PKI library Mac trust store integration

net/tools/cert_verify_tool/verify_using_path_builder.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/tools/cert_verify_tool/verify_using_path_builder.h"
 
 #include <iostream>
 
 #include "base/memory/ptr_util.h"
 #include "base/strings/string_number_conversions.h"
@@ skipping 20 matching lines @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "net/cert/internal/cert_issuer_source_nss.h"
 #include "net/cert/internal/trust_store_nss.h"
 #endif
 
 #if defined(OS_LINUX)
 #include "net/proxy/proxy_config.h"
 #include "net/proxy/proxy_config_service_fixed.h"
 #endif
 
+#if defined(OS_MACOSX) && !defined(OS_IOS)
+#include <Security/Security.h>
+#include "net/cert/internal/trust_store_mac.h"
+#endif
+
 namespace {
 
 std::string GetUserAgent() {
   return "cert_verify_tool/0.1";
 }
 
 // Converts a base::Time::Exploded to a net::der::GeneralizedTime.
 // TODO(mattm): This function exists in cast_cert_validator.cc also. Dedupe it?
 net::der::GeneralizedTime ConvertExplodedTime(
     const base::Time::Exploded& exploded) {
@@ skipping 170 matching lines @@
     scoped_refptr<net::ParsedCertificate> cert = ParseCertificate(der_cert);
     if (cert) {
       trust_store_in_memory.AddTrustAnchor(
           net::TrustAnchor::CreateFromCertificateNoConstraints(cert));
     }
   }
 
 #if defined(USE_NSS_CERTS)
   net::TrustStoreNSS trust_store_nss(trustSSL);
   trust_store.AddTrustStore(&trust_store_nss);
+#elif defined(OS_MACOSX) && !defined(OS_IOS)
+  net::TrustStoreMac trust_store_mac(kSecPolicyAppleSSL);
+  trust_store.AddTrustStore(&trust_store_mac);
 #else
   if (root_der_certs.empty()) {
     std::cerr << "NOTE: CertPathBuilder does not currently use OS trust "
                  "settings (--roots must be specified).\n";
   }
 #endif
 
   net::CertIssuerSourceStatic intermediate_cert_issuer_source;
   for (const auto& der_cert : intermediate_der_certs) {
     scoped_refptr<net::ParsedCertificate> cert = ParseCertificate(der_cert);
@@ skipping 64 matching lines @@
     if (!DumpParsedCertificateChain(
             dump_prefix_path.AddExtension(
                 FILE_PATH_LITERAL(".CertPathBuilder.pem")),
             result.paths[result.best_result_index]->path)) {
       return false;
     }
   }
 
   return result.HasValidPath();
 }