*WIP* Mac Unittest for client cert selection with intermediate certs

net/data/ssl/scripts/generate-keychain.sh

 #!/bin/sh
 
 # Copyright 2016 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 
 set -e -x
 
 SECURITY=/usr/bin/security
@@ skipping 14 matching lines @@
 # create-keychain modifes the global keychain search list, save it first.
 # (or does it?)
 SAVED_KEYCHAIN_LIST=`$SECURITY list -d user`
 echo "Saved user keychain list:"
 echo "$SAVED_KEYCHAIN_LIST"
 echo
 
 
 $SECURITY create-keychain -p "$PASSWORD" "$KEYCHAIN"
 
-trusted=0
+mode=addcert
 
 for cert in "$@"; do
+  if [ "$cert" = "--import" ]; then
+    mode=import
+    continue
+  fi
   if [ "$cert" = "--trusted" ]; then
-    trusted=1
+    mode=addtrustedcert
     continue
   fi
   if [ "$cert" = "--untrusted" ]; then
-    trusted=0
+    mode=addcert
     continue
   fi
 
-  # security tool only accepts DER. If input is a PEM, convert it.
+  if [ $mode = import ]; then
+    $SECURITY import "$cert" -A -k "$KEYCHAIN"
+    continue
+  fi
+
+  # security tool add-trusted-cert and add-certificates only accepts DER. If
+  # input is a PEM, convert it.
   if grep -- "-----BEGIN CERTIFICATE-----" "$cert" ; then
     tmpcert="${cert}.der.tmp"
     openssl x509 -inform PEM -in "$cert" -outform DER -out "$tmpcert"
     cert="$tmpcert"
   fi
 
-  if [ $trusted = 1 ]; then
+  if [ $mode = addtrustedcert ]; then
     $SECURITY add-trusted-cert -r trustAsRoot -k "$KEYCHAIN" "$cert"
   else
     $SECURITY add-certificates -k "$KEYCHAIN" "$cert"
   fi
 done
 
 
 
 #TODO: Would be good to restore the keychain search list on failure too.
 
 echo "pre-restore user keychain list:"
 $SECURITY list -d user
 
 # restore the original keychain search list
 /bin/echo -n "${SAVED_KEYCHAIN_LIST}" | xargs $SECURITY list -d user -s
 
 echo "Restored user keychain list:"
 $SECURITY list -d user
 echo