fdo#72277: don't build and use nsspem when building against system curl

System CURL will know how to get the CA bundle from the system openSSL.
There is no need to have internal NSS CA database support.

Change-Id: Ie5074c78f7d78b2c2f452d4d4e11c98222529883

5 files changed, 34 insertions, 4 deletions

diff --git a/RepositoryExternal.mk b/RepositoryExternal.mk
index 39ca2d852c27..b0747f18cb0b 100644
--- a/RepositoryExternal.mk
+++ b/RepositoryExternal.mk
@@ -2472,6 +2472,9 @@ endif # !SYSTEM_LIBPNG
 ifneq ($(SYSTEM_CURL),)
 
 define gb_LinkTarget__use_curl
+$(call gb_LinkTarget_add_defs,$(1),\
+	-DSYSTEM_CURL \
+)
 $(call gb_LinkTarget_set_include,$(1),\
 	$$(INCLUDE) \
 	$(CURL_CFLAGS) \
diff --git a/external/nss/ExternalPackage_nss.mk b/external/nss/ExternalPackage_nss.mk
index fcbca816986f..26f923979d63 100644
--- a/external/nss/ExternalPackage_nss.mk
+++ b/external/nss/ExternalPackage_nss.mk
@@ -18,7 +18,6 @@ $(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
 		dist/out/lib/libnss3.dylib \
 		dist/out/lib/libnssckbi.dylib \
 		dist/out/lib/libnssdbm3.dylib \
-		dist/out/lib/libnsspem.dylib \
 		dist/out/lib/libnssutil3.dylib \
 		dist/out/lib/libplc4.dylib \
 		dist/out/lib/libplds4.dylib \
@@ -34,7 +33,6 @@ $(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
 		dist/out/lib/nss3.dll \
 		dist/out/lib/nssckbi.dll \
 		dist/out/lib/nssdbm3.dll \
-		dist/out/lib/nsspem.dll \
 		dist/out/lib/nssutil3.dll \
 		dist/out/lib/plc4.dll \
 		dist/out/lib/plds4.dll \
@@ -50,7 +48,6 @@ $(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
 		dist/out/lib/libnss3.so \
 		dist/out/lib/libnssckbi.so \
 		dist/out/lib/libnssdbm3.so \
-		dist/out/lib/libnsspem.so \
 		dist/out/lib/libnssutil3.so \
 		dist/out/lib/libplc4.so \
 		dist/out/lib/libplds4.so \
@@ -61,4 +58,20 @@ $(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
 ))
 endif
 
+ifeq ($(SYSTEM_CURL),)
+ifeq ($(OS),MACOSX)
+$(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
+		dist/out/lib/libnsspem.dylib \
+))
+else ifeq ($(OS),WNT)
+$(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
+		dist/out/lib/nsspem.dll \
+))
+else # OS!=WNT/MACOSX
+$(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
+		dist/out/lib/libnsspem.so \
+))
+endif
+endif
+
 # vim: set noet sw=4 ts=4:
diff --git a/external/nss/UnpackedTarball_nss.mk b/external/nss/UnpackedTarball_nss.mk
index bafe3b5f9415..11839c4e624a 100644
--- a/external/nss/UnpackedTarball_nss.mk
+++ b/external/nss/UnpackedTarball_nss.mk
@@ -18,7 +18,6 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\
 	external/nss/nss_macosx.patch \
 	external/nss/nss-linux-x86.patch.0 \
 	external/nss/nss-win32-make.patch.1 \
-	external/nss/nss-pem.patch \
 	$(if $(filter WNTMSC,$(OS)$(COM)),external/nss/nss.windows.patch) \
 	$(if $(filter WNTGCC,$(OS)$(COM)),external/nss/nspr-4.9-build.patch.3 \
 		external/nss/nss-3.13.3-build.patch.3 \
@@ -26,6 +25,13 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\
         external/nss/nspr-build-config.patch \
 ))
 
+# nss-pem is only needed for internal curl to read the NSS CA database
+ifeq ($(SYSTEM_CURL),)
+$(eval $(call gb_UnpackedTarball_add_patches,nss,\
+	external/nss/nss-pem.patch \
+))
+endif
+
 ifeq ($(COM_GCC_IS_CLANG)$(filter -fsanitize=address,$(CC)),TRUE-fsanitize=address)
 $(eval $(call gb_UnpackedTarball_add_patches,nss,\
 	external/nss/asan.patch.1 \
diff --git a/ucb/source/ucp/cmis/cmis_content.cxx b/ucb/source/ucp/cmis/cmis_content.cxx
index 5b817485e7a7..7cd9d3e7170f 100644
--- a/ucb/source/ucp/cmis/cmis_content.cxx
+++ b/ucb/source/ucp/cmis/cmis_content.cxx
@@ -32,10 +32,12 @@
 #include <com/sun/star/ucb/UnsupportedOpenModeException.hpp>
 #include <com/sun/star/ucb/XCommandInfo.hpp>
 #include <com/sun/star/ucb/XDynamicResultSet.hpp>
+#ifndef SYSTEM_CURL
 #include <com/sun/star/xml/crypto/XDigestContext.hpp>
 #include <com/sun/star/xml/crypto/XDigestContextSupplier.hpp>
 #include <com/sun/star/xml/crypto/DigestID.hpp>
 #include <com/sun/star/xml/crypto/NSSInitializer.hpp>
+#endif
 
 #include <comphelper/processfactory.hxx>
 #include <config_oauth2.h>
@@ -276,6 +278,7 @@ namespace cmis
 
         if ( NULL == m_pSession )
         {
+#ifndef SYSTEM_CURL
             // Initialize NSS library to make sure libcmis (and curl) can access CACERTs using NSS
             // when using internal libcurl.
             uno::Reference< com::sun::star::xml::crypto::XNSSInitializer >
@@ -285,6 +288,7 @@ namespace cmis
                     xNSSInitializer->getDigestContext( com::sun::star::xml::crypto::DigestID::SHA256,
                                                               uno::Sequence< beans::NamedValue >() ),
                                                               uno::UNO_SET_THROW );
+#endif
 
             // Set the SSL Validation handler
             libcmis::CertValidationHandlerPtr certHandler(
diff --git a/ucb/source/ucp/cmis/cmis_repo_content.cxx b/ucb/source/ucp/cmis/cmis_repo_content.cxx
index 3adc2b34e0b9..4d2504978388 100644
--- a/ucb/source/ucp/cmis/cmis_repo_content.cxx
+++ b/ucb/source/ucp/cmis/cmis_repo_content.cxx
@@ -15,10 +15,12 @@
 #include <com/sun/star/ucb/XCommandInfo.hpp>
 #include <com/sun/star/ucb/XDynamicResultSet.hpp>
 #include <com/sun/star/ucb/XProgressHandler.hpp>
+#ifndef SYSTEM_CURL
 #include <com/sun/star/xml/crypto/XDigestContext.hpp>
 #include <com/sun/star/xml/crypto/XDigestContextSupplier.hpp>
 #include <com/sun/star/xml/crypto/DigestID.hpp>
 #include <com/sun/star/xml/crypto/NSSInitializer.hpp>
+#endif
 
 #include <comphelper/processfactory.hxx>
 #include <config_oauth2.h>
@@ -124,6 +126,7 @@ namespace cmis
 
     void RepoContent::getRepositories( const uno::Reference< ucb::XCommandEnvironment > & xEnv )
     {
+#ifndef SYSTEM_CURL
         // Initialize NSS library to make sure libcmis (and curl) can access CACERTs using NSS
         // when using internal libcurl.
         uno::Reference< com::sun::star::xml::crypto::XNSSInitializer >
@@ -133,6 +136,7 @@ namespace cmis
                 xNSSInitializer->getDigestContext( com::sun::star::xml::crypto::DigestID::SHA256,
                                                           uno::Sequence< beans::NamedValue >() ),
                                                           uno::UNO_SET_THROW );
+#endif
 
         // Set the proxy if needed. We are doing that all times as the proxy data shouldn't be cached.
         ucbhelper::InternetProxyDecider aProxyDecider( m_xContext );