I was just reading through Adam Langley's description of the bug and this jumped out at me:

> The code will always jump to the end from that second goto, err will contain a successful value because the SHA1 update operation was successful and so the signature verification will never fail.

Wait, Apple still uses SHA1? Are they aware it's banned from use (by NIST, no less) starting with this year?

http://www.zdnet.com/nist-makes-a-hash-of-sha-1-ban-70000259...

Maybe they'd want to take this opportunity to fix that, too...