Restrict the set of WoSign/StartCom certs to the Alexa Top 1M

net/BUILD.gn

 # Copyright (c) 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/buildflag_header.gni")
 import("//build/config/chromecast_build.gni")
 import("//build/config/compiler/compiler.gni")
 import("//build/config/crypto.gni")
 import("//build/config/features.gni")
 import("//build/config/ui.gni")
@@ skipping 331 matching lines @@
     "ssl/token_binding.cc",
     "ssl/token_binding.h",
   ]
   net_unfiltered_sources = []
 
   deps = [
     ":constants",
     ":net_resources",
     "//base",
     "//net/base/registry_controlled_domains",
+    "//net/data/ssl/wosign:wosign_domains",
     "//third_party/protobuf:protobuf_lite",
     "//url:url_features",
   ]
 
   public_deps = [
     ":net_quic_proto",
     "//crypto",
     "//crypto:platform",
   ]
 
@@ skipping 4347 matching lines @@
 
   configs += [
     "//build/config:precompiled_headers",
 
     # TODO(jschuh): crbug.com/167187 fix size_t to int truncations.
     "//build/config/compiler:no_size_t_to_int_warning",
   ]
   defines = []
 
   deps = [
+    ":cert_verify_proc_whitelist_unittest_data",
     ":net",
     ":simple_quic_tools",
     ":test_support",
     "//base",
     "//base/third_party/dynamic_annotations",
     "//crypto",
     "//crypto:platform",
     "//crypto:test_support",
     "//net/base/registry_controlled_domains",
     "//testing/gmock",
@@ skipping 400 matching lines @@
 
     # Some linker failures have been observed for this target on the Win64
     # continuous builder, see crbug.com/659369.
     # TODO(sebmarchand): Remove this once we have some data.
     if (is_win && linkrepro_root_dir != "") {
       ldflags = [ "/LINKREPRO:" + linkrepro_root_dir + "/" + target_name ]
     }
   }
 }
 
+action_foreach("cert_verify_proc_whitelist_unittest_data") {
+  script = "//net/tools/dafsa/make_dafsa.py"
+  sources = [
+    "//net/cert/cert_verify_proc_whitelist_unittest1.gperf",
+  ]
+  outputs = [
+    "${target_gen_dir}/cert/{{source_name_part}}-inc.cc",
+  ]
+  args = [
+    "{{source}}",
+    rebase_path("${target_gen_dir}/cert/{{source_name_part}}-inc.cc",
+                root_build_dir),
+  ]
+}
+
 # Fuzzers
 
 # This has a global (InitGlobals) that must always be linked in, so
 # must be a source set instead of a static library.
 source_set("net_fuzzer_test_support") {
   testonly = true
 
   sources = [
     "base/fuzzer_test_support.cc",
     "dns/fuzzed_host_resolver.cc",
@@ skipping 499 matching lines @@
       "tools/transport_security_state_generator/trie/trie_writer.cc",
       "tools/transport_security_state_generator/trie/trie_writer.h",
     ]
     deps = [
       "//base",
       "//crypto",
       "//third_party/boringssl",
     ]
   }
 }