Introduce USE_OPENSSL_CERTS for certificate handling.

build/common.gypi

 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # IMPORTANT:
 # Please don't directly include this file if you are building via gyp_chromium,
 # since gyp_chromium is automatically forcing its inclusion.
 {
   # Variables expected to be overriden on the GYP command line (-D) or by
   # ~/.gyp/include.gypi.
@@ skipping 29 matching lines @@
           'chromeos%': '<(chromeos)',
           'use_aura%': '<(use_aura)',
           'use_ash%': '<(use_ash)',
           'use_cras%': '<(use_cras)',
           'use_ozone%': '<(use_ozone)',
           'embedded%': '<(embedded)',
 
           # Whether we are using Views Toolkit
           'toolkit_views%': 0,
 
-          # Use OpenSSL instead of NSS. Under development: see http://crbug.com/62803
+          # Use OpenSSL instead of NSS as underlying SSL protocol.

[wtc, 2014/03/25 17:18:28]

Nit: "protocol" should be changed to "implementation" or "provider". Add "the"
before "underlying".

Also, I would say "crypto and SSL" because this also affects crypto/.

[haavardm, 2014/03/26 12:25:18]

Done.

[haavardm, 2014/03/26 12:25:18]

Done.

+          # Certificate verification will in most cases be handled by the OS.
+          # If openssl also is used for certificate verification, or the OS
+          # uses OpenSSLL's struct X509 to represent certificates,

[wtc, 2014/03/25 17:18:28]

Typo: "OpenSSLL" has an extra L.

I think the "openssl also is used for certificate verification" part can be
removed.

[haavardm, 2014/03/26 12:25:18]

Done.

+          # use_openssl_certs must be set.
           'use_openssl%': 0,
 
+          # Typedef fX509Certificate::OSCertHandle to OpenSSL's struct X509*.

[wtc, 2014/03/25 17:18:28]

Remove the "f" before "X509Certificate".

[haavardm, 2014/03/26 12:25:18]

Done.

+          'use_openssl_certs%': 0,
+
           # Disable viewport meta tag by default.
           'enable_viewport%': 0,
 
           # Enable HiDPI support.
           'enable_hidpi%': 0,
 
           # Override buildtype to select the desired build flavor.
           # Dev - everyday build for development/testing
           # Official - release build (generally implies additional processing)
           # TODO(mmoss) Once 'buildtype' is fully supported (e.g. Windows gyp
@@ skipping 54 matching lines @@
         },
         # Copy conditionally-set variables out one scope.
         'chromeos%': '<(chromeos)',
         'desktop_linux%': '<(desktop_linux)',
         'use_aura%': '<(use_aura)',
         'use_ash%': '<(use_ash)',
         'use_cras%': '<(use_cras)',
         'use_ozone%': '<(use_ozone)',
         'embedded%': '<(embedded)',
         'use_openssl%': '<(use_openssl)',
+        'use_openssl_certs%': '<(use_openssl_certs)',
         'use_system_fontconfig%': '<(use_system_fontconfig)',
         'enable_viewport%': '<(enable_viewport)',
         'enable_hidpi%': '<(enable_hidpi)',
         'buildtype%': '<(buildtype)',
         'branding%': '<(branding)',
         'host_arch%': '<(host_arch)',
 
         'target_subarch%': '',
 
         # This is set when building the Android WebView inside the Android
@@ skipping 103 matching lines @@
       'toolkit_uses_gtk%': '<(toolkit_uses_gtk)',
       'desktop_linux%': '<(desktop_linux)',
       'use_aura%': '<(use_aura)',
       'use_ash%': '<(use_ash)',
       'use_cras%': '<(use_cras)',
       'use_ozone%': '<(use_ozone)',
       'use_ozone_evdev%': '<(use_ozone_evdev)',
       'use_clipboard_aurax11%': '<(use_clipboard_aurax11)',
       'embedded%': '<(embedded)',
       'use_openssl%': '<(use_openssl)',
+      'use_openssl_certs%': '<(use_openssl_certs)',
       'use_system_fontconfig%': '<(use_system_fontconfig)',
       'enable_viewport%': '<(enable_viewport)',
       'enable_hidpi%': '<(enable_hidpi)',
       'android_webview_build%': '<(android_webview_build)',
       'use_goma%': '<(use_goma)',
       'gomadir%': '<(gomadir)',
       'enable_app_list%': '<(enable_app_list)',
       'use_default_render_theme%': '<(use_default_render_theme)',
       'buildtype%': '<(buildtype)',
       'branding%': '<(branding)',
@@ skipping 287 matching lines @@
           'os_bsd%': 0,
         }],
 
         # NSS usage.
         ['(OS=="linux" or OS=="freebsd" or OS=="openbsd" or OS=="solaris") and use_openssl==0', {
           'use_nss%': 1,
         }, {
           'use_nss%': 0,
         }],
 
+        # When OpenSSL is used for SSL and crypto on unix like systems, use

[wtc, 2014/03/25 17:18:28]

Nit: unix like => Unix-like

[haavardm, 2014/03/26 12:25:18]

Done.

+        # OpenSSL's certificate definition.
+        ['(OS=="linux" or OS=="freebsd" or OS=="openbsd" or OS=="solaris") and use_openssl==1', {
+          'use_openssl_certs%': 1,
+        }, {
+          'use_openssl_certs%': 0,
+        }],
+
         # libudev usage.  This currently only affects the content layer.
         ['OS=="linux" and embedded==0', {
           'use_udev%': 1,
         }, {
           'use_udev%': 0,
         }],
 
         # Flags to use X11 on non-Mac POSIX platforms.
         ['OS=="win" or OS=="mac" or OS=="ios" or OS=="android" or use_ozone==1', {
           'use_x11%': 0,
@@ skipping 342 matching lines @@
     'target_arch%': '<(target_arch)',
     'target_subarch%': '<(target_subarch)',
     'host_arch%': '<(host_arch)',
     'toolkit_views%': '<(toolkit_views)',
     'ui_compositor_image_transport%': '<(ui_compositor_image_transport)',
     'use_aura%': '<(use_aura)',
     'use_ash%': '<(use_ash)',
     'use_cras%': '<(use_cras)',
     'use_mojo%': '<(use_mojo)',
     'use_openssl%': '<(use_openssl)',
+    'use_openssl_certs%': '<(use_openssl_certs)',
     'use_nss%': '<(use_nss)',
     'use_udev%': '<(use_udev)',
     'os_bsd%': '<(os_bsd)',
     'os_posix%': '<(os_posix)',
     'use_dbus%': '<(use_dbus)',
     'use_glib%': '<(use_glib)',
     'use_pango%': '<(use_pango)',
     'use_cairo%': '<(use_cairo)',
     'use_ozone%': '<(use_ozone)',
     'use_ozone_evdev%': '<(use_ozone_evdev)',
@@ skipping 602 matching lines @@
         'android_readelf%' : '<!(/bin/echo -n <(android_toolchain)/*-readelf)',
 
         # Determines whether we should optimize JNI generation at the cost of
         # breaking assumptions in the build system that when inputs have changed
         # the outputs should always change as well.  This is meant purely for
         # developer builds, to avoid spurious re-linking of native files.
         'optimize_jni_generation%': 0,
 
         # Always uses openssl.
         'use_openssl%': 1,
+        'use_openssl_certs%': 1,
 
         'proprietary_codecs%': '<(proprietary_codecs)',
         'safe_browsing%': 2,
         'input_speech%': 0,
         'enable_automation%': 0,
         'java_bridge%': 1,
         'build_ffmpegsumo%': 0,
         # TODO(dmikurube): Change the default of use_allocator to "none".
         # TODO(dmikurube): Kill linux_use_tcmalloc. http://crbug.com/345554
         'linux_use_tcmalloc%': 0,
@@ skipping 1009 matching lines @@
         'defines': ['ENABLE_IPC_FUZZER=1'],
       }],
       ['video_hole==1', {
         'defines': ['VIDEO_HOLE=1'],
       }],
     ],  # conditions for 'target_defaults'
     'target_conditions': [
       ['<(use_openssl)==1 or >(nacl_untrusted_build)==1', {
         'defines': ['USE_OPENSSL=1'],
       }],
+      ['<(use_openssl_certs)==1 or >(nacl_untrusted_build)==1', {
+        'defines': ['USE_OPENSSL_CERTS=1'],
+      }],

[wtc, 2014/03/25 17:18:28]

It seems clearer to rewrite these two as follows:

    ['<(use_openssl)==1', {
      'defines': ['USE_OPENSSL=1'],
    }],
    ['<(use_openssl_certs)==1', {
      'defines': ['USE_OPENSSL_CERTS=1'],
    }],
    ['>(nacl_untrusted_build)==1', {
      'defines': [
        'USE_OPENSSL=1',
        'USE_OPENSSL_CERTS=1',
      ],
    }],

[haavardm, 2014/03/26 12:25:18]

Done.

       ['<(use_nss)==1 and >(nacl_untrusted_build)==0', {
         'defines': ['USE_NSS=1'],
       }],
       ['enable_wexit_time_destructors==1', {
         'conditions': [
           [ 'clang==1', {
             'cflags': [
               '-Wexit-time-destructors',
             ],
             'xcode_settings': {
@@ skipping 2572 matching lines @@
     # settings in target dicts.  SYMROOT is a special case, because many other
     # Xcode variables depend on it, including variables such as
     # PROJECT_DERIVED_FILE_DIR.  When a source group corresponding to something
     # like PROJECT_DERIVED_FILE_DIR is added to a project, in order for the
     # files to appear (when present) in the UI as actual files and not red
     # red "missing file" proxies, the correct path to PROJECT_DERIVED_FILE_DIR,
     # and therefore SYMROOT, needs to be set at the project level.
     'SYMROOT': '<(DEPTH)/xcodebuild',
   },
 }