Only depend on NSS in one place.

net/BUILD.gn

 # Copyright (c) 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/crypto.gni")
 import("//build/config/features.gni")
 import("//build/config/ui.gni")
 import("//url/config.gni")
 
 # TODO(cjhopman): //build/config/android/rules.gni also imports grit_rule.gni.
@@ skipping 440 matching lines @@
   if (is_win) {
     sources -= [
       "http/http_auth_handler_ntlm_portable.cc",
       "socket/socket_libevent.cc",
       "socket/socket_libevent.h",
       "socket/tcp_socket_libevent.cc",
       "socket/tcp_socket_libevent.h",
       "udp/udp_socket_libevent.cc",
       "udp/udp_socket_libevent.h",
     ]
-    deps += [
-      "//third_party/nss:nspr",
-      "//third_party/nss",
-    ]
   } else {  # !is_win
     sources -= [
       "base/winsock_init.cc",
       "base/winsock_init.h",
       "base/winsock_util.cc",
       "base/winsock_util.h",
       "proxy/proxy_resolver_winhttp.cc",
       "proxy/proxy_resolver_winhttp.h",
     ]
   }
 
   if (is_mac) {
-    if (!use_openssl) {
-      deps += [
-        "//third_party/nss:nspr",
-        "//third_party/nss",
-      ]
-    }
     libs = [
       "Foundation.framework",
       "Security.framework",
       "SystemConfiguration.framework",
       "resolv",
     ]
   }
 
   if (is_ios) {
     # Add back some sources that were otherwise filtered out. iOS additionally
     # doesn't set USE_NSS but needs some of the files.
     set_sources_assignment_filter([])
     sources += [
       "base/network_change_notifier_mac.cc",
       "base/network_config_watcher_mac.cc",
       "base/platform_mime_util_mac.mm",
       "cert/cert_verify_proc_nss.cc",
       "cert/cert_verify_proc_nss.h",
       "cert/test_root_certs_nss.cc",
       "cert/x509_util_nss.cc",
       "cert/x509_util_nss.h",
       "proxy/proxy_resolver_mac.cc",
       "proxy/proxy_server_mac.cc",
       "ocsp/nss_ocsp.cc",
       "ocsp/nss_ocsp.h",
     ]
     set_sources_assignment_filter(sources_assignment_filter)
 
     sources -= [ "disk_cache/blockfile/file_posix.cc" ]
-    deps += [
-      "//third_party/nss",
-    ]
     libs = [
       "CFNetwork.framework",
       "MobileCoreServices.framework",
       "Security.framework",
       "SystemConfiguration.framework",
       "resolv",
     ]
   }
 
   if (is_android) {
@@ skipping 176 matching lines @@
     "//base",
     "//base/test:test_support",
     "//crypto",
     "//net",
     "//net/tools/tld_cleanup",
     "//testing/gmock",
     "//testing/gtest",
     "//url",
   ]
 
-  if (is_ios) {
-    public_deps += [ "//third_party/nss" ]
+  if (!use_openssl && (use_nss_certs || is_ios)) {
+    public_deps += ["//crypto:platform" ]
   }
 
   if (!is_android) {
     sources -= [
       "test/spawned_test_server/remote_test_server.cc",
       "test/spawned_test_server/remote_test_server.h",
       "test/spawned_test_server/spawner_communicator.cc",
       "test/spawned_test_server/spawner_communicator.h",
     ]
   }
 
   if (use_v8_in_net) {
     public_deps += [ ":net_with_v8" ]
   }
 
   if (!enable_mdns) {
     sources -= [
       "dns/mock_mdns_socket_factory.cc",
       "dns/mock_mdns_socket_factory.h",
     ]
   }
 
-  if (use_nss_certs) {
-    public_deps += ["//crypto:platform" ]
-  } else {
+  if (!use_nss_certs) {
     sources -= [
       "test/cert_test_util_nss.cc",
     ]
   }
 }
 
 source_set("balsa") {
   sources = [
     "tools/balsa/balsa_enums.h",
     "tools/balsa/balsa_frame.cc",
@@ skipping 640 matching lines @@
   sources = [ "quic/quic_server_bin.cc" ]
   deps = [
     ":quic_tools",
     ":net",
     "//base",
     "//third_party/boringssl",
   ]
 }
 
 }  # !is_android