Don't treat trust anchors as certificates during path building.

components/cast_certificate/cast_cert_validator.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/cast_certificate/cast_cert_validator.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ skipping 49 matching lines @@
 
   CastTrustStore() {
     AddAnchor(kCastRootCaDer);
     AddAnchor(kEurekaRootCaDer);
   }
 
   // Adds a trust anchor given a DER-encoded certificate from static
   // storage.
   template <size_t N>
   void AddAnchor(const uint8_t (&data)[N]) {
-    scoped_refptr<net::ParsedCertificate> root =
+    scoped_refptr<net::ParsedCertificate> cert =
         net::ParsedCertificate::CreateFromCertificateData(
             data, N, net::ParsedCertificate::DataSource::EXTERNAL_REFERENCE,
             {});
-    CHECK(root);
-    store_.AddTrustedCertificate(std::move(root));
+    CHECK(cert);
+    // TODO(crbug.com/635200): Support anchor constraints, and initialize the
+    // anchor using constraints from the self-signed certificate.
+    scoped_refptr<net::TrustAnchor> anchor =
+        net::TrustAnchor::CreateFromCertificateNoConstraints(std::move(cert));
+    store_.AddTrustAnchor(std::move(anchor));
   }
 
   net::TrustStore store_;
   DISALLOW_COPY_AND_ASSIGN(CastTrustStore);
 };
 
 using ExtensionsMap = std::map<net::der::Input, net::ParsedExtension>;
 
 // Helper that looks up an extension by OID given a map of extensions.
 bool GetExtensionValue(const ExtensionsMap& extensions,
@@ skipping 261 matching lines @@
 
 std::unique_ptr<CertVerificationContext> CertVerificationContextImplForTest(
     const base::StringPiece& spki) {
   // Use a bogus CommonName, since this is just exposed for testing signature
   // verification by unittests.
   return base::WrapUnique(
       new CertVerificationContextImpl(net::der::Input(spki), "CommonName"));
 }
 
 }  // namespace cast_certificate