: https://codereview.chromium.org/2669213003
> Cr-Commit-Position: refs/heads/master@{#447816}
> Committed: https://chromium.googlesource.com/chromium/src/+/d46123678f9f8e22c6210134bdbcfdb3e49b3bf2

TBR=miguelg@google.com,miguelg@chromium.org,dpranke@chromium.org
NOTRY=true
BUG= 604809 , 662466 

Review-Url: https://codereview.chromium.org/2700013002
Cr-Commit-Position: refs/heads/master@{#451175}

[modify] https://crrev.com/247dfa7270288b09ff4ff433e616408102b51755/chrome/BUILD.gn

The framework is now versioned, so all the prerequisites for adding XPC services should now be met.

As part of adding an actual XPC service to the bundle, the signing scripts will need to be updated. But that has to be done when actually including the .xpc in the bundle and can't be done before. The specific files are:

https://cs.chromium.org/chromium/src/chrome/installer/mac/sign_versioned_dir.sh.in?sq=package:chromium&dr=C to sign the .xpc bundle itself
https://cs.chromium.org/chromium/src/chrome/installer/mac/sign_app.sh.in?sq=package:chromium&dr=C to verify the signature of nested contents

Ca we do it in two steps? 

1) Include the xpc in the bundle but not sign it. Alerts will still be displayed as banners in that case

2) Sign the bundle

No, it must be done in the same step.

https://developer.apple.com/library/content/technotes/tn2206/_index.html

"From Mavericks onwards, signatures record nested code by its code signature and embed that information in the (outer) signature's resource envelope, recursively. This means that when a code signature is created, all nested code must already be signed correctly or the signing attempt will fail."