@CydeWeys made 2 comments.
Reviewable status: 0 of 25 files reviewed, 2 unresolved discussions (waiting on gbrodman).

core/src/main/java/google/registry/flows/domain/DomainFlowUtils.java line 379 at r1 (raw file):

  }

  public static boolean algorithmIsInvalid(int alg) {

Curious as to why this was inverted?

core/src/main/java/google/registry/tools/DigestType.java line 32 at r1 (raw file):

 */
public enum DigestType {
  // Algorithm number 1 is SHA-1 and is deliberately NOT SUPPORTED.

We need to lock this change behind a FeatureFlag and send out notification 30 days ahead of time.

@gbrodman made 2 comments.
Reviewable status: 0 of 25 files reviewed, 2 unresolved discussions (waiting on CydeWeys).

core/src/main/java/google/registry/flows/domain/DomainFlowUtils.java line 379 at r1 (raw file):

Suggested by IDEA, because all calls to it were immediately inverted.

core/src/main/java/google/registry/tools/DigestType.java line 32 at r1 (raw file):

Done. We'll use the same feature flag for the algorithms too.

Geez that's a lot of test changes ... too bad we were using a SHA1 digest everywhere.

@CydeWeys made 2 comments and resolved 2 discussions.
Reviewable status: 0 of 28 files reviewed, 1 unresolved discussion (waiting on gbrodman).

core/src/main/java/google/registry/tools/DigestType.java line 45 at r2 (raw file):

  private final int wireValue;
  private final int bytes;

You could consider adding a third field here, something like boolean allowedInRfc, which would then make it easier to see in the constructor calls above what's allowed and what's not, and then the filter at the call site would be easier as it'd just call filter on the getter.

@CydeWeys reviewed 28 files and all commit messages.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on gbrodman).

no kidding :(

@gbrodman made 2 comments.
Reviewable status: 26 of 28 files reviewed, 1 unresolved discussion (waiting on CydeWeys).

core/src/main/java/google/registry/tools/DigestType.java line 45 at r2 (raw file):

yeah sure, we'll be doing something similar when forbidding insecure algorithms too