Certificate path builder for new certificate verification library

net/cert/internal/verify_certificate_chain_unittest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/verify_certificate_chain.h"
 
 #include "base/base_paths.h"
 #include "base/files/file_util.h"
 #include "base/path_service.h"
 #include "base/strings/string_split.h"
@@ skipping 57 matching lines @@
   bool has_result = false;
 
   PEMTokenizer pem_tokenizer(file_data, pem_headers);
   while (pem_tokenizer.GetNext()) {
     const std::string& block_type = pem_tokenizer.block_type();
     const std::string& block_data = pem_tokenizer.data();
 
     if (block_type == kCertificateHeader) {
       chain->push_back(block_data);
     } else if (block_type == kTrustedCertificateHeader) {
-      ASSERT_TRUE(trust_store->AddTrustedCertificate(block_data));
+      scoped_refptr<CertThing> cert(
+          CertThing::CreateFromCertificateCopy(block_data));
+      ASSERT_TRUE(cert);
+      trust_store->AddTrustedCertificate(std::move(cert));
     } else if (block_type == kTimeHeader) {
       ASSERT_FALSE(has_time) << "Duplicate " << kTimeHeader;
       has_time = true;
       ASSERT_TRUE(der::ParseUTCTime(der::Input(&block_data), time));
     } else if (block_type == kResultHeader) {
       ASSERT_FALSE(has_result) << "Duplicate " << kResultHeader;
       ASSERT_TRUE(block_data == "SUCCESS" || block_data == "FAIL")
           << "Unrecognized result: " << block_data;
       has_result = true;
       *verify_result = block_data == "SUCCESS";
@@ skipping 125 matching lines @@
 }
 
 TEST(VerifyCertificateChainTest, ViolatesPathlen1Root) {
   RunTest("violates-pathlen-1-root.pem");
 }
 
 TEST(VerifyCertificateChainTest, NonSelfSignedRoot) {
   RunTest("non-self-signed-root.pem");
 }
 
+TEST(VerifyCertificateChainTest, KeyRolloverOldChain) {
+  RunTest("key-rollover-oldchain.pem");
+}
+
+TEST(VerifyCertificateChainTest, KeyRolloverRolloverChain) {
+  RunTest("key-rollover-rolloverchain.pem");
+}
+
+TEST(VerifyCertificateChainTest, KeyRolloverLongRolloverChain) {
+  RunTest("key-rollover-longrolloverchain.pem");
+}
+
+TEST(VerifyCertificateChainTest, KeyRolloverNewChain) {
+  RunTest("key-rollover-newchain.pem");
+}
+
 // Tests that verifying a chain with no certificates fails.
 TEST(VerifyCertificateChainTest, EmptyChainIsInvalid) {
   TrustStore trust_store;
   der::GeneralizedTime time;
   std::vector<der::Input> chain;
   SimpleSignaturePolicy signature_policy(2048);
 
   ASSERT_FALSE(
       VerifyCertificateChain(chain, trust_store, &signature_policy, time));
 }
 
 // TODO(eroman): Add test that invalidate validity dates where the day or month
 // ordinal not in range, like "March 39, 2016" are rejected.
 
 }  // namespace
 
 }  // namespace net