Make Cast certificate verification enforce constraints specified in the trusted root certificate.

net/net.gypi

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # This file is shared between the regular GYP build, the NaCl GYP build, and
 # the GN build. For GN support, it must have no conditionals or anything like
 # that beyond the simple one-level-deep dictionary of values.
 {
   'variables': {
     # Subset of net source files that are compiled for NaCl (net_nacl target).
@@ skipping 2389 matching lines @@
       'data/url_request_unittest/redirect308-to-https.mock-http-headers',
       'data/url_request_unittest/simple.html',
       'data/url_request_unittest/simple.html.mock-http-headers',
       'data/url_request_unittest/two-content-lengths.html',
       'data/url_request_unittest/two-content-lengths.html.mock-http-headers',
       'data/url_request_unittest/with-headers.html',
       'data/url_request_unittest/with-headers.html.mock-http-headers',
       'data/verify_certificate_chain_unittest/basic-constraints-pathlen-0-self-issued.pem',
       'data/verify_certificate_chain_unittest/common.py',
       'data/verify_certificate_chain_unittest/expired-intermediary.pem',
+      'data/verify_certificate_chain_unittest/expired-root.pem',
       'data/verify_certificate_chain_unittest/expired-target-notBefore.pem',
       'data/verify_certificate_chain_unittest/expired-target.pem',
       'data/verify_certificate_chain_unittest/generate-all.sh',
       'data/verify_certificate_chain_unittest/generate-basic-constraints-pathlen-0-self-issued.py',
       'data/verify_certificate_chain_unittest/generate-expired-intermediary.py',
       'data/verify_certificate_chain_unittest/generate-expired-target-notBefore.py',
       'data/verify_certificate_chain_unittest/generate-expired-target.py',
       'data/verify_certificate_chain_unittest/generate-intermediary-basic-constraints-ca-false.py',
       'data/verify_certificate_chain_unittest/generate-intermediary-basic-constraints-not-critical.py',
       'data/verify_certificate_chain_unittest/generate-intermediary-lacks-basic-constraints.py',
@@ skipping 14 matching lines @@
       'data/verify_certificate_chain_unittest/generate-violates-basic-constraints-pathlen-0.py',
       'data/verify_certificate_chain_unittest/intermediary-basic-constraints-ca-false.pem',
       'data/verify_certificate_chain_unittest/intermediary-basic-constraints-not-critical.pem',
       'data/verify_certificate_chain_unittest/intermediary-lacks-basic-constraints.pem',
       'data/verify_certificate_chain_unittest/intermediary-lacks-signing-key-usage.pem',
       'data/verify_certificate_chain_unittest/intermediary-signed-with-md5.pem',
       'data/verify_certificate_chain_unittest/intermediary-unknown-critical-extension.pem',
       'data/verify_certificate_chain_unittest/intermediary-unknown-non-critical-extension.pem',
       'data/verify_certificate_chain_unittest/issuer-and-subject-not-byte-for-byte-equal-anchor.pem',
       'data/verify_certificate_chain_unittest/issuer-and-subject-not-byte-for-byte-equal.pem',
+      'data/verify_certificate_chain_unittest/non-self-signed-root.pem',
       'data/verify_certificate_chain_unittest/openssl_conf.py',
       'data/verify_certificate_chain_unittest/target-and-intermediary.pem',
       'data/verify_certificate_chain_unittest/target-has-keycertsign-but-not-ca.pem',
       'data/verify_certificate_chain_unittest/target-has-pathlen-but-not-ca.pem',
       'data/verify_certificate_chain_unittest/target-not-end-entity.pem',
       'data/verify_certificate_chain_unittest/target-signed-by-512bit-rsa.pem',
       'data/verify_certificate_chain_unittest/target-signed-using-ecdsa.pem',
       'data/verify_certificate_chain_unittest/target-signed-with-md5.pem',
       'data/verify_certificate_chain_unittest/target-unknown-critical-extension.pem',
       'data/verify_certificate_chain_unittest/target-wrong-signature.pem',
       'data/verify_certificate_chain_unittest/unknown-root.pem',
       'data/verify_certificate_chain_unittest/violates-basic-constraints-pathlen-0.pem',
+      'data/verify_certificate_chain_unittest/violates-pathlen-1-root.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-case_swap-dupe_attr.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-case_swap-extra_attr.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-case_swap-extra_rdn.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-case_swap.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-extra_whitespace-dupe_attr.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-extra_whitespace-extra_attr.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-extra_whitespace-extra_rdn.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-extra_whitespace.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-unmangled-dupe_attr.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-unmangled-extra_attr.pem',
@@ skipping 674 matching lines @@
       'third_party/nist-pkits/crls/requireExplicitPolicy5subCACRL.crl',
       'third_party/nist-pkits/crls/requireExplicitPolicy5subsubCACRL.crl',
       'third_party/nist-pkits/crls/requireExplicitPolicy5subsubsubCACRL.crl',
       'third_party/nist-pkits/crls/requireExplicitPolicy7CACRL.crl',
       'third_party/nist-pkits/crls/requireExplicitPolicy7subCARE2CRL.crl',
       'third_party/nist-pkits/crls/requireExplicitPolicy7subsubCARE2RE4CRL.crl',
       'third_party/nist-pkits/crls/requireExplicitPolicy7subsubsubCARE2RE4CRL.crl',
     ],
   }
 }