def extract_from_system(cert_callback=None, callback_only_on_failure=False):
certs_pointer_pointer = new(CoreFoundation, '<STR_LIT>')<EOL>res = Security.SecTrustCopyAnchorCertificates(certs_pointer_pointer)<EOL>handle_sec_error(res)<EOL>certs_pointer = unwrap(certs_pointer_pointer)<EOL>certificates = {}<EOL>trust_info = {}<EOL>all_purposes = '<STR_LIT>'<EOL>default_trust = (set(), set())<EOL>length = CoreFoundation.CFArrayGetCount(certs_pointer)<EOL>for index in range(<NUM_LIT:0>, length):<EOL><INDENT>cert_pointer = CoreFoundation.CFArrayGetValueAtIndex(certs_pointer, index)<EOL>der_cert, cert_hash = _cert_details(cert_pointer)<EOL>certificates[cert_hash] = der_cert<EOL><DEDENT>CoreFoundation.CFRelease(certs_pointer)<EOL>for domain in [SecurityConst.kSecTrustSettingsDomainUser, SecurityConst.kSecTrustSettingsDomainAdmin]:<EOL><INDENT>cert_trust_settings_pointer_pointer = new(CoreFoundation, '<STR_LIT>')<EOL>res = Security.SecTrustSettingsCopyCertificates(domain, cert_trust_settings_pointer_pointer)<EOL>if res == SecurityConst.errSecNoTrustSettings:<EOL><INDENT>continue<EOL><DEDENT>handle_sec_error(res)<EOL>cert_trust_settings_pointer = unwrap(cert_trust_settings_pointer_pointer)<EOL>length = CoreFoundation.CFArrayGetCount(cert_trust_settings_pointer)<EOL>for index in range(<NUM_LIT:0>, length):<EOL><INDENT>cert_pointer = CoreFoundation.CFArrayGetValueAtIndex(cert_trust_settings_pointer, index)<EOL>trust_settings_pointer_pointer = new(CoreFoundation, '<STR_LIT>')<EOL>res = Security.SecTrustSettingsCopyTrustSettings(cert_pointer, domain, trust_settings_pointer_pointer)<EOL>if res == SecurityConst.errSecItemNotFound:<EOL><INDENT>continue<EOL><DEDENT>if res == SecurityConst.errSecInvalidTrustSettings:<EOL><INDENT>der_cert, cert_hash = _cert_details(cert_pointer)<EOL>if cert_hash in certificates:<EOL><INDENT>_cert_callback(<EOL>cert_callback,<EOL>certificates[cert_hash],<EOL>'<STR_LIT>'<EOL>)<EOL>del certificates[cert_hash]<EOL><DEDENT>continue<EOL><DEDENT>handle_sec_error(res)<EOL>trust_settings_pointer = unwrap(trust_settings_pointer_pointer)<EOL>trust_oids = set()<EOL>reject_oids = set()<EOL>settings_length = CoreFoundation.CFArrayGetCount(trust_settings_pointer)<EOL>for settings_index in range(<NUM_LIT:0>, settings_length):<EOL><INDENT>settings_dict_entry = CoreFoundation.CFArrayGetValueAtIndex(trust_settings_pointer, settings_index)<EOL>settings_dict = CFHelpers.cf_dictionary_to_dict(settings_dict_entry)<EOL>policy_oid = settings_dict.get('<STR_LIT>', {}).get('<STR_LIT>', all_purposes)<EOL>trust_result = settings_dict.get('<STR_LIT>', <NUM_LIT:1>)<EOL>should_trust = trust_result != <NUM_LIT:0> and trust_result != <NUM_LIT:3><EOL>if should_trust:<EOL><INDENT>trust_oids.add(policy_oid)<EOL><DEDENT>else:<EOL><INDENT>reject_oids.add(policy_oid)<EOL><DEDENT><DEDENT>der_cert, cert_hash = _cert_details(cert_pointer)<EOL>if all_purposes in reject_oids:<EOL><INDENT>if cert_hash in certificates:<EOL><INDENT>_cert_callback(<EOL>cert_callback,<EOL>certificates[cert_hash],<EOL>'<STR_LIT>'<EOL>)<EOL>del certificates[cert_hash]<EOL><DEDENT><DEDENT>else:<EOL><INDENT>if all_purposes in trust_oids:<EOL><INDENT>trust_oids = set([all_purposes])<EOL><DEDENT>trust_info[cert_hash] = (trust_oids, reject_oids)<EOL><DEDENT>CoreFoundation.CFRelease(trust_settings_pointer)<EOL><DEDENT>CoreFoundation.CFRelease(cert_trust_settings_pointer)<EOL><DEDENT>output = []<EOL>for cert_hash in certificates:<EOL><INDENT>if not callback_only_on_failure:<EOL><INDENT>_cert_callback(cert_callback, certificates[cert_hash], None)<EOL><DEDENT>cert_trust_info = trust_info.get(cert_hash, default_trust)<EOL>output.append((certificates[cert_hash], cert_trust_info[<NUM_LIT:0>], cert_trust_info[<NUM_LIT:1>]))<EOL><DEDENT>return output<EOL>
Extracts trusted CA certificates from the OS X trusted root keychain.

:param cert_callback:
    A callback that is called once for each certificate in the trust store.
    It should accept two parameters: an asn1crypto.x509.Certificate object,
    and a reason. The reason will be None if the certificate is being
    exported, otherwise it will be a unicode string of the reason it won't.

:param callback_only_on_failure:
    A boolean - if the callback should only be called when a certificate is
    not exported.

:raises:
    OSError - when an error is returned by the OS crypto library

:return:
    A list of 3-element tuples:
     - 0: a byte string of a DER-encoded certificate
     - 1: a set of unicode strings that are OIDs of purposes to trust the
          certificate for
     - 2: a set of unicode strings that are OIDs of purposes to reject the
          certificate for