CertVerifyProcMac: Add Keychain re-ordering hack, check CRLsets in path pruning loop.

net/BUILD.gn

 # Copyright (c) 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/buildflag_header.gni")
 import("//build/config/chromecast_build.gni")
 import("//build/config/compiler/compiler.gni")
 import("//build/config/crypto.gni")
 import("//build/config/features.gni")
 import("//build/config/ui.gni")
@@ skipping 1452 matching lines @@
       ":epoll_quic_tools",
       ":epoll_server",
       ":flip_in_mem_edsm_server_base",
     ]
   }
 
   if (is_mac || is_ios) {
     sources += gypi_values.net_base_test_mac_ios_sources
   }
 
+  if (is_mac) {
+    libs = [ "Security.framework" ]

[Ryan Sleevi, 2016/08/12 19:50:17]

I thought we also needed to add Foundation.framework (because of CFArray)?

[mattm, 2016/08/16 01:41:34]

I think this is okay since the cert_verify_proc_unittest.cc doesn't use CFArray,
only SecKeychainRef.

test_keychain_search_list_mac and cert_verify_proc_mac use CFArray, but those
are in net (rather than net_unittests) and net already has both
Foundation.framework and Security.framework.

+  }
+
   if (is_chromeos) {
     sources -= [ "proxy/proxy_config_service_linux_unittest.cc" ]
   }
 
   if (v8_use_external_startup_data) {
     deps += [ "//gin" ]
   }
 
   if (!use_nss_certs) {
     sources -= [
@@ skipping 585 matching lines @@
     "url_request/url_request_fuzzer.cc",
   ]
   deps = [
     ":net_fuzzer_test_support",
     ":test_support",
     "//base",
     "//net",
   ]
   dict = "data/http/http.dict"
 }