#
#
# patch "database.cc"
#  from [d3ff536dbfd8f3e8fb8b81417acc7bae06dcd3df]
#    to [45a853c398d98224ff998f8769cf4dcbbb0a7d40]
# 
# patch "database.hh"
#  from [874796e56fe674718be27ae6832e9178edfd90bb]
#    to [e3de5162c6654e1355444eb0d6c4d8bd6c0fe63b]
#
============================================================
--- database.cc	d3ff536dbfd8f3e8fb8b81417acc7bae06dcd3df
+++ database.cc	45a853c398d98224ff998f8769cf4dcbbb0a7d40
@@ -19,6 +19,7 @@
 #include "vector.hh"
 
 #include <string.h>
+#include <boost/bind.hpp>
 #include <boost/shared_ptr.hpp>
 #include <boost/tuple/tuple.hpp>
 #include <boost/tuple/tuple_comparison.hpp>
@@ -3442,15 +3443,10 @@ namespace {
     }
   };
 
-  typedef bool (lua_hooks::*cert_trust_hook_t)(set<rsa_keypair_id> const &,
-                                               id const &,
-                                               cert_name const &,
-                                               cert_value const &);
-
   void
   erase_bogus_certs_internal(vector<cert> & certs,
-                             database & db, lua_hooks & lua,
-                             cert_trust_hook_t hook_get_cert_trust)
+                             database & db,
+                             database::cert_trust_checker const & checker)
   {
     typedef vector<cert>::iterator it;
     it e = remove_if(certs.begin(), certs.end(), bogus_cert_p(db));
@@ -3484,10 +3480,10 @@ namespace {
     for (trust_map::const_iterator i = trust.begin();
          i != trust.end(); ++i)
       {
-        if ((lua.*hook_get_cert_trust)(*(i->second.first),
-                                       get<0>(i->first),
-                                       get<1>(i->first),
-                                       get<2>(i->first)))
+        if (checker(*(i->second.first),
+                    get<0>(i->first),
+                    get<1>(i->first),
+                    get<2>(i->first)))
           {
             if (global_sanity.debug_p())
               L(FL("trust function liked %d signers of %s cert on revision %s")
@@ -3511,9 +3507,16 @@ database::erase_bogus_certs(vector<cert>
 void
 database::erase_bogus_certs(vector<cert> & certs)
 {
-  erase_bogus_certs_internal(certs, *this, this->lua,
-                             &lua_hooks::hook_get_revision_cert_trust);
+  erase_bogus_certs_internal(certs, *this,
+                             boost::bind(&lua_hooks::hook_get_revision_cert_trust,
+                                         &this->lua, _1, _2, _3, _4));
 }
+void
+database::erase_bogus_certs(vector<cert> & certs,
+                            database::cert_trust_checker const & checker)
+{
+  erase_bogus_certs_internal(certs, *this, checker);
+}
 
 // These are only used by migration from old manifest-style ancestry, so we
 // don't much worry that they are not perfectly typesafe.  Also, we know
@@ -3523,16 +3526,18 @@ database::get_manifest_certs(manifest_id
 database::get_manifest_certs(manifest_id const & id, std::vector<cert> & certs)
 {
   imp->get_certs(id.inner(), certs, "manifest_certs");
-  erase_bogus_certs_internal(certs, *this, this->lua,
-                             &lua_hooks::hook_get_manifest_cert_trust);
+  erase_bogus_certs_internal(certs, *this,
+                             boost::bind(&lua_hooks::hook_get_manifest_cert_trust,
+                                         &this->lua, _1, _2, _3, _4));
 }
 
 void
 database::get_manifest_certs(cert_name const & name, std::vector<cert> & certs)
 {
   imp->get_certs(name, certs, "manifest_certs");
-  erase_bogus_certs_internal(certs, *this, this->lua,
-                             &lua_hooks::hook_get_manifest_cert_trust);
+  erase_bogus_certs_internal(certs, *this,
+                             boost::bind(&lua_hooks::hook_get_manifest_cert_trust,
+                                         &this->lua, _1, _2, _3, _4));
 }
 
 // completions
============================================================
--- database.hh	874796e56fe674718be27ae6832e9178edfd90bb
+++ database.hh	e3de5162c6654e1355444eb0d6c4d8bd6c0fe63b
@@ -12,6 +12,7 @@
 
 #include "vector.hh"
 #include <set>
+#include <boost/function.hpp>
 #include <boost/shared_ptr.hpp>
 #include <botan/version.h>
 
@@ -308,7 +309,14 @@ public:
 
   void get_revision_cert(id const & hash, cert & c);
 
+  typedef boost::function<bool(std::set<rsa_keypair_id> const &,
+                               id const &,
+                               cert_name const &,
+                               cert_value const &)> cert_trust_checker;
   void erase_bogus_certs(std::vector<cert> & certs);
+  // permit alternative trust functions
+  void erase_bogus_certs(std::vector<cert> & certs,
+                         cert_trust_checker const & checker);
 
   //
   // --== Epochs ==--