Support building BoringSSL with NSS certificates.

build/common.gypi

Index: build/common.gypi
diff --git a/build/common.gypi b/build/common.gypi
index cf560eee2201d5adf15aae13289d3d30f04929a7..eafeadfa99cc73a944e5f8dbfa8d675365ece28d 100644
--- a/build/common.gypi
+++ b/build/common.gypi
@@ -70,7 +70,8 @@
           # certificates, use_openssl_certs must be set.
           'use_openssl%': 0,
 
-          # Typedef X509Certificate::OSCertHandle to OpenSSL's struct X509*.
+          # Use OpenSSL for representing certificates and, unless targetting

[Ryan Sleevi, 2015/02/26 00:35:35]

targeting

[davidben, 2015/02/26 22:59:24]

Done.

+          # Android, the certificate verifier.

[Ryan Sleevi, 2015/02/26 00:35:35]

s/the certificate verifier/certificate verification/.

[davidben, 2015/02/26 22:59:24]

Done.

           'use_openssl_certs%': 0,
 
           # Disable viewport meta tag by default.
@@ -648,21 +649,16 @@
           'os_bsd%': 0,
         }],
 
-        # NSS usage.
-        ['(OS=="linux" or OS=="freebsd" or OS=="openbsd" or OS=="solaris") and use_openssl==0', {
+        # NSS usage. This controls whether NSS is used for certificate
+        # validation and storage (like use_openssl_certs). For historical
+        # reasons, this flag is named use_nss rather than use_nss_certs. In
+        # particular, note it is possible to set both use_openssl and use_nss.
+        ['(OS=="linux" or OS=="freebsd" or OS=="openbsd" or OS=="solaris")', {
           'use_nss%': 1,
         }, {
           'use_nss%': 0,
         }],
 
-        # When OpenSSL is used for SSL and crypto on Unix-like systems, use
-        # OpenSSL's certificate definition.
-        ['(OS=="linux" or OS=="freebsd" or OS=="openbsd" or OS=="solaris") and use_openssl==1', {
-          'use_openssl_certs%': 1,
-        }, {
-          'use_openssl_certs%': 0,
-        }],
-
         # libudev usage.  This currently only affects the content layer.
         ['OS=="linux" and embedded==0', {
           'use_udev%': 1,
@@ -2984,6 +2980,10 @@
         'defines': ['USE_GLIB=1'],
       }],
       ['<(use_nss)==1 and >(nacl_untrusted_build)==0', {
+        # USE_NSS really means NSS is used for certificate validation and
+        # storage (like USE_OPENSSL_CERTS). For historical reasons, this flag is
+        # named USE_NSS rather than USE_NSS_CERTS. In particular, note it is
+        # possible to set both USE_OPENSSL and USE_NSS.
         'defines': ['USE_NSS=1'],
       }],
       ['<(chromeos)==1 and >(nacl_untrusted_build)==0', {