Use OS-provided trusted root certs on Linux

runtime/bin/main.cc

Index: runtime/bin/main.cc
diff --git a/runtime/bin/main.cc b/runtime/bin/main.cc
index 9f7123843e824452a4c3793fac63b43d830f3b50..b0f68efb3ccb8b8d3c7746126b10fecd3dd3a094 100644
--- a/runtime/bin/main.cc
+++ b/runtime/bin/main.cc
@@ -494,6 +494,43 @@ static bool ProcessShortSocketWriteOption(const char* arg,
 }
 
 
+#if !defined(TARGET_OS_MACOS)
+extern const char* commandline_root_certs_file;
+extern const char* commandline_root_certs_cache;
+
+static bool ProcessRootCertsFileOption(const char* arg,
+                                       CommandLineOptions* vm_options) {
+  ASSERT(arg != NULL);
+  if (*arg == '-') {
+    return false;
+  }
+  if (commandline_root_certs_cache != NULL) {
+    Log::PrintErr("Only one of --root-certs-file and --root-certs-cache "
+                  "may be specified");
+    return false;
+  }
+  commandline_root_certs_file = arg;
+  return true;
+}
+
+
+static bool ProcessRootCertsCacheOption(const char* arg,
+                                       CommandLineOptions* vm_options) {
+  ASSERT(arg != NULL);
+  if (*arg == '-') {
+    return false;
+  }
+  if (commandline_root_certs_file != NULL) {
+    Log::PrintErr("Only one of --root-certs-file and --root-certs-cache "
+                  "may be specified");
+    return false;
+  }
+  commandline_root_certs_cache = arg;
+  return true;
+}
+#endif  // !defined(TARGET_OS_MACOS)
+
+
 static struct {
   const char* option_name;
   bool (*process)(const char* option, CommandLineOptions* vm_options);
@@ -522,6 +559,10 @@ static struct {
   { "--hot-reload-rollback-test-mode", ProcessHotReloadRollbackTestModeOption },
   { "--short_socket_read", ProcessShortSocketReadOption },
   { "--short_socket_write", ProcessShortSocketWriteOption },
+#if !defined(TARGET_OS_MACOS)
+  { "--root-certs-file=", ProcessRootCertsFileOption },
+  { "--root-certs-cache=", ProcessRootCertsCacheOption },
+#endif  // !defined(TARGET_OS_MACOS)

[siva, 2016/09/16 01:27:12]

Do these options have to be added to PrintUsage() so that some kind of help will
be available.

Is this to be supported for windows too?

[zra, 2016/09/16 16:08:01]

Done
Yes, it should work on Windows too since Windows also uses boringssl.

   { NULL, NULL }
 };