@@ -393,16 +393,19 @@ TrustStatus IsTrustDictionaryTrustedForPolicy(CFDictionaryRef trust_dict,
393393
394394 // When kSecTrustSettingsResult is absent from the trust dict,
395395 // Apple docs specify kSecTrustSettingsResultTrustRoot as the default.
396- // Refs https://github.com/apple-oss-distributions/Security/blob/db15acbe6a7f257a859ad9a3bb86097bfe0679d9/trust/headers/SecTrustSettings.h#L119-L122
396+ // Refs
397+ // https://github.com/apple-oss-distributions/Security/blob/db15acbe6a7f257a859ad9a3bb86097bfe0679d9/trust/headers/SecTrustSettings.h#L119-L122
397398 // This is also enforced at write time for self-signed certs get TrustRoot,
398399 // and non-self-signed certs cannot have an empty settings,
399- // Refs https://github.com/apple-oss-distributions/Security/blob/db15acbe6a7f257a859ad9a3bb86097bfe0679d9/OSX/sec/Security/SecTrustStore.c#L196-L207
400+ // Refs
401+ // https://github.com/apple-oss-distributions/Security/blob/db15acbe6a7f257a859ad9a3bb86097bfe0679d9/OSX/sec/Security/SecTrustStore.c#L196-L207
400402
401403 if (trust_settings_result == kSecTrustSettingsResultDeny ) {
402404 return TrustStatus::DISTRUSTED;
403405 }
404406
405- // From https://source.chromium.org/chromium/chromium/src/+/main:net/cert/internal/trust_store_mac.cc;l=144-146
407+ // From
408+ // https://source.chromium.org/chromium/chromium/src/+/main:net/cert/internal/trust_store_mac.cc;l=144-146
406409 // This is a bit of a hack: if the cert is self-issued allow either
407410 // kSecTrustSettingsResultTrustRoot or kSecTrustSettingsResultTrustAsRoot on
408411 // the basis that SecTrustSetTrustSettings should not allow creating an
@@ -416,8 +419,8 @@ TrustStatus IsTrustDictionaryTrustedForPolicy(CFDictionaryRef trust_dict,
416419 if (is_self_issued) {
417420 return (trust_settings_result == kSecTrustSettingsResultTrustRoot ||
418421 trust_settings_result == kSecTrustSettingsResultTrustAsRoot )
419- ? TrustStatus::TRUSTED
420- : TrustStatus::UNSPECIFIED;
422+ ? TrustStatus::TRUSTED
423+ : TrustStatus::UNSPECIFIED;
421424 }
422425
423426 // kSecTrustSettingsResultTrustAsRoot can only be applied to non-root certs.
@@ -462,7 +465,8 @@ bool IsCertificateTrustValid(SecCertificateRef ref) {
462465 // policy that guarantees the certificate can be chained to a known
463466 // trust anchor while filtering out irrelevant certificates.
464467 //
465- // Refs https://github.com/apple-oss-distributions/Security/blob/db15acbe6a7f257a859ad9a3bb86097bfe0679d9/OSX/sec/Security/SecPolicy.c#L1855-L1890
468+ // Refs
469+ // https://github.com/apple-oss-distributions/Security/blob/db15acbe6a7f257a859ad9a3bb86097bfe0679d9/OSX/sec/Security/SecPolicy.c#L1855-L1890
466470 // SecPolicyCreateSSL (both mark EKU optional):
467471 // server=true -> BasicX509 + serverAuth + anyExtendedKeyUsage + SGC
468472 // server=false -> BasicX509 + clientAuth + anyExtendedKeyUsage
0 commit comments