Allow the TrustStore interface to return matching intermediates, and identify distrusted certs.

components/cast_certificate/cast_cert_validator_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/cast_certificate/cast_cert_validator.h"
 
 #include "components/cast_certificate/cast_cert_validator_test_helpers.h"
 #include "net/cert/internal/cert_errors.h"
 #include "net/cert/internal/parsed_certificate.h"
 #include "net/cert/internal/trust_store_in_memory.h"
@@ skipping 77 matching lines @@
       ASSERT_TRUE(root) << errors.ToDebugString();
 
       // Remove it from the chain.
       certs.pop_back();
 
       // Add it to the trust store as a trust anchor
       trust_store.reset(new net::TrustStoreInMemory);
 
       if (trust_store_dependency == TRUST_STORE_FROM_TEST_FILE_UNCONSTRAINED) {
         // This is a test-only mode where anchor constraints are not enforced.
-        trust_store->AddTrustAnchor(
-            net::TrustAnchor::CreateFromCertificateNoConstraints(
-                std::move(root)));
+        trust_store->AddTrustAnchor(std::move(root));
       } else {
-        // This is the regular mode used by the TrustAnchors for the built-in
-        // Cast store.
-        trust_store->AddTrustAnchor(
-            net::TrustAnchor::CreateFromCertificateWithConstraints(
-                std::move(root)));
+        // Add a trust anchor and enforce constraints on it (regular mode for
+        // buil-in Cast roots).

[mattm, 2017/04/28 20:26:47]

built-in

[eroman, 2017/04/28 21:48:03]

Done.

+        trust_store->AddTrustAnchorWithConstraints(std::move(root));
       }
     }
   }
 
   std::unique_ptr<CertVerificationContext> context;
   CastDeviceCertPolicy policy;
 
   bool result = VerifyDeviceCertUsingCustomTrustStore(
       certs, time, &context, &policy, nullptr, CRLPolicy::CRL_OPTIONAL,
       trust_store.get());
@@ skipping 431 matching lines @@
   auto context =
       CertVerificationContextImplForTest(CreateString(kEx2PublicKeySpki));
 
   EXPECT_TRUE(context->VerifySignatureOverData(CreateString(kEx2Signature),
                                                CreateString(kEx2Message)));
 }
 
 }  // namespace
 
 }  // namespace cast_certificate