fdo#72277: don't build and use nsspem when building against system curl

System CURL will know how to get the CA bundle from the system openSSL.
There is no need to have internal NSS CA database support.

Change-Id: Ie5074c78f7d78b2c2f452d4d4e11c98222529883

RepositoryExternal.mk

@@ -2472,6 +2472,9 @@ endif # !SYSTEM_LIBPNG
 ifneq ($(SYSTEM_CURL),)
 
 define gb_LinkTarget__use_curl
+$(call gb_LinkTarget_add_defs,$(1),\
+	-DSYSTEM_CURL \
+)
 $(call gb_LinkTarget_set_include,$(1),\
 	$$(INCLUDE) \
 	$(CURL_CFLAGS) \

external/nss/ExternalPackage_nss.mk

@@ -18,7 +18,6 @@ $(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
 		dist/out/lib/libnss3.dylib \
 		dist/out/lib/libnssckbi.dylib \
 		dist/out/lib/libnssdbm3.dylib \
-		dist/out/lib/libnsspem.dylib \
 		dist/out/lib/libnssutil3.dylib \
 		dist/out/lib/libplc4.dylib \
 		dist/out/lib/libplds4.dylib \
@@ -34,7 +33,6 @@ $(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
 		dist/out/lib/nss3.dll \
 		dist/out/lib/nssckbi.dll \
 		dist/out/lib/nssdbm3.dll \
-		dist/out/lib/nsspem.dll \
 		dist/out/lib/nssutil3.dll \
 		dist/out/lib/plc4.dll \
 		dist/out/lib/plds4.dll \
@@ -50,7 +48,6 @@ $(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
 		dist/out/lib/libnss3.so \
 		dist/out/lib/libnssckbi.so \
 		dist/out/lib/libnssdbm3.so \
-		dist/out/lib/libnsspem.so \
 		dist/out/lib/libnssutil3.so \
 		dist/out/lib/libplc4.so \
 		dist/out/lib/libplds4.so \
@@ -61,4 +58,20 @@ $(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
 ))
 endif
 
+ifeq ($(SYSTEM_CURL),)
+ifeq ($(OS),MACOSX)
+$(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
+		dist/out/lib/libnsspem.dylib \
+))
+else ifeq ($(OS),WNT)
+$(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
+		dist/out/lib/nsspem.dll \
+))
+else # OS!=WNT/MACOSX
+$(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
+		dist/out/lib/libnsspem.so \
+))
+endif
+endif
+
 # vim: set noet sw=4 ts=4:

external/nss/UnpackedTarball_nss.mk

@@ -18,7 +18,6 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\
 	external/nss/nss_macosx.patch \
 	external/nss/nss-linux-x86.patch.0 \
 	external/nss/nss-win32-make.patch.1 \
-	external/nss/nss-pem.patch \
 	$(if $(filter WNTMSC,$(OS)$(COM)),external/nss/nss.windows.patch) \
 	$(if $(filter WNTGCC,$(OS)$(COM)),external/nss/nspr-4.9-build.patch.3 \
 		external/nss/nss-3.13.3-build.patch.3 \
@@ -26,6 +25,13 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\
         external/nss/nspr-build-config.patch \
 ))
 
+# nss-pem is only needed for internal curl to read the NSS CA database
+ifeq ($(SYSTEM_CURL),)
+$(eval $(call gb_UnpackedTarball_add_patches,nss,\
+	external/nss/nss-pem.patch \
+))
+endif
+
 ifeq ($(COM_GCC_IS_CLANG)$(filter -fsanitize=address,$(CC)),TRUE-fsanitize=address)
 $(eval $(call gb_UnpackedTarball_add_patches,nss,\
 	external/nss/asan.patch.1 \

ucb/source/ucp/cmis/cmis_content.cxx

@@ -32,10 +32,12 @@
 #include <com/sun/star/ucb/UnsupportedOpenModeException.hpp>
 #include <com/sun/star/ucb/XCommandInfo.hpp>
 #include <com/sun/star/ucb/XDynamicResultSet.hpp>
+#ifndef SYSTEM_CURL
 #include <com/sun/star/xml/crypto/XDigestContext.hpp>
 #include <com/sun/star/xml/crypto/XDigestContextSupplier.hpp>
 #include <com/sun/star/xml/crypto/DigestID.hpp>
 #include <com/sun/star/xml/crypto/NSSInitializer.hpp>
+#endif
 
 #include <comphelper/processfactory.hxx>
 #include <config_oauth2.h>
@@ -276,6 +278,7 @@ namespace cmis
 
         if ( NULL == m_pSession )
         {
+#ifndef SYSTEM_CURL
             // Initialize NSS library to make sure libcmis (and curl) can access CACERTs using NSS
             // when using internal libcurl.
             uno::Reference< com::sun::star::xml::crypto::XNSSInitializer >
@@ -285,6 +288,7 @@ namespace cmis
                     xNSSInitializer->getDigestContext( com::sun::star::xml::crypto::DigestID::SHA256,
                                                               uno::Sequence< beans::NamedValue >() ),
                                                               uno::UNO_SET_THROW );
+#endif
 
             // Set the SSL Validation handler
             libcmis::CertValidationHandlerPtr certHandler(

ucb/source/ucp/cmis/cmis_repo_content.cxx

@@ -15,10 +15,12 @@
 #include <com/sun/star/ucb/XCommandInfo.hpp>
 #include <com/sun/star/ucb/XDynamicResultSet.hpp>
 #include <com/sun/star/ucb/XProgressHandler.hpp>
+#ifndef SYSTEM_CURL
 #include <com/sun/star/xml/crypto/XDigestContext.hpp>
 #include <com/sun/star/xml/crypto/XDigestContextSupplier.hpp>
 #include <com/sun/star/xml/crypto/DigestID.hpp>
 #include <com/sun/star/xml/crypto/NSSInitializer.hpp>
+#endif
 
 #include <comphelper/processfactory.hxx>
 #include <config_oauth2.h>
@@ -124,6 +126,7 @@ namespace cmis
 
     void RepoContent::getRepositories( const uno::Reference< ucb::XCommandEnvironment > & xEnv )
     {
+#ifndef SYSTEM_CURL
         // Initialize NSS library to make sure libcmis (and curl) can access CACERTs using NSS
         // when using internal libcurl.
         uno::Reference< com::sun::star::xml::crypto::XNSSInitializer >
@@ -133,6 +136,7 @@ namespace cmis
                 xNSSInitializer->getDigestContext( com::sun::star::xml::crypto::DigestID::SHA256,
                                                           uno::Sequence< beans::NamedValue >() ),
                                                           uno::UNO_SET_THROW );
+#endif
 
         // Set the proxy if needed. We are doing that all times as the proxy data shouldn't be cached.
         ucbhelper::InternetProxyDecider aProxyDecider( m_xContext );