Work around GTE CyberTrust/Baltimore CyberTrust cross-signing issues

net/cert/test_root_certs_mac.cc

Index: net/cert/test_root_certs_mac.cc
diff --git a/net/cert/test_root_certs_mac.cc b/net/cert/test_root_certs_mac.cc
index 18ae0d610ad77ef1cb6a9c89d8d1fa05ccb26fa8..57533c35a63d10d9d19c05fbdefc413b6be7f370 100644
--- a/net/cert/test_root_certs_mac.cc
+++ b/net/cert/test_root_certs_mac.cc
@@ -71,7 +71,11 @@ OSStatus TestRootCerts::FixupSecTrustRef(SecTrustRef trust_ref) const {
   OSStatus status = SecTrustSetAnchorCertificates(trust_ref, temporary_roots_);
   if (status)
     return status;
-  return SecTrustSetAnchorCertificatesOnly(trust_ref, false);
+  return SecTrustSetAnchorCertificatesOnly(trust_ref, !allow_system_trust_);
+}
+
+void TestRootCerts::SetAllowSystemTrust(bool allow_system_trust) {
+  allow_system_trust_ = allow_system_trust;
 }
 
 TestRootCerts::~TestRootCerts() {}
@@ -79,6 +83,7 @@ TestRootCerts::~TestRootCerts() {}
 void TestRootCerts::Init() {
   temporary_roots_.reset(CFArrayCreateMutable(kCFAllocatorDefault, 0,
                                               &kCertArrayCallbacks));
+  allow_system_trust_ = true;

[wtc, 2013/04/29 19:14:57]

Is it convenient to initialize allow_system_trust_ in the
constructor? Otherwise tools such as Coverity may report
an uninitialized class member.

[Ryan Sleevi, 2013/04/29 21:28:23]

No. We use |Init()| to handle the per-OS initialization of members.

This is the same as how empty_ is treated, and it doesn't trigger any warnings.
Init() is called by the CTOR, FWIW.

[wtc, 2013/04/29 22:53:42]

I see. I didn't know that (I didn't check test_root_certs.cc)
when I reviewed the CL. Sorry about my confusion.

 }
 
 }  // namespace net