Remove residual support for SHA-1 public key pins.

net/http/transport_security_state.cc

Index: net/http/transport_security_state.cc
diff --git a/net/http/transport_security_state.cc b/net/http/transport_security_state.cc
index e5202c054e3265cb8f1d0e68b24d465fa4b6c773..e68552815b9571c0f98c69aae743ccdc8e49c88a 100644
--- a/net/http/transport_security_state.cc
+++ b/net/http/transport_security_state.cc
@@ -15,7 +15,6 @@
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
-#include "base/sha1.h"
 #include "base/stl_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
@@ -153,8 +152,7 @@ bool GetHPKPReport(const HostPortPair& host_port_pair,
 
     switch (hash_value.tag) {
       case HASH_VALUE_SHA1:
-        known_pin += "pin-sha1=";
-        break;
+        continue;

[davidben, 2017/06/22 21:33:47]

This is just removing a bit in the reporting side of things, right? It looks
like we'd still enforce any SHA-1 pins we have lying around in the user's
profile directory; there's still residual code in HashValue::FromString (used by
the parser) and CertVerifyProc continues to produce SHA-1 hashes.

We probably want to unwind all of that (which I'm all for doing) before taking
this piece out. I bet we can even take HASH_VALUE_SHA1 out altogether. I see
net/cert/internal/parse_ocsp.cc uses it, but not in any useful away as far as I
can tell. (I can unwind that part if you like.)

[davidben, 2017/06/22 21:51:43]

Here's taking it out of parse_ocsp.cc:
https://chromium-review.googlesource.com/545017

[palmer, 2017/06/26 21:32:59]

Oh, OK, great. I didn't know if you'd want me to remove it from CertVerifyProc,
too; I saw it but hesitated to touch it. I'll put up another patchset with that
removed.

       case HASH_VALUE_SHA256:
         known_pin += "pin-sha256=";
         break;