*wip* NSS: handle chromeos system slot.

chrome/browser/chromeos/net/cert_verify_proc_chromeos.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/net/cert_verify_proc_chromeos.h"
 
 #include "net/cert/test_root_certs.h"
 #include "net/cert/x509_certificate.h"
 
 // NSS doesn't currently define CERT_LIST_TAIL.
@@ skipping 11 matching lines @@
   CertVerifyProcChromeOS* cert_verify_proc;
   const net::CertificateList& additional_trust_anchors;
 };
 
 }  // namespace
 
 CertVerifyProcChromeOS::CertVerifyProcChromeOS() {}
 
 CertVerifyProcChromeOS::CertVerifyProcChromeOS(
     crypto::ScopedPK11Slot public_slot) {
-  profile_filter_.Init(public_slot.Pass(), crypto::ScopedPK11Slot());
+  // Only the software slot is passed, since that is the only one where user
+  // trust settings are stored.
+  profile_filter_.Init(
+      public_slot.Pass(), crypto::ScopedPK11Slot(), crypto::ScopedPK11Slot());
 }
 
 CertVerifyProcChromeOS::~CertVerifyProcChromeOS() {}
 
 int CertVerifyProcChromeOS::VerifyInternal(
     net::X509Certificate* cert,
     const std::string& hostname,
     int flags,
     net::CRLSet* crl_set,
     const net::CertificateList& additional_trust_anchors,
@@ skipping 51 matching lines @@
   // properly when the same cert is in multiple slots, this would also need
   // updating to check the per-slot trust values.
   *chain_ok = args->cert_verify_proc->profile_filter_.IsCertAllowed(cert)
                   ? PR_TRUE
                   : PR_FALSE;
   DVLOG(3) << cert->subjectName << " is " << (*chain_ok ? "ok" : "not ok");
   return SECSuccess;
 }
 
 }  // namespace chromeos