Re the file-to-file copy, so far I haven't been able to come up with a satisfactory method of doing so... What I was originally thinking was to add to the mojo Blob interface a something like a "SaveToFile(mojo_base.mojom.File)" method. That would all be nice and secure even if a renderer can call it (since you can only write to files you can open somehow, and by having access to the BlobPtr you were already granted access to the blob contents), but it doesn't actually let us optimize the file-to-file copy case. The Blob implementation of that method might know it is itself a single file, but only having an open file pointer isn't good enough to be able to do an efficient file-to-file copy (i.e. the base::CopyFile method needs file paths, not files. In particularly because the underlying windows CopyFile API needs paths).

But I can't think of anything that involves passing a file path over the mojo pipe that would still be secure (as we don't want to let renderers that have a BlobPtr be able to just write that blob to arbitrary paths on disk). I guess having some static global base::UnguessableToken in the browser process that IDB code could pass together with a path to a Blob mojo method would work, but would also be really ugly (and if we ever move to IDB in the renderer process of course none of this would work either).
</ramble>