Remove OS X 10.5 support code from net/cert

Remove some unnecessary comments/look-up code, now that OS X 10.6+
is the required target.

This is a relanding of http://crrev.com/197119 , which was reverted because despite documentation, SecTrustSetAnchorCertificatesOnly is not actually *implemented* until OS X 10.7.

BUG=none
TEST=unit tests
R=wtc

Review URL: https://chromiumcodereview.appspot.com/13945027

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@197229 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 14 insertions, 36 deletions

diff --git a/net/cert/cert_verify_proc_mac.cc b/net/cert/cert_verify_proc_mac.cc
index b082e34..77346df 100644
--- a/net/cert/cert_verify_proc_mac.cc
+++ b/net/cert/cert_verify_proc_mac.cc
@@ -559,8 +559,7 @@ int CertVerifyProcMac::VerifyInternal(
 
   if (flags & CertVerifier::VERIFY_EV_CERT) {
     // Determine the certificate's EV status using SecTrustCopyExtendedResult(),
-    // which we need to look up because the function wasn't added until
-    // Mac OS X 10.5.7.
+    // which is an internal/private API function added in OS X 10.5.7.
     // Note: "ExtendedResult" means extended validation results.
     CFBundleRef bundle =
         CFBundleGetBundleWithIdentifier(CFSTR("com.apple.security"));
diff --git a/net/cert/test_root_certs_mac.cc b/net/cert/test_root_certs_mac.cc
index 475fb24..2728248 100644
--- a/net/cert/test_root_certs_mac.cc
+++ b/net/cert/test_root_certs_mac.cc
@@ -7,6 +7,7 @@
 #include <Security/Security.h>
 
 #include "base/logging.h"
+#include "base/mac/mac_util.h"
 #include "base/mac/scoped_cftyperef.h"
 #include "net/cert/x509_certificate.h"
 
@@ -68,50 +69,28 @@ OSStatus TestRootCerts::FixupSecTrustRef(SecTrustRef trust_ref) const {
   if (IsEmpty())
     return noErr;
 
-  CFBundleRef bundle =
-      CFBundleGetBundleWithIdentifier(CFSTR("com.apple.security"));
-  SecTrustSetAnchorCertificatesOnlyFuncPtr set_anchor_certificates_only = NULL;
-  if (bundle) {
-    set_anchor_certificates_only =
-        reinterpret_cast<SecTrustSetAnchorCertificatesOnlyFuncPtr>(
-            CFBundleGetFunctionPointerForName(bundle,
-                CFSTR("SecTrustSetAnchorCertificatesOnly")));
-  }
-
-  OSStatus status = noErr;
-  if (set_anchor_certificates_only) {
-    // OS X 10.6 includes a function where the system trusts can be
-    // preserved while appending application trusts. This is preferable,
-    // because it preserves any user trust settings (explicit distrust),
-    // which the naive copy in 10.5 does not. Unfortunately, though the
-    // function pointer may be available, it is not always implemented. If it
-    // returns errSecUnimplemented, fall through to the 10.5 behaviour.
-    status = SecTrustSetAnchorCertificates(trust_ref, temporary_roots_);
-    if (status)
-      return status;
-    status = set_anchor_certificates_only(trust_ref, false);
-    if (status != errSecUnimplemented)
-      return status;
-
-    // Restore the original settings before falling back.
-    status = SecTrustSetAnchorCertificates(trust_ref, NULL);
+  // Despite SecTrustSetAnchorCertificatesOnly existing in OS X 10.6, and
+  // being documented as available, it is not actually implemented. On 10.7+,
+  // however, it always works.
+  if (base::mac::IsOSLionOrLater()) {
+    OSStatus status = SecTrustSetAnchorCertificates(trust_ref,
+                                                    temporary_roots_);
     if (status)
       return status;
+    // Trust system store in addition to trusting |temporary_roots_|.
+    return SecTrustSetAnchorCertificatesOnly(trust_ref, false);
   }
 
-  // On 10.5, the system certificates have to be copied and merged into
-  // the application trusts, and may override any user trust settings.
+  // For OS X 10.6, emulate the functionality by copying the system roots
+  // in addition to |temporary_roots_|.
   CFArrayRef system_roots = NULL;
-  status = SecTrustCopyAnchorCertificates(&system_roots);
+  OSStatus status = SecTrustCopyAnchorCertificates(&system_roots);
   if (status)
     return status;
 
   base::mac::ScopedCFTypeRef<CFArrayRef> scoped_system_roots(system_roots);
   base::mac::ScopedCFTypeRef<CFMutableArrayRef> scoped_roots(
-      CFArrayCreateMutableCopy(kCFAllocatorDefault, 0,
-                               scoped_system_roots));
-  DCHECK(scoped_roots.get());
-
+      CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, scoped_system_roots));
   CFArrayAppendArray(scoped_roots, temporary_roots_,
                      CFRangeMake(0, CFArrayGetCount(temporary_roots_)));
   return SecTrustSetAnchorCertificates(trust_ref, scoped_roots);