AU: Restrict the CA certificates to a smaller trusted set.

AU: Restrict the CA certificates to a smaller trusted set.

BUG=1969
TEST=unit tests, gmerged on device, updated successfully from
https://tools.google.com/service/update2; removed certs from directory
and update failed as expected

Change-Id: I18a04b0222a29249347aae56315bc35170063626

Committed: http://chrome-svn/viewvc/chromeos?view=rev&revision=3a4016a

[Chris Masone, 2010-09-28 18:16:40]

http://codereview.chromium.org/3475026/diff/2001/3001
File libcurl_http_fetcher.cc (right):

http://codereview.chromium.org/3475026/diff/2001/3001#newcode19
libcurl_http_fetcher.cc:19: const char kCACertificatesPath[] =
"/usr/share/update_engine/ca-certificates";
I forget...is /usr/share on the stateful partition or not?

[petkov, 2010-09-28 19:17:18]

http://codereview.chromium.org/3475026/diff/2001/3001
File libcurl_http_fetcher.cc (right):

http://codereview.chromium.org/3475026/diff/2001/3001#newcode19
libcurl_http_fetcher.cc:19: const char kCACertificatesPath[] =
"/usr/share/update_engine/ca-certificates";
On 2010/09/28 18:16:41, Chris Masone wrote:
> I forget...is /usr/share on the stateful partition or not?

/usr/share is not a special mount -- it's off of / (i.e., it's read-only, not
part of stateful). Also, according to
http://www.pathname.com/fhs/2.2/fhs-4.11.html, /usr/share is for read-only data
files, so I think it all makes sense.

[Chris Masone, 2010-09-28 20:46:19]

Cool.  I just always forget.

LGTM

On Tue, Sep 28, 2010 at 12:17 PM, <petkov@chromium.org> wrote:

>
> http://codereview.chromium.org/3475026/diff/2001/3001
> File libcurl_http_fetcher.cc (right):
>
> http://codereview.chromium.org/3475026/diff/2001/3001#newcode19
> libcurl_http_fetcher.cc:19: const char kCACertificatesPath[] =
> "/usr/share/update_engine/ca-certificates";
> On 2010/09/28 18:16:41, Chris Masone wrote:
>
>> I forget...is /usr/share on the stateful partition or not?
>>
>
> /usr/share is not a special mount -- it's off of / (i.e., it's
> read-only, not part of stateful). Also, according to
> http://www.pathname.com/fhs/2.2/fhs-4.11.html, /usr/share is for
> read-only data files, so I think it all makes sense.
>
>
> http://codereview.chromium.org/3475026/show
>