Allow the TrustStore interface to return matching intermediates, and identify distrusted certs.

components/cast_certificate/cast_cert_validator_test_helpers.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/cast_certificate/cast_cert_validator_test_helpers.h"
 
 #include "base/files/file_util.h"
 #include "base/path_service.h"
 #include "net/cert/internal/cert_errors.h"
 #include "net/cert/pem_tokenizer.h"
@@ skipping 75 matching lines @@
     const std::string& path) {
   std::unique_ptr<net::TrustStoreInMemory> trust_store(
       new net::TrustStoreInMemory());
   const auto trusted_test_roots =
       cast_certificate::testing::ReadCertificateChainFromFile(path);
   for (const auto& trusted_root : trusted_test_roots) {
     net::CertErrors errors;
     scoped_refptr<net::ParsedCertificate> cert(net::ParsedCertificate::Create(
         net::x509_util::CreateCryptoBuffer(trusted_root), {}, &errors));
     EXPECT_TRUE(cert) << errors.ToDebugString();
-    scoped_refptr<net::TrustAnchor> anchor =
-        net::TrustAnchor::CreateFromCertificateWithConstraints(std::move(cert));
-    trust_store->AddTrustAnchor(std::move(anchor));
+    trust_store->AddTrustAnchorWithConstraints(cert);

[ryanchung, 2017/04/28 23:11:30]

nit: std:move(cert) ?

[eroman, 2017/04/28 23:51:06]

AddTrustAnchorWithConstraints() in this case takes a |const
scoped_refptr<ParsedCertificate>&|, so it wouldn't benefit from move semantics.

That said there is some inconsistency between which methods takes
scoped_refptr<> vs which ones take a const reference, which could be improved.

(In general I find the move() versions to be more fragile, since it invalidates
the caller's variable; mainly only done if we want to squeeze out unnecessary
refcounts).

[ryanchung, 2017/04/28 23:57:37]

Isn't it AddTrustAnchorWithConstraints(scoped_refptr<ParsedCertificate> cert);

https://cs.chromium.org/chromium/src/net/cert/internal/trust_store_in_memory....

   }
   return trust_store;
 }
 
 base::Time ConvertUnixTimestampSeconds(uint64_t time) {
   return base::Time::UnixEpoch() + base::TimeDelta::FromSeconds(time);
 }
 
 }  // namespace testing
 
 }  // namespace cast_certificate