[glib-networking/nacho/ca-macos] Use the keychain CA certificates on macos

[Ignacio Casal Quinteiro <icq src gnome org>]

commit db1529ed985ab5f5a2452d7abc2117392dbd81f8
Author: Ignacio Casal Quinteiro <qignacio amazon com>
Date:   Wed May 12 12:43:36 2021 +0200

    Use the keychain CA certificates on macos
    
    On macOS the system CA certificates are stored in the keychain.
    Use the system api to retrieve them and to add them to the
    default database.

 meson.build                        |  4 ++++
 tls/openssl/gtlsdatabase-openssl.c | 42 ++++++++++++++++++++++++++++++++++++++
 tls/openssl/meson.build            |  6 ++++++
 3 files changed, 52 insertions(+)
---
diff --git a/meson.build b/meson.build
index 768cdf2..6d15970 100644
--- a/meson.build
+++ b/meson.build
@@ -190,6 +190,10 @@ if gnutls_dep.found()
 endif
 
 if backends.contains('openssl')
+  if ['darwin', 'ios'].contains(host_system)
+    security_dep = dependency('appleframeworks', modules : ['Security'])
+  endif
+
   subdir('tls/openssl')
 endif
 
diff --git a/tls/openssl/gtlsdatabase-openssl.c b/tls/openssl/gtlsdatabase-openssl.c
index 61d607d..1c960cc 100644
--- a/tls/openssl/gtlsdatabase-openssl.c
+++ b/tls/openssl/gtlsdatabase-openssl.c
@@ -31,6 +31,10 @@
 #include <glib/gi18n-lib.h>
 #include "openssl-include.h"
 
+#ifdef __APPLE__
+#include <Security/Security.h>
+#endif
+
 typedef struct
 {
   /*
@@ -181,6 +185,44 @@ g_tls_database_openssl_populate_trust_list (GTlsDatabaseOpenssl  *self,
                                             X509_STORE           *store,
                                             GError              **error)
 {
+#ifdef __APPLE__
+  CFArrayRef anchors;
+  OSStatus ret;
+  CFIndex i;
+
+  ret = SecTrustCopyAnchorCertificates (&anchors);
+  if (ret != errSecSuccess)
+    {
+      g_set_error_literal (error, G_TLS_ERROR, G_TLS_ERROR_MISC,
+                           "Could not get trusted anchors from Keychain");
+      return FALSE;
+    }
+
+  for (i = 0; i < CFArrayGetCount (anchors); i++)
+    {
+      SecCertificateRef cert;
+      CFDataRef data;
+
+      cert = (SecCertificateRef)CFArrayGetValueAtIndex (anchors, i);
+      data = SecCertificateCopyData (cert);
+      if (data)
+        {
+          X509 *x;
+          const unsigned char *pdata;
+
+          pdata = (const unsigned char *)CFDataGetBytePtr (data);
+
+          x = d2i_X509 (NULL, &pdata, CFDataGetLength (data));
+          if (x)
+            X509_STORE_add_cert (store, x);
+
+          CFRelease (data);
+        }
+    }
+
+  CFRelease (anchors);
+#endif
+
   if (!X509_STORE_set_default_paths (store))
     {
       g_set_error (error, G_TLS_ERROR, G_TLS_ERROR_MISC,
diff --git a/tls/openssl/meson.build b/tls/openssl/meson.build
index 0ac25c8..feb10b1 100644
--- a/tls/openssl/meson.build
+++ b/tls/openssl/meson.build
@@ -24,6 +24,12 @@ deps = [
   tlsbase_dep,
 ]
 
+if ['darwin', 'ios'].contains(host_system)
+  deps += [
+    security_dep,
+  ]
+endif
+
 module = shared_module(
   'gioopenssl',
   sources: sources,