Use NSS to generate Origin-Bound Certs on Win and Mac.

net/net.gyp

 # Copyright (c) 2011 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 {
   'variables': {
     'chromium_code': 1,
 
     'linux_link_kerberos%': 0,
     'conditions': [
@@ skipping 229 matching lines @@
         'base/winsock_util.h',
         'base/x509_cert_types.cc',
         'base/x509_cert_types.h',
         'base/x509_cert_types_mac.cc',
         'base/x509_certificate.cc',
         'base/x509_certificate.h',
         'base/x509_certificate_mac.cc',
         'base/x509_certificate_nss.cc',
         'base/x509_certificate_openssl.cc',
         'base/x509_certificate_win.cc',
+        'base/x509_util.h',
+        'base/x509_util_nss.cc',
+        'base/x509_util_nss.h',
         'base/x509_util_openssl.cc',
         'base/x509_util_openssl.h',
         'disk_cache/addr.cc',
         'disk_cache/addr.h',
         'disk_cache/backend_impl.cc',
         'disk_cache/backend_impl.h',
         'disk_cache/bitmap.cc',
         'disk_cache/bitmap.h',
         'disk_cache/block_files.cc',
         'disk_cache/block_files.h',
@@ skipping 496 matching lines @@
             'sources!': [
               'base/cert_database_nss.cc',
               'base/crypto_module_nss.cc',
               'base/dnssec_keyset.cc',
               'base/dnssec_keyset.h',
               'base/keygen_handler_nss.cc',
               'base/nss_memio.c',
               'base/nss_memio.h',
               'base/test_root_certs_nss.cc',
               'base/x509_certificate_nss.cc',
+              'base/x509_util_nss.cc',
+              'base/x509_util_nss.h',
               'ocsp/nss_ocsp.cc',
               'ocsp/nss_ocsp.h',
               'socket/dns_cert_provenance_check.cc',
               'socket/dns_cert_provenance_check.h',
               'socket/nss_ssl_util.cc',
               'socket/nss_ssl_util.h',
               'socket/ssl_client_socket_nss.cc',
               'socket/ssl_client_socket_nss.h',
               'socket/ssl_server_socket_nss.cc',
               'socket/ssl_server_socket_nss.h',
@@ skipping 191 matching lines @@
         'base/ssl_client_auth_cache_unittest.cc',
         'base/ssl_config_service_unittest.cc',
         'base/ssl_false_start_blacklist_unittest.cc',
         'base/static_cookie_policy_unittest.cc',
         'base/transport_security_state_unittest.cc',
         'base/test_certificate_data.h',
         'base/test_completion_callback_unittest.cc',
         'base/upload_data_stream_unittest.cc',
         'base/x509_certificate_unittest.cc',
         'base/x509_cert_types_mac_unittest.cc',
+        'base/x509_util_nss_unittest.cc',
+        'base/x509_util_openssl_unittest.cc',
         'disk_cache/addr_unittest.cc',
         'disk_cache/backend_unittest.cc',
         'disk_cache/bitmap_unittest.cc',
         'disk_cache/block_files_unittest.cc',
         'disk_cache/cache_util_unittest.cc',
         'disk_cache/disk_cache_test_base.cc',
         'disk_cache/disk_cache_test_base.h',
         'disk_cache/entry_unittest.cc',
         'disk_cache/mapped_file_unittest.cc',
         'disk_cache/storage_block_unittest.cc',
@@ skipping 161 matching lines @@
             'http/http_auth_handler_negotiate_unittest.cc',
             'http/mock_gssapi_library_posix.cc',
             'http/mock_gssapi_library_posix.h',
           ],
         }],
         [ 'use_openssl==1', {
             # When building for OpenSSL, we need to exclude NSS specific tests.
             # TODO(bulach): Add equivalent tests when the underlying
             #               functionality is ported to OpenSSL.
             'sources!': [
+              'base/x509_util_nss_unittest.cc',
               'base/cert_database_nss_unittest.cc',
               'base/dnssec_unittest.cc',
             ],
           },
+          {  # else !use_openssl: remove the unneeded files

[wtc, 2011/10/17 19:09:27]

Put this on the previous line.  See line 1152 above for an
example.

[mattm, 2011/10/17 22:54:19]

Done.

+            'sources!': [
+              'base/x509_util_openssl_unittest.cc',
+            ],
+          },
         ],
         [ 'OS == "win"', {
             'sources!': [
               'dns/dns_config_service_posix_unittest.cc',
               'http/http_auth_gssapi_posix_unittest.cc',
             ],
             # This is needed to trigger the dll copy step on windows.
             # TODO(mark): Specifying this here shouldn't be necessary.
             'dependencies': [
               '../third_party/icu/icu.gyp:icudata',
+              '../third_party/nss/nss.gyp:nspr',
+              '../third_party/nss/nss.gyp:nss',
+              'third_party/nss/ssl.gyp:ssl',
             ],
           },
         ],
+        [ 'OS == "mac"', {
+            'dependencies': [
+              '../third_party/nss/nss.gyp:nspr',
+              '../third_party/nss/nss.gyp:nss',
+              'third_party/nss/ssl.gyp:ssl',
+            ],
+          },
+        ],
       ],
     },
     {
       'target_name': 'net_perftests',
       'type': 'executable',
       'dependencies': [
         'net',
         'net_test_support',
         '../base/base.gyp:base',
         '../base/base.gyp:base_i18n',
@@ skipping 391 matching lines @@
             'tools/dump_cache/url_to_filename_encoder.cc',
             'tools/dump_cache/url_to_filename_encoder.h',
             'tools/dump_cache/url_utilities.h',
             'tools/dump_cache/url_utilities.cc',
           ],
         },
       ],
     }],
   ],
 }