NSSCertDatabaseChromeOS

chrome/browser/net/nss_context.h

Index: chrome/browser/net/nss_context.h
diff --git a/chrome/browser/net/nss_context.h b/chrome/browser/net/nss_context.h
index 0735df2d2b17b69f1e0c9f493b0fb76a239372f0..989c41488af176cd0ab45b161317f4c4fb8e414b 100644
--- a/chrome/browser/net/nss_context.h
+++ b/chrome/browser/net/nss_context.h
@@ -11,6 +11,10 @@
 #include "base/compiler_specific.h"
 #include "crypto/scoped_nss_types.h"
 
+namespace net {
+class NSSCertDatabase;
+}
+
 namespace content {
 class ResourceContext;
 }  // namespace content
@@ -29,4 +33,15 @@ crypto::ScopedPK11Slot GetPrivateNSSKeySlotForResourceContext(
     const base::Callback<void(crypto::ScopedPK11Slot)>& callback)
     WARN_UNUSED_RESULT;
 
+// Returns a pointer to the NSSCertDatabase for the user associated with
+// |context|, if it is ready. If it is not ready and |callback| is non-null, the
+// |callback| will be run once the DB is initialized. Ownership is not
+// transferred, but the caller may save the pointer, which will remain valid for
+// the lifetime of the process.

[Ryan Sleevi, 2013/12/13 19:16:59]

Process? Or IO thread?

It seems like the long-term goal is validity tied to the ResourceContext, which
your API should (artificially) restrict to here.

That is, I see no reason to commit to process-lifetime if the end-goal is
ResourceContext-lifetime.

[mattm, 2013/12/18 04:00:50]

Switched to ResourceContext-lifetime.

+// Should be called only on the IO thread.
+net::NSSCertDatabase* GetNSSCertDatabaseForResourceContext(
+    content::ResourceContext* context,
+    const base::Callback<void(net::NSSCertDatabase*)>& callback)
+    WARN_UNUSED_RESULT;

[Ryan Sleevi, 2013/12/13 19:16:59]

Unnecessary?

[mattm, 2013/12/18 04:00:50]

Think it's worthwhile for the same reason as the others: If you don't check the
return value, you can't know whether you need to wait for the callback or not.

+
 #endif  // CHROME_BROWSER_NET_NSS_CONTEXT_H_