*WIP* Store NSS slots per profile. Move keygen to chrome.

net/cert/cert_verify_proc_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_nss.h"
 
 #include <string>
 #include <vector>
 
 #include <cert.h>
@@ skipping 433 matching lines @@
     in_param.type = cert_pi_trustAnchors;
     in_param.value.pointer.chain = additional_trust_anchors;
     cvin.push_back(in_param);
     in_param.type = cert_pi_useOnlyTrustAnchors;
     in_param.value.scalar.b = PR_FALSE;
     cvin.push_back(in_param);
   }
   in_param.type = cert_pi_end;
   cvin.push_back(in_param);
 
+  // XXX can't specify slots here

[Ryan Sleevi, 2013/10/09 19:18:00]

Why would you need to? What's the thought?

[mattm, 2013/10/09 23:52:38]

Mentioned in an earlier reply, but was just thinking about the "Honor trust
roots per-profile" bug.  Cert verification needs to be profile aware in some
manner, right? I guess the comment is just saying I'm not sure yet how that will
work.

   SECStatus rv = CERT_PKIXVerifyCert(cert_handle, certificateUsageSSLServer,
                                      &cvin[0], cvout, NULL);
   if (rv != SECSuccess) {
     rv = RetryPKIXVerifyCertWithWorkarounds(cert_handle, num_policy_oids,
                                             cert_io_enabled, &cvin, cvout);
   }
   return rv;
 }
 
 // PKIXVerifyCert calls this function to work around some bugs in
@@ skipping 418 matching lines @@
     if (VerifyEV(cert_handle, flags, crl_set, check_revocation, metadata,
                  ev_policy_oid, trust_anchors.get())) {
       verify_result->cert_status |= CERT_STATUS_IS_EV;
     }
   }
 
   return OK;
 }
 
 }  // namespace net