Reland "[standalone] Remove the fallback root certificates."

Leave in hooks for the google3 build.

TEST=ci
Change-Id: Ib5768d27fcdbf3d4963da3d8dd142bea5fae10ef
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/506420
Reviewed-by: Slava Egorov <vegorov@google.com>
Commit-Queue: Ryan Macnak <rmacnak@google.com>

runtime/bin/BUILD.gn

@@ -581,16 +581,10 @@ template("dart_io") {
       ]
     }
 
-    if (is_linux || is_win || is_fuchsia) {
-      if (dart_use_fallback_root_certificates) {
-        deps += [ "../../third_party/fallback_root_certificates" ]
-      } else {
-        defines += [ "DART_IO_ROOT_CERTS_DISABLED" ]
-      }
-    }
-
     if (dart_disable_secure_socket) {
       defines += [ "DART_IO_SECURE_SOCKET_DISABLED" ]
+    } else {
+      defines += [ "DART_IO_ROOT_CERTS_DISABLED" ]
     }
 
     include_dirs = [

runtime/bin/security_context_fuchsia.cc

@@ -22,12 +22,7 @@
 namespace dart {
 namespace bin {
 
-// The security context won't necessarily use the compiled-in root certificates,
-// but since there is no way to update the size of the allocation after creating
-// the weak persistent handle, we assume that it will. Note that when the
-// root certs aren't compiled in, |root_certificates_pem_length| is 0.
-const intptr_t SSLCertContext::kApproximateSize =
-    sizeof(SSLCertContext) + root_certificates_pem_length;
+const intptr_t SSLCertContext::kApproximateSize = sizeof(SSLCertContext);
 
 void SSLCertContext::TrustBuiltinRoots() {
   // First, try to use locations specified on the command line.

runtime/bin/security_context_linux.cc

@@ -22,12 +22,7 @@
 namespace dart {
 namespace bin {
 
-// The security context won't necessarily use the compiled-in root certificates,
-// but since there is no way to update the size of the allocation after creating
-// the weak persistent handle, we assume that it will. Note that when the
-// root certs aren't compiled in, |root_certificates_pem_length| is 0.
-const intptr_t SSLCertContext::kApproximateSize =
-    sizeof(SSLCertContext) + root_certificates_pem_length;
+const intptr_t SSLCertContext::kApproximateSize = sizeof(SSLCertContext);
 
 void SSLCertContext::TrustBuiltinRoots() {
   // First, try to use locations specified on the command line.

runtime/bin/security_context_win.cc

@@ -27,12 +27,7 @@
 namespace dart {
 namespace bin {
 
-// The security context won't necessarily use the compiled-in root certificates,
-// but since there is no way to update the size of the allocation after creating
-// the weak persistent handle, we assume that it will. Note that when the
-// root certs aren't compiled in, |root_certificates_pem_length| is 0.
-const intptr_t SSLCertContext::kApproximateSize =
-    sizeof(SSLCertContext) + root_certificates_pem_length;
+const intptr_t SSLCertContext::kApproximateSize = sizeof(SSLCertContext);
 
 static void PrintSSLErr(const char* str) {
   int error = ERR_get_error();
@@ -214,12 +209,6 @@ void SSLCertContext::TrustBuiltinRoots() {
   // Reset store. SSL_CTX_set_cert_store will take ownership of store. A manual
   // free is not needed.
   SSL_CTX_set_cert_store(context(), X509_STORE_new());
-  // Fall back on the compiled-in certs if the standard locations don't exist,
-  // or fail to load certificates from Windows root store.
-  if (SSL_LOG_STATUS) {
-    Syslog::Print("Trusting compiled-in roots\n");
-  }
-  AddCompiledInCerts();
 }
 
 void SSLCertContext::RegisterCallbacks(SSL* ssl) {

runtime/runtime_args.gni

@@ -45,10 +45,6 @@ declare_args() {
   # Whether to enable code coverage for the standalone VM.
   dart_vm_code_coverage = false
 
-  # Whether to fall back to built-in root certificates when they cannot be
-  # verified at the operating system level.
-  dart_use_fallback_root_certificates = false
-
   # Whether to disable support for secure sockets in the Dart IO library.
   dart_disable_secure_socket = false