Misc changes to cert_verify_tool for errors

net/tools/cert_verify_tool/verify_using_path_builder.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/tools/cert_verify_tool/verify_using_path_builder.h"
 
 #include <iostream>
 
 #include "base/memory/ptr_util.h"
 #include "base/strings/string_number_conversions.h"
@@ skipping 106 matching lines @@
   if (!net::ParseNameValue(trust_anchor->normalized_subject(), &parsed_subject))
     return std::string();
   return SubjectToString(parsed_subject);
 }
 
 void PrintCertErrors(const net::CertErrors& errors) {
   // TODO(crbug.com/634443): Include more detailed error information. Also this
   // should likely be extracted to a common location and used by unit-tests and
   // other debugging needs.
   for (const auto& error : errors.errors()) {
-    std::cout << " " << error.type;
+    std::cout << " " << error.type << "\n";
   }
 }
 
 // Dumps a ResultPath to std::cout.
 void PrintResultPath(const net::CertPathBuilder::ResultPath* result_path,
                      size_t index,
                      bool is_best) {
   std::cout << "path " << index << " "
             << (result_path->valid ? "valid" : "invalid")
             << (is_best ? " (best)" : "") << "\n";
@@ skipping 10 matching lines @@
     std::string trust_anchor_cert_fingerprint = "<no cert>";
     if (trust_anchor->cert()) {
       trust_anchor_cert_fingerprint =
           FingerPrintParsedCertificate(trust_anchor->cert().get());
     }
     std::cout << " " << trust_anchor_cert_fingerprint << " "
               << SubjectFromTrustAnchor(trust_anchor.get()) << "\n";
   }
 
   // Print the errors.
-  if (result_path->errors.errors().empty()) {
+  if (!result_path->errors.errors().empty()) {
     std::cout << "Errors:\n";
     PrintCertErrors(result_path->errors);
   }
 }
 
 }  // namespace
 
 // Verifies |target_der_cert| using CertPathBuilder.
 bool VerifyUsingPathBuilder(
     const CertInput& target_der_cert,
     const std::vector<CertInput>& intermediate_der_certs,
     const std::vector<CertInput>& root_der_certs,
     const base::Time at_time,
     const base::FilePath& dump_prefix_path) {
-  std::cerr << "WARNING: --hostname is not yet verified with CertPathBuilder\n";
-
   base::Time::Exploded exploded_time;
   at_time.UTCExplode(&exploded_time);
   net::der::GeneralizedTime time = ConvertExplodedTime(exploded_time);
 
   net::TrustStoreCollection trust_store;
 
   net::TrustStoreInMemory trust_store_in_memory;
   trust_store.AddTrustStoreSynchronousOnly(&trust_store_in_memory);
   for (const auto& der_cert : root_der_certs) {
     scoped_refptr<net::ParsedCertificate> cert =
         net::ParsedCertificate::CreateFromCertificateCopy(der_cert.der_cert,
                                                           {});
     if (!cert)
       PrintCertError("ERROR: ParsedCertificate failed:", der_cert);
     else {
       trust_store_in_memory.AddTrustAnchor(
           net::TrustAnchor::CreateFromCertificateNoConstraints(cert));
     }
   }
 
 #if defined(USE_NSS_CERTS)
   net::TrustStoreNSS trust_store_nss(trustSSL,
                                      base::ThreadTaskRunnerHandle::Get());
   trust_store.SetPrimaryTrustStore(&trust_store_nss);
 #else
-  std::cout << "NOTE: CertPathBuilder does not currently use OS trust settings "
-               "(--roots must be specified).\n";
+  if (root_der_certs.empty()) {
+    std::cerr << "NOTE: CertPathBuilder does not currently use OS trust "
+                 "settings (--roots must be specified).\n";
+  }
 #endif
 
   net::CertIssuerSourceStatic intermediate_cert_issuer_source;
   for (const auto& der_cert : intermediate_der_certs) {
     scoped_refptr<net::ParsedCertificate> cert =
         net::ParsedCertificate::CreateFromCertificateCopy(der_cert.der_cert,
                                                           {});
     if (!cert)
       PrintCertError("ERROR: ParsedCertificate failed:", der_cert);
     else
@@ skipping 57 matching lines @@
     if (!DumpParsedCertificateChain(
             dump_prefix_path.AddExtension(
                 FILE_PATH_LITERAL(".CertPathBuilder.pem")),
             result.paths[result.best_result_index]->path)) {
       return false;
     }
   }
 
   return result.HasValidPath();
 }