Mark SHA-1 as deprecated

net/cert/cert_verify_proc_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc.h"
 
 #include <vector>
 
 #include "base/callback_helpers.h"
 #include "base/files/file_path.h"
@@ skipping 626 matching lines @@
   CertVerifyResult verify_result;
   // This will blow up, May 24th, 2019. Sorry! Please disable and file a bug
   // against agl. See also PublicKeyHashes.
   int error = Verify(cert_chain.get(),
                      "satveda.com",
                      flags,
                      NULL,
                      empty_cert_list_,
                      &verify_result);
   EXPECT_EQ(OK, error);
-  EXPECT_EQ(0U, verify_result.cert_status);
+  EXPECT_EQ(CERT_STATUS_DEPRECATED_SIGNATURE_ALGORITHM,
+            verify_result.cert_status);
   EXPECT_TRUE(verify_result.is_issued_by_known_root);
 }
 
 // The certse.pem certificate has been revoked. crbug.com/259723.
 TEST_F(CertVerifyProcTest, PublicKeyHashes) {
   if (!SupportsReturningVerifiedChain()) {
     LOG(INFO) << "Skipping this test in this platform.";
     return;
   }
 
@@ skipping 13 matching lines @@
 
   // This will blow up, May 24th, 2019. Sorry! Please disable and file a bug
   // against agl. See also TestKnownRoot.
   int error = Verify(cert_chain.get(),
                      "satveda.com",
                      flags,
                      NULL,
                      empty_cert_list_,
                      &verify_result);
   EXPECT_EQ(OK, error);
-  EXPECT_EQ(0U, verify_result.cert_status);
+  EXPECT_EQ(CERT_STATUS_DEPRECATED_SIGNATURE_ALGORITHM,
+            verify_result.cert_status);
   ASSERT_LE(2U, verify_result.public_key_hashes.size());
 
   HashValueVector sha1_hashes;
   for (size_t i = 0; i < verify_result.public_key_hashes.size(); ++i) {
     if (verify_result.public_key_hashes[i].tag != HASH_VALUE_SHA1)
       continue;
     sha1_hashes.push_back(verify_result.public_key_hashes[i]);
   }
   ASSERT_LE(2u, sha1_hashes.size());
 
@@ skipping 377 matching lines @@
   // works. Only the first two certificates are included in the chain.
   int flags = 0;
   CertVerifyResult verify_result;
   int error = Verify(cybertrust_basic.get(),
                      "cacert.omniroot.com",
                      flags,
                      NULL,
                      empty_cert_list_,
                      &verify_result);
   EXPECT_EQ(OK, error);
-  EXPECT_EQ(0U, verify_result.cert_status);
+  EXPECT_EQ(CERT_STATUS_DEPRECATED_SIGNATURE_ALGORITHM,
+            verify_result.cert_status);
 
   // Attempt to verify with the first known cross-certified intermediate
   // provided.
   scoped_refptr<X509Certificate> baltimore_intermediate_1 =
       ImportCertFromFile(GetTestCertsDirectory(),
                          "cybertrust_baltimore_cross_certified_1.pem");
   ASSERT_TRUE(baltimore_intermediate_1.get());
 
   X509Certificate::OSCertHandles intermediate_chain_1 =
       cybertrust_basic->GetIntermediateCertificates();
   intermediate_chain_1.push_back(baltimore_intermediate_1->os_cert_handle());
 
   scoped_refptr<X509Certificate> baltimore_chain_1 =
       X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(),
                                         intermediate_chain_1);
   error = Verify(baltimore_chain_1.get(),
                  "cacert.omniroot.com",
                  flags,
                  NULL,
                  empty_cert_list_,
                  &verify_result);
   EXPECT_EQ(OK, error);
-  EXPECT_EQ(0U, verify_result.cert_status);
+  EXPECT_EQ(CERT_STATUS_DEPRECATED_SIGNATURE_ALGORITHM,
+            verify_result.cert_status);
 
   // Attempt to verify with the second known cross-certified intermediate
   // provided.
   scoped_refptr<X509Certificate> baltimore_intermediate_2 =
       ImportCertFromFile(GetTestCertsDirectory(),
                          "cybertrust_baltimore_cross_certified_2.pem");
   ASSERT_TRUE(baltimore_intermediate_2.get());
 
   X509Certificate::OSCertHandles intermediate_chain_2 =
       cybertrust_basic->GetIntermediateCertificates();
   intermediate_chain_2.push_back(baltimore_intermediate_2->os_cert_handle());
 
   scoped_refptr<X509Certificate> baltimore_chain_2 =
       X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(),
                                         intermediate_chain_2);
   error = Verify(baltimore_chain_2.get(),
                  "cacert.omniroot.com",
                  flags,
                  NULL,
                  empty_cert_list_,
                  &verify_result);
   EXPECT_EQ(OK, error);
-  EXPECT_EQ(0U, verify_result.cert_status);
+  EXPECT_EQ(CERT_STATUS_DEPRECATED_SIGNATURE_ALGORITHM,
+            verify_result.cert_status);
 
   // Attempt to verify when both a cross-certified intermediate AND
   // the legacy GTE root are provided.
   scoped_refptr<X509Certificate> cybertrust_root =
       ImportCertFromFile(GetTestCertsDirectory(),
                          "cybertrust_gte_root.pem");
   ASSERT_TRUE(cybertrust_root.get());
 
   intermediate_chain_2.push_back(cybertrust_root->os_cert_handle());
   scoped_refptr<X509Certificate> baltimore_chain_with_root =
       X509Certificate::CreateFromHandle(cybertrust_basic->os_cert_handle(),
                                         intermediate_chain_2);
   error = Verify(baltimore_chain_with_root.get(),
                  "cacert.omniroot.com",
                  flags,
                  NULL,
                  empty_cert_list_,
                  &verify_result);
   EXPECT_EQ(OK, error);
-  EXPECT_EQ(0U, verify_result.cert_status);
+  EXPECT_EQ(CERT_STATUS_DEPRECATED_SIGNATURE_ALGORITHM,
+            verify_result.cert_status);
 
   TestRootCerts::GetInstance()->Clear();
   EXPECT_TRUE(TestRootCerts::GetInstance()->IsEmpty());
 }
 #endif
 
 #if defined(USE_NSS) || defined(OS_IOS) || defined(OS_WIN) || defined(OS_MACOSX)
 // Test that CRLSets are effective in making a certificate appear to be
 // revoked.
 TEST_F(CertVerifyProcTest, CRLSet) {
@@ skipping 77 matching lines @@
 
   int flags = 0;
   CertVerifyResult verify_result;
   int error = Verify(leaf.get(),
                      "test.example.com",
                      flags,
                      NULL,
                      empty_cert_list_,
                      &verify_result);
   EXPECT_EQ(OK, error);
-  EXPECT_EQ(0U, verify_result.cert_status);
+  EXPECT_EQ(CERT_STATUS_DEPRECATED_SIGNATURE_ALGORITHM,
+            verify_result.cert_status);
 
   // Test revocation by serial number of a certificate not under the root.
   scoped_refptr<CRLSet> crl_set;
   std::string crl_set_bytes;
   ASSERT_TRUE(base::ReadFileToString(
       GetTestCertsDirectory().AppendASCII("crlset_by_intermediate_serial.raw"),
       &crl_set_bytes));
   ASSERT_TRUE(CRLSetStorage::Parse(crl_set_bytes, &crl_set));
 
   error = Verify(leaf.get(),
@@ skipping 316 matching lines @@
     EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_COMMON_NAME_INVALID);
   }
 }
 
 WRAPPED_INSTANTIATE_TEST_CASE_P(
     VerifyName,
     CertVerifyProcNameTest,
     testing::ValuesIn(kVerifyNameData));
 
 }  // namespace net