Introduce USE_OPENSSL_CERTS for certificate handling.

build/common.gypi

 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # IMPORTANT:
 # Please don't directly include this file if you are building via gyp_chromium,
 # since gyp_chromium is automatically forcing its inclusion.
 {
   # Variables expected to be overriden on the GYP command line (-D) or by
   # ~/.gyp/include.gypi.
@@ skipping 29 matching lines @@
           'chromeos%': '<(chromeos)',
           'use_aura%': '<(use_aura)',
           'use_ash%': '<(use_ash)',
           'use_cras%': '<(use_cras)',
           'use_ozone%': '<(use_ozone)',
           'embedded%': '<(embedded)',
 
           # Whether we are using Views Toolkit
           'toolkit_views%': 0,
 
           # Use OpenSSL instead of NSS. Under development: see http://crbug.com/62803

[wtc, 2014/03/20 21:14:56]

Please update this comment. At least, the "Under development: see
http://crbug.com/ 62803" part should be removed. It would be good to describe
the new, narrower meaning of use_openssl and the relation to use_openssl_certs.

[haavardm, 2014/03/24 18:48:52]

Done.

           'use_openssl%': 0,
 
+         # Use OpenSSL for certificate handling.

[Ryan Sleevi, 2014/03/21 19:47:51]

I'm a little confused here, when reading both this code and the later code for
CertVerifier.

When use_openssl_certs:1, X509Certificate::OSCertHandle will always be an X509*,
right?
When use_openssl_certs:1, certificate verification MAY happen with OpenSSL - or
it may not (eg: Android), right?

Perhaps there's a better way to express that here than just saying "certificate
handling".

[haavardm, 2014/03/24 18:48:52]

The way it is currently implemented, use_openssl_certs means "use openssl for
certificate verification", and is only on for linux.

The naming is confusing, so it should either be renamed to something along
"use_openssl_verification", or I should follow wtc's suggestion and let
use_openssl_certs mean "X509Certificate::OSCertHandle is typedef'd as an X509*".

I think I agree with WTC on this.

+          'use_openssl_certs%': 0,
+
           # Disable viewport meta tag by default.
           'enable_viewport%': 0,
 
           # Enable HiDPI support.
           'enable_hidpi%': 0,
 
           # Override buildtype to select the desired build flavor.
           # Dev - everyday build for development/testing
           # Official - release build (generally implies additional processing)
           # TODO(mmoss) Once 'buildtype' is fully supported (e.g. Windows gyp
@@ skipping 54 matching lines @@
         },
         # Copy conditionally-set variables out one scope.
         'chromeos%': '<(chromeos)',
         'desktop_linux%': '<(desktop_linux)',
         'use_aura%': '<(use_aura)',
         'use_ash%': '<(use_ash)',
         'use_cras%': '<(use_cras)',
         'use_ozone%': '<(use_ozone)',
         'embedded%': '<(embedded)',
         'use_openssl%': '<(use_openssl)',
+        'use_openssl_certs%': '<(use_openssl_certs)',
         'use_system_fontconfig%': '<(use_system_fontconfig)',
         'enable_viewport%': '<(enable_viewport)',
         'enable_hidpi%': '<(enable_hidpi)',
         'buildtype%': '<(buildtype)',
         'branding%': '<(branding)',
         'host_arch%': '<(host_arch)',
 
         'target_subarch%': '',
 
         # This is set when building the Android WebView inside the Android
@@ skipping 103 matching lines @@
       'toolkit_uses_gtk%': '<(toolkit_uses_gtk)',
       'desktop_linux%': '<(desktop_linux)',
       'use_aura%': '<(use_aura)',
       'use_ash%': '<(use_ash)',
       'use_cras%': '<(use_cras)',
       'use_ozone%': '<(use_ozone)',
       'use_ozone_evdev%': '<(use_ozone_evdev)',
       'use_clipboard_aurax11%': '<(use_clipboard_aurax11)',
       'embedded%': '<(embedded)',
       'use_openssl%': '<(use_openssl)',
+      'use_openssl_certs%': '<(use_openssl_certs)',
       'use_system_fontconfig%': '<(use_system_fontconfig)',
       'enable_viewport%': '<(enable_viewport)',
       'enable_hidpi%': '<(enable_hidpi)',
       'android_webview_build%': '<(android_webview_build)',
       'use_goma%': '<(use_goma)',
       'gomadir%': '<(gomadir)',
       'enable_app_list%': '<(enable_app_list)',
       'use_default_render_theme%': '<(use_default_render_theme)',
       'buildtype%': '<(buildtype)',
       'branding%': '<(branding)',
@@ skipping 267 matching lines @@
         }],
 
         # A flag for BSD platforms
         ['OS=="freebsd" or OS=="openbsd"', {
           'os_bsd%': 1,
         }, {
           'os_bsd%': 0,
         }],
 
         # NSS usage.
         ['(OS=="linux" or OS=="freebsd" or OS=="openbsd" or OS=="solaris") and use_openssl==0', {

[wtc, 2014/03/20 21:14:56]

Nit: ideally this should be combined with the new code you added below, so that
we don't repeat the (OS=="linux" or OS=="freebsd" or OS=="openbsd" or
OS=="solaris") test.

[haavardm, 2014/03/21 13:08:21]

I had that at first, but the result got quite nested and was hard to read,
partly in due to how the "if" is expressed using "'conditions': []". It was
actually more clear having  it in two separate "ifs".

In general I think the ssl logic in common.gyp as a whole could be simplified.
Much of the logic could probably be combined into fewer blocks. The logic has
probably evolved bit by bit, and I'm certainly contributing to that now. I'm
just afraid that if I simplify and rewrite the logic, I'll miss something and
cause compilation trouble on some unknown profile.

[Ryan Sleevi, 2014/03/21 19:47:51]

Yeah, as we transition towards OpenSSL, we can simplify a lot. Part of the issue
is caused by the "system NSS vs bundled NSS" hassles.

           'use_nss%': 1,
         }, {
           'use_nss%': 0,
         }],
 
+        # When OpenSSL is used for SSL on unix like systems, turn on OpenSSL

[wtc, 2014/03/20 21:14:56]

This should be "for SSL and crypto".

+        # certificate handling for now.
+        ['(OS=="linux" or OS=="freebsd" or OS=="openbsd" or OS=="solaris") and use_openssl==1', {
+          'use_openssl_certs%': 1,

[wtc, 2014/03/20 21:14:56]

Should we also add an "else" block that set use_openssl_certs to 0? All the
neighboring code does that, so it would be good to be consistent even if it's
not necessary.

[Ryan Sleevi, 2014/03/21 19:47:51]

+1 for consistency.

[haavardm, 2014/03/24 18:48:52]

Done.

+        }],
         # libudev usage.  This currently only affects the content layer.
         ['OS=="linux" and embedded==0', {
           'use_udev%': 1,
         }, {
           'use_udev%': 0,
         }],
 
         # Flags to use X11 on non-Mac POSIX platforms.
         ['OS=="win" or OS=="mac" or OS=="ios" or OS=="android" or use_ozone==1', {
           'use_x11%': 0,
@@ skipping 337 matching lines @@
     'buildtype%': '<(buildtype)',
     'target_arch%': '<(target_arch)',
     'target_subarch%': '<(target_subarch)',
     'host_arch%': '<(host_arch)',
     'toolkit_views%': '<(toolkit_views)',
     'ui_compositor_image_transport%': '<(ui_compositor_image_transport)',
     'use_aura%': '<(use_aura)',
     'use_ash%': '<(use_ash)',
     'use_cras%': '<(use_cras)',
     'use_openssl%': '<(use_openssl)',
+    'use_openssl_certs%': '<(use_openssl_certs)',
     'use_nss%': '<(use_nss)',
     'use_udev%': '<(use_udev)',
     'os_bsd%': '<(os_bsd)',
     'os_posix%': '<(os_posix)',
     'use_dbus%': '<(use_dbus)',
     'use_glib%': '<(use_glib)',
     'use_pango%': '<(use_pango)',
     'use_cairo%': '<(use_cairo)',
     'use_ozone%': '<(use_ozone)',
     'use_ozone_evdev%': '<(use_ozone_evdev)',
@@ skipping 1602 matching lines @@
         'defines': ['ENABLE_IPC_FUZZER=1'],
       }],
       ['video_hole==1', {
         'defines': ['VIDEO_HOLE=1'],
       }],
     ],  # conditions for 'target_defaults'
     'target_conditions': [
       ['<(use_openssl)==1 or >(nacl_untrusted_build)==1', {
         'defines': ['USE_OPENSSL=1'],
       }],
+      ['<(use_openssl_certs)==1 or >(nacl_untrusted_build)==1', {
+        'defines': ['USE_OPENSSL_CERTS=1'],
+      }],
       ['<(use_nss)==1 and >(nacl_untrusted_build)==0', {
         'defines': ['USE_NSS=1'],
       }],
       ['enable_wexit_time_destructors==1', {
         'conditions': [
           [ 'clang==1', {
             'cflags': [
               '-Wexit-time-destructors',
             ],
             'xcode_settings': {
@@ skipping 2532 matching lines @@
     # settings in target dicts.  SYMROOT is a special case, because many other
     # Xcode variables depend on it, including variables such as
     # PROJECT_DERIVED_FILE_DIR.  When a source group corresponding to something
     # like PROJECT_DERIVED_FILE_DIR is added to a project, in order for the
     # files to appear (when present) in the UI as actual files and not red
     # red "missing file" proxies, the correct path to PROJECT_DERIVED_FILE_DIR,
     # and therefore SYMROOT, needs to be set at the project level.
     'SYMROOT': '<(DEPTH)/xcodebuild',
   },
 }