Work around GTE CyberTrust/Baltimore CyberTrust cross-signing issues

net/cert/test_root_certs_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/test_root_certs.h"
 
 #include <Security/Security.h>
 
 #include "base/logging.h"
 #include "base/mac/mac_util.h"
@@ skipping 59 matching lines @@
     return noErr;
 
   // Despite SecTrustSetAnchorCertificatesOnly existing in OS X 10.6, and
   // being documented as available, it is not actually implemented. On 10.7+,
   // however, it always works.
   if (base::mac::IsOSLionOrLater()) {
     OSStatus status = SecTrustSetAnchorCertificates(trust_ref,
                                                     temporary_roots_);
     if (status)
       return status;
-    // Trust system store in addition to trusting |temporary_roots_|.
-    return SecTrustSetAnchorCertificatesOnly(trust_ref, false);
+    return SecTrustSetAnchorCertificatesOnly(trust_ref, !allow_system_trust_);
   }
 
-  // For OS X 10.6, emulate the functionality by copying the system roots
-  // in addition to |temporary_roots_|.
+  if (!allow_system_trust_) {
+    // Avoid any copying if system roots are not to be trusted. This acts as
+    // an exclusive list on 10.6, replacing the built-ins.
+    return SecTrustSetAnchorCertificates(trust_ref, temporary_roots_);
+  }
+
+  // Otherwise, both system trust and temporary_roots_ must be trusted.
+  // Emulate the functionality of SecTrustSetAnchorCertificatesOnly by
+  // creating a copy of the system roots and merging with temporary_roots_.
   CFArrayRef system_roots = NULL;
   OSStatus status = SecTrustCopyAnchorCertificates(&system_roots);
   if (status)
     return status;
 
   base::mac::ScopedCFTypeRef<CFArrayRef> scoped_system_roots(system_roots);
   base::mac::ScopedCFTypeRef<CFMutableArrayRef> scoped_roots(
       CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, scoped_system_roots));
   CFArrayAppendArray(scoped_roots, temporary_roots_,
                      CFRangeMake(0, CFArrayGetCount(temporary_roots_)));
   return SecTrustSetAnchorCertificates(trust_ref, scoped_roots);
 }
 
+void TestRootCerts::SetAllowSystemTrust(bool allow_system_trust) {
+  allow_system_trust_ = allow_system_trust;
+}
+
 TestRootCerts::~TestRootCerts() {}
 
 void TestRootCerts::Init() {
   temporary_roots_.reset(CFArrayCreateMutable(kCFAllocatorDefault, 0,
                                               &kCertArrayCallbacks));
+  allow_system_trust_ = true;
 }
 
 }  // namespace net