if (!newInstance && !PK11_IsInternal(tok->pk11slot)) { PK11SlotInfo *slot = PK11_GetInternalKeySlot(); NSSUTF8 *nickname = nssCertificate_GetNickname(c, NULL); NSSASCII7 *email = c->email; tok = PK11Slot_GetNSSToken(slot); PK11_FreeSlot(slot);  newInstance = nssToken_ImportCertificate(tok, NULL, NSSCertificateType_PKIX, &c->id, nickname, &c->encoding, &c->issuer, &c->subject, &c->serial, email, PR_TRUE); if (!newInstance) { nssrv = PR_FAILURE; goto done; } nssPKIObject_AddInstance(&c->object, newInstance); newInstance = nssToken_ImportTrust(tok, NULL, &c->encoding, &c->issuer, &c->serial, nssTrust->serverAuth, nssTrust->clientAuth, nssTrust->codeSigning, nssTrust->emailProtection, PR_TRUE); }
STAN_ChangeCertTrust(CERTCertificate *cc, CERTCertTrust *trust){    PRStatus nssrv;    NSSCertificate *c = STAN_GetNSSCertificate(cc);    NSSToken *tok;    NSSTrustDomain *td;    NSSTrust *nssTrust;    NSSArena *arena;    CERTCertTrust *oldTrust;    nssListIterator *tokens;    PRBool moving_object;    nssCryptokiObject *newInstance;    nssPKIObject *pkiob;    oldTrust = nssTrust_GetCERTCertTrustForCert(c, cc);    if (oldTrust) {	if (memcmp(oldTrust, trust, sizeof (CERTCertTrust)) == 0) {	    /* ... and the new trust is no different, done) */	    return PR_SUCCESS;	} else {	    /* take over memory already allocated in cc's arena */	    cc->trust = oldTrust;	}    } else {	cc->trust = PORT_ArenaAlloc(cc->arena, sizeof(CERTCertTrust));    }    memcpy(cc->trust, trust, sizeof(CERTCertTrust));    /* Set the NSSCerticate's trust */    arena = nssArena_Create();    if (!arena) return PR_FAILURE;    nssTrust = nss_ZNEW(arena, NSSTrust);    pkiob = nssPKIObject_Create(arena, NULL, cc->dbhandle, NULL);    if (!pkiob) {	nssArena_Destroy(arena);	return PR_FAILURE;    }    nssTrust->object = *pkiob;    nssTrust->certificate = c;    nssTrust->serverAuth = get_stan_trust(trust->sslFlags, PR_FALSE);    nssTrust->clientAuth = get_stan_trust(trust->sslFlags, PR_TRUE);    nssTrust->emailProtection = get_stan_trust(trust->emailFlags, PR_FALSE);    nssTrust->codeSigning = get_stan_trust(trust->objectSigningFlags, PR_FALSE);    if (c->object.cryptoContext != NULL) {	/* The cert is in a context, set the trust there */	NSSCryptoContext *cc = c->object.cryptoContext;	nssrv = nssCryptoContext_ImportTrust(cc, nssTrust);	if (nssrv != PR_SUCCESS) {	    goto done;	}	if (c->object.numInstances == 0) {	    /* The context is the only instance, finished */	    goto done;	}    }    td = STAN_GetDefaultTrustDomain();    tok = stan_GetTrustToken(c);    moving_object = PR_FALSE;    if (tok && PK11_IsReadOnly(tok->pk11slot))  {	tokens = nssList_CreateIterator(td->tokenList);	if (!tokens) {	    nssrv = PR_FAILURE;	    goto done;	}	for (tok  = (NSSToken *)nssListIterator_Start(tokens);	     tok != (NSSToken *)NULL;	     tok  = (NSSToken *)nssListIterator_Next(tokens))	{	    if (!PK11_IsReadOnly(tok->pk11slot)) break;	}	nssListIterator_Finish(tokens);	nssListIterator_Destroy(tokens);	moving_object = PR_TRUE;    }     if (tok) {	if (moving_object) {	    /* this is kind of hacky.  the softoken needs the cert	     * object in order to store trust.  forcing it to be perm	     */	    NSSUTF8 *nickname = nssCertificate_GetNickname(c, NULL);	    NSSASCII7 *email = NULL;	    if (PK11_IsInternal(tok->pk11slot)) {		email = c->email;	    }	    newInstance = nssToken_ImportCertificate(tok, NULL,	                                             NSSCertificateType_PKIX,	                                             &c->id,	                                             nickname,	                                             &c->encoding,	                                             &c->issuer,	                                             &c->subject,	                                             &c->serial,						     email,	                                             PR_TRUE);	    if (!newInstance) {		nssrv = PR_FAILURE;		goto done;	    }	    nssPKIObject_AddInstance(&c->object, newInstance);	}	newInstance = nssToken_ImportTrust(tok, NULL, &c->encoding,	                                   &c->issuer, &c->serial,	                                   nssTrust->serverAuth,	                                   nssTrust->clientAuth,	                                   nssTrust->codeSigning,	                                   nssTrust->emailProtection, PR_TRUE);	if (newInstance) {	    nssCryptokiObject_Destroy(newInstance);	    nssrv = PR_SUCCESS;	} else {	    nssrv = PR_FAILURE;	}    } else {	nssrv = PR_FAILURE;    }done:    (void)nssTrust_Destroy(nssTrust);    return nssrv;}