1519492 - reorganize NSSCertDBTrustDomain::FindIssuer to facilitate bug 1514118

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[Dana Keeler (she/her) [:keeler]]

The architecture of NSSCertDBTrustDomain::FindIssuer (that it uses a CERTCertList and iterates over the candidates twice) makes it a bit harder than it should be to mix in additional certificates from other sources (essentially, bug 1514118). We can reorganize it to ease future improvements.

Comment 1

[Dana Keeler (she/her) [:keeler]]

Attachment: bug 1519492 - reorganize NSSCertDBTrustDomain::FindIssuer to facilitate future improvements r?jcj

Before this patch, NSSCertDBTrustDomain::FindIssuer would iterate over its
candidate list (a CERTCertList) twice. This would have made it difficult to add
in candidate issuers from other sources (see e.g. bug 1514118, wherein the goal
is to bypass NSS' view of what certificates exist to facilitate third
party/enterprise roots). This patch reorganizes this function to make future
improvements easier.

Comment 2

[Dana Keeler (she/her) [:keeler]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=1b20a34fa61dacd0cf34a71a24737184586b1ea6

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7c4644640936
reorganize NSSCertDBTrustDomain::FindIssuer to facilitate future improvements r=jcj

Comment 4

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/7c4644640936