The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ca55c1b22e7d29645ce9a5396b0d778bb1ee024c

commit ca55c1b22e7d29645ce9a5396b0d778bb1ee024c
Author: mark <mark@chromium.org>
Date: Wed Jul 13 04:40:17 2016

Update UDIFResourceFile struct definition with code signature data

In  https://crbug.com/620831 , I worked out how code signatures are added
to .dmg files. These signatures can be added, verified, and displayed by
codesign on 10.11.5 and later.

This adds the fields to the 'koly' block that point to the signature
data, but does not process or interpret the signature in any way. The
UDIFResourceFile struct in udif.cc is a more appropriate location to
maintain knowledge of the 'koly' block's layout than some random closed
bug report.

BUG= 620381 , 627605 

Review-Url: https://codereview.chromium.org/2145603002
Cr-Commit-Position: refs/heads/master@{#405023}

[modify] https://crrev.com/ca55c1b22e7d29645ce9a5396b0d778bb1ee024c/chrome/utility/safe_browsing/mac/udif.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ca55c1b22e7d29645ce9a5396b0d778bb1ee024c

commit ca55c1b22e7d29645ce9a5396b0d778bb1ee024c
Author: mark <mark@chromium.org>
Date: Wed Jul 13 04:40:17 2016

Update UDIFResourceFile struct definition with code signature data

In  https://crbug.com/620831 , I worked out how code signatures are added
to .dmg files. These signatures can be added, verified, and displayed by
codesign on 10.11.5 and later.

This adds the fields to the 'koly' block that point to the signature
data, but does not process or interpret the signature in any way. The
UDIFResourceFile struct in udif.cc is a more appropriate location to
maintain knowledge of the 'koly' block's layout than some random closed
bug report.

BUG= 620381 , 627605 

Review-Url: https://codereview.chromium.org/2145603002
Cr-Commit-Position: refs/heads/master@{#405023}

[modify] https://crrev.com/ca55c1b22e7d29645ce9a5396b0d778bb1ee024c/chrome/utility/safe_browsing/mac/udif.cc

I’m happy to consult and discuss, but this should be owned by someone in safebrowsing-land.

auk@, does bineval has any plan for this new type of signature? 

auk@ -- please let us know if bineval has any plan for this new type of signature and then assign the bug back to me. Thanks!

Our team have plans to start building reputation for mac downloads soon. We have a mac pipeline running in production and will start reputation work once scoring decision is more reliable. DMG signature will definitely be used as one of the signals used to build mac download reputation.

Removing SafeBrowsing-Triaged since this needs re-look.

mark@, I'm trying to digest these mac feature extraction code and get confused. It might be a super dumb question...

What's the relationship between the code signature extracted by UDIFParser and the one by MachOImageReader::GetCodeSignatureInfo(..)? 

The entire DMG file itself can have a code signature, and then individual Mach-O files inside the DMG may also have signatures attached. There's not necessarily a relationship between the signature of the DMG and its contents.

https://developer.apple.com/library/content/technotes/tn2206/_index.html#//apple_ref/doc/uid/DTS40007919-CH1-TNTAG18 has more info.

Ah, I see! I'll talk to auk@ to add an extra field in ClientDownloadRequest::SignatureInfo (csd.proto) to hold the dmg file signature then.  

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/276eacb1c63fa58b1fce7e668690c2b53a853f3b

commit 276eacb1c63fa58b1fce7e668690c2b53a853f3b
Author: mortonm <mortonm@google.com>
Date: Wed Jul 12 17:46:11 2017

Record Code Signature of Downloaded DMG files: As of MacOS 10.11.5, DMG file
metadata includes a signature for the disk image itself, in addition to code
signatures on individual executables within the archive. This change records
the DMG signature for uploading via SafeBrowsing pings.

BUG= 627605 

Review-Url: https://codereview.chromium.org/2934373002
Cr-Commit-Position: refs/heads/master@{#486012}

[modify] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/chrome/browser/safe_browsing/download_protection_service.cc
[modify] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/chrome/browser/safe_browsing/download_protection_service_unittest.cc
[modify] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/chrome/browser/safe_browsing/sandboxed_dmg_analyzer_mac_unittest.cc
[modify] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/chrome/common/safe_browsing/archive_analyzer_results.h
[modify] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/chrome/common/safe_browsing/safe_archive_analyzer_param_traits.h
[modify] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/chrome/test/data/safe_browsing/mach_o/Makefile
[modify] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/chrome/test/data/safe_browsing/mach_o/README
[delete] https://crrev.com/b3a69b95bdaa7e2df899e7bb02b0c7680748bdd4/chrome/test/data/safe_browsing/mach_o/codesign.keychain
[add] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/chrome/test/data/safe_browsing/mach_o/signed-archive-signature.data
[add] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/chrome/test/data/safe_browsing/mach_o/signed-archive.dmg
[modify] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/chrome/utility/safe_browsing/mac/dmg_analyzer.cc
[modify] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/chrome/utility/safe_browsing/mac/dmg_iterator.cc
[modify] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/chrome/utility/safe_browsing/mac/dmg_iterator.h
[modify] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/chrome/utility/safe_browsing/mac/udif.cc
[modify] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/chrome/utility/safe_browsing/mac/udif.h
[modify] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/components/safe_browsing/csd.proto
[modify] https://crrev.com/276eacb1c63fa58b1fce7e668690c2b53a853f3b/tools/metrics/histograms/histograms.xml