This is a long lead time item

Just to confirm: is the MD5 is serving as anything more than a checksum here? I don't think being able to prevent an update through engineering a collision is security relevant, but if it needs to be resistant to preimaging for some reason we should use a modern hash function.

We have decided to use a Murmur2 hash. You are right, we are not using the hash as anything more than a checksum and are not using a cryptographically secure hash

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ccf35305af4fba3e1cd73bb9ce032fe9063d0eea

commit ccf35305af4fba3e1cd73bb9ce032fe9063d0eea
Author: pkotwicz <pkotwicz@chromium.org>
Date: Wed Aug 17 18:13:36 2016

Take Murmur2 hash of untransformed icon when creating WebAPK

This CL makes WebApkInstaller take the Murmur2 hash of the bitmap at the icon
URL prior to any transformations being applied to the bitmap (such as
encoding/decoding the bitmap). The icon hash is used to determine whether the
icon that the user sees matches the icon of a WebAPK that the server generated
for another user.

The icon could be dynamically generated and:
- use the same icon URL for all users
- be visually different for each user

If the hashes match the server can vend the WebAPK that it
previously generated to other users. Vending previously generated WebAPKs is
faster than creating a new WebAPK for each "create WebAPK" request.

BUG= 624059 
TEST=WebApkIconHasherTest

Review-Url: https://codereview.chromium.org/2231843003
Cr-Commit-Position: refs/heads/master@{#412586}

[add] https://crrev.com/ccf35305af4fba3e1cd73bb9ce032fe9063d0eea/chrome/browser/android/webapk/webapk_icon_hasher.cc
[add] https://crrev.com/ccf35305af4fba3e1cd73bb9ce032fe9063d0eea/chrome/browser/android/webapk/webapk_icon_hasher.h
[add] https://crrev.com/ccf35305af4fba3e1cd73bb9ce032fe9063d0eea/chrome/browser/android/webapk/webapk_icon_hasher_unittest.cc
[modify] https://crrev.com/ccf35305af4fba3e1cd73bb9ce032fe9063d0eea/chrome/browser/android/webapk/webapk_installer.cc
[modify] https://crrev.com/ccf35305af4fba3e1cd73bb9ce032fe9063d0eea/chrome/browser/android/webapk/webapk_installer.h
[modify] https://crrev.com/ccf35305af4fba3e1cd73bb9ce032fe9063d0eea/chrome/browser/android/webapk/webapk_installer_unittest.cc
[modify] https://crrev.com/ccf35305af4fba3e1cd73bb9ce032fe9063d0eea/chrome/chrome_browser.gypi
[modify] https://crrev.com/ccf35305af4fba3e1cd73bb9ce032fe9063d0eea/chrome/chrome_tests_unit.gypi

This bug is not completely fixed. ManifestUpgradeDetectorFetcher needs to use WebApkIconHasher.

I suspect that:
- ManifestUpgradeDetector#requireUpgrade() will no longer need to check whether FetchedData#icon is null (A Web Manifest with no icon is not WebAPK compatible)
- some tests in ManifestUpgradeDetectorTest will become obsolete (e.g. ManifestUpgradeDetectorTest#testHomescreenIconUrlsRemovedShouldNotUpgrade())
- integration tests will need to be added to ManifestUpgradeDetectorFetcherTest

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9190e10d578823e6e353d55cf9f3c436d8dc1099

commit 9190e10d578823e6e353d55cf9f3c436d8dc1099
Author: pkotwicz <pkotwicz@chromium.org>
Date: Fri Sep 16 16:20:37 2016

Take Murmur2 hash of untransformed icon when creating WebAPK part 2/2

This CL makes ManifestUpgradeDetectorFetcher take the Murmur2 hash of the bitmap
at the icon URL prior to any transformations being applied to the bitmap (such
as encoding/decoding the bitmap). The icon hash is used to determine whether the
icon that the user sees matches the icon of a WebAPK that the server generated
for another user.

The icon could be dynamically generated and:
- use the same icon URL for all users
- be visually different for each user

If the hashes match the server can vend the WebAPK that it
previously generated to other users. Vending previously generated WebAPKs is
faster than creating a new WebAPK for each "create WebAPK" request.

BUG= 624059 
TEST=ManifestUpgradeDetectorFetcherTest.*

Review-Url: https://codereview.chromium.org/2331773002
Cr-Commit-Position: refs/heads/master@{#419182}

[modify] https://crrev.com/9190e10d578823e6e353d55cf9f3c436d8dc1099/chrome/android/java/src/org/chromium/chrome/browser/webapps/ManifestUpgradeDetector.java
[modify] https://crrev.com/9190e10d578823e6e353d55cf9f3c436d8dc1099/chrome/android/java/src/org/chromium/chrome/browser/webapps/ManifestUpgradeDetectorFetcher.java
[modify] https://crrev.com/9190e10d578823e6e353d55cf9f3c436d8dc1099/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebApkUpdateManager.java
[modify] https://crrev.com/9190e10d578823e6e353d55cf9f3c436d8dc1099/chrome/android/javatests/src/org/chromium/chrome/browser/webapps/ManifestUpgradeDetectorFetcherTest.java
[modify] https://crrev.com/9190e10d578823e6e353d55cf9f3c436d8dc1099/chrome/android/junit/src/org/chromium/chrome/browser/webapps/ManifestUpgradeDetectorTest.java
[modify] https://crrev.com/9190e10d578823e6e353d55cf9f3c436d8dc1099/chrome/browser/android/webapk/manifest_upgrade_detector_fetcher.cc
[modify] https://crrev.com/9190e10d578823e6e353d55cf9f3c436d8dc1099/chrome/browser/android/webapk/manifest_upgrade_detector_fetcher.h