Allow the TrustStore interface to return matching intermediates, and identify distrusted certs.

components/cast_certificate/cast_cert_validator_test_helpers.cc

Index: components/cast_certificate/cast_cert_validator_test_helpers.cc
diff --git a/components/cast_certificate/cast_cert_validator_test_helpers.cc b/components/cast_certificate/cast_cert_validator_test_helpers.cc
index d9ade267ccd88ba0e0ddc5ac7014b1e25d58ad9b..4a41ed2b0d3a35dc75ad67291da17e77caa13497 100644
--- a/components/cast_certificate/cast_cert_validator_test_helpers.cc
+++ b/components/cast_certificate/cast_cert_validator_test_helpers.cc
@@ -93,9 +93,7 @@ std::unique_ptr<net::TrustStoreInMemory> CreateTrustStoreFromFile(
     scoped_refptr<net::ParsedCertificate> cert(net::ParsedCertificate::Create(
         net::x509_util::CreateCryptoBuffer(trusted_root), {}, &errors));
     EXPECT_TRUE(cert) << errors.ToDebugString();
-    scoped_refptr<net::TrustAnchor> anchor =
-        net::TrustAnchor::CreateFromCertificateWithConstraints(std::move(cert));
-    trust_store->AddTrustAnchor(std::move(anchor));
+    trust_store->AddTrustAnchorWithConstraints(cert);

[ryanchung, 2017/04/28 23:11:30]

nit: std:move(cert) ?

[eroman, 2017/04/28 23:51:06]

AddTrustAnchorWithConstraints() in this case takes a |const
scoped_refptr<ParsedCertificate>&|, so it wouldn't benefit from move semantics.

That said there is some inconsistency between which methods takes
scoped_refptr<> vs which ones take a const reference, which could be improved.

(In general I find the move() versions to be more fragile, since it invalidates
the caller's variable; mainly only done if we want to squeeze out unnecessary
refcounts).

[ryanchung, 2017/04/28 23:57:37]

Isn't it AddTrustAnchorWithConstraints(scoped_refptr<ParsedCertificate> cert);

https://cs.chromium.org/chromium/src/net/cert/internal/trust_store_in_memory....

   }
   return trust_store;
 }