fdo#72277: don't build and use nsspem when building against system curl

System CURL will know how to get the CA bundle from the system openSSL.
There is no need to have internal NSS CA database support.

Change-Id: Ie5074c78f7d78b2c2f452d4d4e11c98222529883

Conflicts:
ucb/source/ucp/cmis/cmis_content.cxx
ucb/source/ucp/cmis/cmis_repo_content.cxx

5 files changed, 58 insertions, 2 deletions

diff --git a/RepositoryExternal.mk b/RepositoryExternal.mk
index fc8c8f70a881..c0dbb784ec97 100644
--- a/RepositoryExternal.mk
+++ b/RepositoryExternal.mk
@@ -2426,6 +2426,9 @@ endif # !SYSTEM_LIBPNG
 ifneq ($(SYSTEM_CURL),)
 
 define gb_LinkTarget__use_curl
+$(call gb_LinkTarget_add_defs,$(1),\
+	-DSYSTEM_CURL \
+)
 $(call gb_LinkTarget_set_include,$(1),\
 	$$(INCLUDE) \
 	$(CURL_CFLAGS) \
diff --git a/external/nss/ExternalPackage_nss.mk b/external/nss/ExternalPackage_nss.mk
index e7e9e8a08159..26f923979d63 100644
--- a/external/nss/ExternalPackage_nss.mk
+++ b/external/nss/ExternalPackage_nss.mk
@@ -58,4 +58,20 @@ $(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
 ))
 endif
 
+ifeq ($(SYSTEM_CURL),)
+ifeq ($(OS),MACOSX)
+$(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
+		dist/out/lib/libnsspem.dylib \
+))
+else ifeq ($(OS),WNT)
+$(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
+		dist/out/lib/nsspem.dll \
+))
+else # OS!=WNT/MACOSX
+$(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
+		dist/out/lib/libnsspem.so \
+))
+endif
+endif
+
 # vim: set noet sw=4 ts=4:
diff --git a/external/nss/UnpackedTarball_nss.mk b/external/nss/UnpackedTarball_nss.mk
index 56f9430fade7..3ccd7d3c16dc 100644
--- a/external/nss/UnpackedTarball_nss.mk
+++ b/external/nss/UnpackedTarball_nss.mk
@@ -24,6 +24,13 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\
 		external/nss/nss.mingw.patch.3) \
 ))
 
+# nss-pem is only needed for internal curl to read the NSS CA database
+ifeq ($(SYSTEM_CURL),)
+$(eval $(call gb_UnpackedTarball_add_patches,nss,\
+	external/nss/nss-pem.patch \
+))
+endif
+
 ifeq ($(COM_GCC_IS_CLANG)$(filter -fsanitize=address,$(CC)),TRUE-fsanitize=address)
 $(eval $(call gb_UnpackedTarball_add_patches,nss,\
 	external/nss/asan.patch.1 \
diff --git a/ucb/source/ucp/cmis/cmis_content.cxx b/ucb/source/ucp/cmis/cmis_content.cxx
index 4b874e2cad9c..181a67b57ebe 100644
--- a/ucb/source/ucp/cmis/cmis_content.cxx
+++ b/ucb/source/ucp/cmis/cmis_content.cxx
@@ -32,6 +32,15 @@
 #include <com/sun/star/ucb/UnsupportedOpenModeException.hpp>
 #include <com/sun/star/ucb/XCommandInfo.hpp>
 #include <com/sun/star/ucb/XDynamicResultSet.hpp>
+<<<<<<< HEAD
+=======
+#ifndef SYSTEM_CURL
+#include <com/sun/star/xml/crypto/XDigestContext.hpp>
+#include <com/sun/star/xml/crypto/XDigestContextSupplier.hpp>
+#include <com/sun/star/xml/crypto/DigestID.hpp>
+#include <com/sun/star/xml/crypto/NSSInitializer.hpp>
+#endif
+>>>>>>> 89361fa... fdo#72277: don't build and use nsspem when building against system curl
 
 #include <comphelper/processfactory.hxx>
 #include <config_oauth2.h>
@@ -272,6 +281,21 @@ namespace cmis
 
         if ( NULL == m_pSession )
         {
+<<<<<<< HEAD
+=======
+#ifndef SYSTEM_CURL
+            // Initialize NSS library to make sure libcmis (and curl) can access CACERTs using NSS
+            // when using internal libcurl.
+            uno::Reference< com::sun::star::xml::crypto::XNSSInitializer >
+                xNSSInitializer = com::sun::star::xml::crypto::NSSInitializer::create( m_xContext );
+
+            uno::Reference< com::sun::star::xml::crypto::XDigestContext > xDigestContext(
+                    xNSSInitializer->getDigestContext( com::sun::star::xml::crypto::DigestID::SHA256,
+                                                              uno::Sequence< beans::NamedValue >() ),
+                                                              uno::UNO_SET_THROW );
+#endif
+
+>>>>>>> 89361fa... fdo#72277: don't build and use nsspem when building against system curl
             // Set the SSL Validation handler
             libcmis::CertValidationHandlerPtr certHandler(
                     new CertValidationHandler( xEnv, m_xContext, aBindingUrl.GetHost( ) ) );
diff --git a/ucb/source/ucp/cmis/cmis_repo_content.cxx b/ucb/source/ucp/cmis/cmis_repo_content.cxx
index 52068daf6306..6cc2b7108d6d 100644
--- a/ucb/source/ucp/cmis/cmis_repo_content.cxx
+++ b/ucb/source/ucp/cmis/cmis_repo_content.cxx
@@ -16,10 +16,12 @@
 #include <com/sun/star/ucb/XDynamicResultSet.hpp>
 #include <com/sun/star/ucb/XProgressHandler.hpp>
 #include <com/sun/star/uno/XComponentContext.hpp>
+#ifndef SYSTEM_CURL
 #include <com/sun/star/xml/crypto/XDigestContext.hpp>
 #include <com/sun/star/xml/crypto/XDigestContextSupplier.hpp>
 #include <com/sun/star/xml/crypto/DigestID.hpp>
 #include <com/sun/star/xml/crypto/NSSInitializer.hpp>
+#endif
 
 #include <comphelper/processfactory.hxx>
 #include <config_oauth2.h>
@@ -125,8 +127,11 @@ namespace cmis
 
     void RepoContent::getRepositories( const uno::Reference< ucb::XCommandEnvironment > & xEnv )
     {
-        const uno::Reference< com::sun::star::uno::XComponentContext >& 
-            xComponentContext = ::comphelper::getProcessComponentContext();
+#ifndef SYSTEM_CURL
+        // Initialize NSS library to make sure libcmis (and curl) can access CACERTs using NSS
+        // when using internal libcurl.
+        uno::Reference< com::sun::star::xml::crypto::XNSSInitializer >
+            xNSSInitializer = com::sun::star::xml::crypto::NSSInitializer::create( m_xContext );
 
         uno::Reference< com::sun::star::xml::crypto::XNSSInitializer > 
             xNSSInitializer = com::sun::star::xml::crypto::NSSInitializer::create( xComponentContext );
@@ -135,6 +140,7 @@ namespace cmis
                 xNSSInitializer->getDigestContext( com::sun::star::xml::crypto::DigestID::SHA256,
                                                           uno::Sequence< beans::NamedValue >() ),
                                                           uno::UNO_SET_THROW );
+#endif
 
         // Set the proxy if needed. We are doing that all times as the proxy data shouldn't be cached.
         ucbhelper::InternetProxyDecider aProxyDecider( m_xContext );