Allow the TrustStore interface to return matching intermediates, and identify distrusted certs.

net/cert/internal/verify_certificate_chain_pkits_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/verify_certificate_chain.h"
 
 #include "net/cert/internal/parsed_certificate.h"
 #include "net/cert/internal/signature_policy.h"
 #include "net/cert/internal/trust_store.h"
 #include "net/der/input.h"
@@ skipping 52 matching lines @@
               bssl::UniquePtr<CRYPTO_BUFFER>(
                   CRYPTO_BUFFER_new(reinterpret_cast<const uint8_t*>(i->data()),
                                     i->size(), nullptr)),
               {}, &input_chain, &parsing_errors)) {
         ADD_FAILURE() << "Cert failed to parse:\n"
                       << parsing_errors.ToDebugString();
         return false;
       }
     }
 
-    scoped_refptr<TrustAnchor> trust_anchor =
-        TrustAnchor::CreateFromCertificateNoConstraints(input_chain.back());
-    input_chain.pop_back();
-
     SimpleSignaturePolicy signature_policy(1024);
 
     // Run all tests at the time the PKITS was published.
     der::GeneralizedTime time = {2011, 4, 15, 0, 0, 0};
 
     CertPathErrors path_errors;
-    bool result = VerifyCertificateChain(input_chain, trust_anchor.get(),
-                                         &signature_policy, time,
-                                         KeyPurpose::ANY_EKU, &path_errors);
+    VerifyCertificateChain(input_chain, CertificateTrust::ForTrustAnchor(),
+                           &signature_policy, time, KeyPurpose::ANY_EKU,
+                           &path_errors);
 
     //  TODO(crbug.com/634443): Test errors on failure?
-    EXPECT_EQ(result, !path_errors.ContainsHighSeverityErrors());
-    return result;
+    return !path_errors.ContainsHighSeverityErrors();
   }
 };
 
 }  // namespace
 
 class PkitsTest01SignatureVerificationCustom
     : public PkitsTest<VerifyCertificateChainPkitsTestDelegate> {};
 
 // Modified version of 4.1.4 Valid DSA Signatures Test4
 TEST_F(PkitsTest01SignatureVerificationCustom,
@@ skipping 115 matching lines @@
 
 // TODO(mattm): CRL support: PkitsTest04BasicCertificateRevocationTests,
 // PkitsTest05VerifyingPathswithSelfIssuedCertificates,
 // PkitsTest14DistributionPoints, PkitsTest15DeltaCRLs
 
 // TODO(mattm): Certificate Policies support: PkitsTest08CertificatePolicies,
 // PkitsTest09RequireExplicitPolicy PkitsTest10PolicyMappings,
 // PkitsTest11InhibitPolicyMapping, PkitsTest12InhibitAnyPolicy
 
 }  // namespace net