Restrict the set of WoSign/StartCom certs to the Alexa Top 1M

net/BUILD.gn

Index: net/BUILD.gn
diff --git a/net/BUILD.gn b/net/BUILD.gn
index 15f0453d598fde0f879857d7dca782dd0cd42459..d5cffe04f2ef5c1f4c8c286ccb8a2712b730b1b0 100644
--- a/net/BUILD.gn
+++ b/net/BUILD.gn
@@ -349,6 +349,7 @@ component("net") {
     ":net_resources",
     "//base",
     "//net/base/registry_controlled_domains",
+    "//net/data/ssl/wosign:wosign_domains",
     "//third_party/protobuf:protobuf_lite",
     "//url:url_features",
   ]
@@ -4716,6 +4717,7 @@ test("net_unittests") {
   defines = []
 
   deps = [
+    ":cert_verify_proc_whitelist_unittest_data",
     ":net",
     ":simple_quic_tools",
     ":test_support",
@@ -5136,6 +5138,21 @@ if (!is_ios && !is_proto_quic) {
   }
 }
 
+action_foreach("cert_verify_proc_whitelist_unittest_data") {
+  script = "//net/tools/dafsa/make_dafsa.py"
+  sources = [
+    "//net/cert/cert_verify_proc_whitelist_unittest1.gperf",
+  ]
+  outputs = [
+    "${target_gen_dir}/cert/{{source_name_part}}-inc.cc",
+  ]
+  args = [
+    "{{source}}",
+    rebase_path("${target_gen_dir}/cert/{{source_name_part}}-inc.cc",
+                root_build_dir),
+  ]
+}
+
 # Fuzzers
 
 # This has a global (InitGlobals) that must always be linked in, so