NSSCertDatabaseChromeOS

net/cert/cert_database.h

Index: net/cert/cert_database.h
diff --git a/net/cert/cert_database.h b/net/cert/cert_database.h
index feadf4c1d0856d8795cc9f0690fd84000414e090..3ba98455138429ec64a016388a307f4a62118ce7 100644
--- a/net/cert/cert_database.h
+++ b/net/cert/cert_database.h
@@ -16,6 +16,8 @@ template <class ObserverType> class ObserverListThreadSafe;
 
 namespace net {
 
+class NSSCertDatabase;
+
 // This class provides cross-platform functions to verify and add user
 // certificates, and to observe changes to the underlying certificate stores.
 
@@ -85,6 +87,12 @@ class NET_EXPORT CertDatabase {
   void OnAndroidKeyChainChanged();
 #endif
 
+#if defined(USE_NSS)
+  // Observe events from the |source| and forward them to observers of this
+  // CertDatabase.
+  void ObserveNSSCertDatabase(NSSCertDatabase* source);

[Ryan Sleevi, 2013/12/18 21:28:32]

Per our discussion, this is temporary, right?

If so, please open a tracking bug (to fix the CertDatabase::GetInstance()
callers) and let's fix this.

Also, should it be public, or should it be private + friend class to
NSSCertDatabase? Since this feels like a "Temporary while refactoring", I'd
prefer the latter.

[mattm, 2013/12/19 22:35:00]

Hm, even after making CertDatabase a per-profile object, CertDatabase and
NSSCertDatabase would still be separate, I still think we need something like
this to combine the events from both. I might be forgetting something we
discussed.
If we friend the NSSCertDatabase, this could actually all be much simpler.
NSSCertDatabase could just directly call the CertDatabase->NotifyObservers
methods and we could drop the Notifier helper and the observer lists on
NSSCertDatabase, etc.

[Ryan Sleevi, 2013/12/20 01:35:19]

Both CertDatabase and NSSCertDatabase are objects that should be
threaded-through per-profile.

When the IOThread initializes its CertDatabase, for the NSS case, it can
construct a CertDatabaseNSS and pass the NSSCertDatabase in (or we can fold
NSSCertDatabase back into CertDatabaseNSS if-and-only-if the only accesses to
the "NSS-specific" stuff is done at chrome/ or higher).

IIRC, the NSS-specific bits are used by chromeos/ as well, but beyond that, it's
all at chrome/?

Anyways, we can address this in a follow-up, but I think we've got a good
transition away from this dependency graph, and the "friend" is just to keep the
dependencies from growing.

+#endif
+
  private:
   friend struct DefaultSingletonTraits<CertDatabase>;