Bring back SCT_STATUS_INVALID for cached entries

net/cert/sct_status_flags.h

Index: net/cert/sct_status_flags.h
diff --git a/net/cert/sct_status_flags.h b/net/cert/sct_status_flags.h
index ac0bc7d7e6716793c9911833fc089eff881818a9..a37b09fa26d7876c9c639671f2e00036456ddf80 100644
--- a/net/cert/sct_status_flags.h
+++ b/net/cert/sct_status_flags.h
@@ -21,9 +21,13 @@ enum SCTVerifyStatus {
   // The SCT is from an unknown log, so we cannot verify its signature.
   SCT_STATUS_LOG_UNKNOWN = 1,
 
-  // SCTVerifyStatus=2 used to represent SCT_STATUS_INVALID, which has now been
-  // split into INVALID_SIGNATURE and INVALID_TIMESTAMP to represent the
-  // different reasons an SCT could be invalid.
+  // This value is deprecated and should not be used. It has been split
+  // into INVALID_SIGNATURE and INVALID_TIMESTAMP to represent the
+  // different reasons an SCT could be invalid. It is preserved here
+  // because SCTVerifyStatus values are serialized into the disk cache,
+  // so a previously written value of SCT_STATUS_INVALID could be read
+  // out of the disk cache.

[Ryan Sleevi, 2016/08/24 04:51:13]

Layering: net/cert doesn't know about things like "the disk cache"

// DEPRECATED: No longer in use, but may be present in serialized messages.
DEPRECATED_SCT_STATUS_INVALID = 2,

+  SCT_STATUS_INVALID = 2,
 
   // The SCT is from a known log, and the signature is valid.
   SCT_STATUS_OK = 3,