tree 4e1ece7dfcacc7f50f79977c82f50ae54e0a234b
parent a38f29ad613a56b2ad5b3f109a404c06a7a92fed
author Roland Shoemaker <rolandshoemaker@gmail.com> 1589239314 -0700
committer Filippo Valsorda <filippo@golang.org> 1591375847 +0000

crypto/x509: match cgo and Apple behavior in domain fallback of macOS roots

This change makes the direct call darwin loadSystemRoots implementation
match the existing cgo implementation, which in turn _mostly_ matches
the Apple implementation. The main change here is that when
SecTrustSettingsCopyTrustSettings the error is ignored, and can either
cause a fallback to check admin trust settings, or cause the
certificate to be marked kSecTrustSettingsResultUnspecified.

As well as updating the implementation to match the cgo one, this
change also updates the documentation of how the fallbacks work and
how they match the Apple implementations. References are made to the
Apple source where appropriate. This change does not update the
existing comments in the cgo implementation, since the goal is to
delete that code once the direct call implementation is matured.

Updates #38888

Change-Id: Id0344ea9d2eede3b715f341e9cbd3c1c661b7a90
Reviewed-on: https://go-review.googlesource.com/c/go/+/233360
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>