Remove residual support for SHA-1 public key pins.

net/cert/cert_verify_proc_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_nss.h"
 
 #include <cert.h>
 #include <nss.h>
 #include <prerror.h>
 #include <secerr.h>
@@ skipping 597 matching lines @@
   od.offset = SEC_OID_UNKNOWN;
   // NSS doesn't allow us to pass an empty description, so I use a hardcoded,
   // default description here.  The description doesn't need to be unique for
   // each OID.
   od.desc = "a certificate policy";
   od.mechanism = CKM_INVALID_MECHANISM;
   od.supportedExtension = INVALID_CERT_EXTENSION;
   return SECOID_AddEntry(&od);
 }
 
-HashValue CertPublicKeyHashSHA1(CERTCertificate* cert) {
-  HashValue hash(HASH_VALUE_SHA1);
-  SECStatus rv = HASH_HashBuf(HASH_AlgSHA1, hash.data(),
-                              cert->derPublicKey.data, cert->derPublicKey.len);
-  DCHECK_EQ(SECSuccess, rv);
-  return hash;
-}
-
 HashValue CertPublicKeyHashSHA256(CERTCertificate* cert) {
   HashValue hash(HASH_VALUE_SHA256);
   SECStatus rv = HASH_HashBuf(HASH_AlgSHA256, hash.data(),
                               cert->derPublicKey.data, cert->derPublicKey.len);
   DCHECK_EQ(rv, SECSuccess);
   return hash;
 }
 
 void AppendPublicKeyHashes(CERTCertList* cert_list,
                            CERTCertificate* root_cert,
                            HashValueVector* hashes) {
   for (CERTCertListNode* node = CERT_LIST_HEAD(cert_list);
        !CERT_LIST_END(node, cert_list);
        node = CERT_LIST_NEXT(node)) {
-    hashes->push_back(CertPublicKeyHashSHA1(node->cert));
     hashes->push_back(CertPublicKeyHashSHA256(node->cert));
   }
   if (root_cert) {
-    hashes->push_back(CertPublicKeyHashSHA1(root_cert));
     hashes->push_back(CertPublicKeyHashSHA256(root_cert));
   }
 }
 
 // Returns true if |cert_handle| contains a policy OID that is an EV policy
 // OID according to |metadata|, storing the resulting policy OID in
 // |*ev_policy_oid|. A true return is not sufficient to establish that a
 // certificate is EV, but a false return is sufficient to establish the
 // certificate cannot be EV.
 bool IsEVCandidate(EVRootCAMetadata* metadata,
@@ skipping 298 matching lines @@
     CRLSet* crl_set,
     const CertificateList& additional_trust_anchors,
     CertVerifyResult* verify_result) {
   return VerifyInternalImpl(cert, hostname, ocsp_response, flags, crl_set,
                             additional_trust_anchors,
                             NULL,  // chain_verify_callback
                             verify_result);
 }
 
 }  // namespace net