Use time-constant comparison in password testing (#3090)

Normal comparison exits out once a difference is found so theoretically
a time variance can leak information. This isn't really a huge deal but
is probably still worth doing.

console-webapp/build.gradle

@@ -53,10 +53,17 @@ def createConsoleTask = { env ->
   project.tasks.register("buildConsoleFor${env.capitalize()}", Exec) {
     workingDir "${consoleDir}/"
     executable 'npx'
-    args 'ng', 'build', '--base-href=/console/', "--configuration=${env}", "--output-path=staged/console-${env}"
+    args 'ng', 'build', '--base-href=/console/', "--configuration=${env}"
     doFirst {
       println "Building console for environment: ${env}"
     }
+    doLast {
+      copy {
+        from "${consoleDir}/staged/dist/"
+        into "${consoleDir}/staged/console-${env}"
+      }
+      delete "${consoleDir}/staged/dist"
+    }
     dependsOn(tasks.npmInstallDeps)
   }
   project.tasks.register("deleteConsoleFor${env.capitalize()}", Delete) {

core/src/main/java/google/registry/beam/rde/RdeIO.java

@@ -212,17 +212,16 @@ public class RdeIO {
           }
         }
 
-        // Don't write the IDN elements for BRDA.
+        // Don't write the IDN elements or EPP params for BRDA.
         if (mode == RdeMode.FULL) {
           for (IdnTableEnum idn : IdnTableEnum.values()) {
             output.write(marshaller.marshalIdn(idn.getTable()));
             counter.increment(RdeResourceType.IDN);
           }
+          output.write(marshaller.marshalRdeEppParams());
+          counter.increment(RdeResourceType.EPP_PARAMS);
         }
 
-        output.write(marshaller.marshalRdeEppParams());
-        counter.increment(RdeResourceType.EPP_PARAMS);
-
         // Output XML that says how many resources were emitted.
         header = counter.makeHeader(tld, mode);
         output.write(marshaller.marshalOrDie(new XjcRdeHeaderElement(header)));

core/src/main/java/google/registry/beam/rde/RdePipeline.java

@@ -372,7 +372,7 @@ public class RdePipeline implements Serializable {
    * <p>The (repoId, pendingDeposit) pairs denote hosts that are referenced from a domain, that are
    * to be included in the corresponding pending deposit.
    *
-   * <p>The (repoId, revisionId) paris come from the most recent history entry query, which can be
+   * <p>The (repoId, revisionId) pairs come from the most recent history entry query, which can be
    * used to load the embedded resources themselves.
    *
    * @return a pair of (repoId, ([pendingDeposit], [revisionId])) where neither the pendingDeposit

core/src/main/java/google/registry/cache/SimplifiedJedisClient.java

@@ -25,10 +25,20 @@ import com.google.common.flogger.FluentLogger;
 import google.registry.model.EppResource;
 import google.registry.model.domain.Domain;
 import google.registry.model.host.Host;
+import io.protostuff.Input;
 import io.protostuff.LinkedBuffer;
+import io.protostuff.Output;
+import io.protostuff.Pipe;
 import io.protostuff.ProtostuffIOUtil;
 import io.protostuff.Schema;
+import io.protostuff.WireFormat;
+import io.protostuff.runtime.DefaultIdStrategy;
+import io.protostuff.runtime.Delegate;
 import io.protostuff.runtime.RuntimeSchema;
+import java.io.IOException;
+import java.net.Inet4Address;
+import java.net.Inet6Address;
+import java.net.InetAddress;
 import java.nio.charset.StandardCharsets;
 import java.util.Optional;
 import redis.clients.jedis.AbstractPipeline;
@@ -52,11 +62,20 @@ public class SimplifiedJedisClient {
           Domain.class, "d_",
           Host.class, "h_");
 
+  /** We need to inform Protostuff of the custom {@link InetAddress} delegates. */
+  private static DefaultIdStrategy createIdStrategy() {
+    DefaultIdStrategy strategy = new DefaultIdStrategy();
+    strategy.registerDelegate(new GenericInetAddressDelegate<>(InetAddress.class));
+    strategy.registerDelegate(new GenericInetAddressDelegate<>(Inet4Address.class));
+    strategy.registerDelegate(new GenericInetAddressDelegate<>(Inet6Address.class));
+    return strategy;
+  }
+
   private static final ImmutableMap<Class<? extends EppResource>, Schema<? extends EppResource>>
       VALUE_SCHEMAS =
           ImmutableMap.of(
               Domain.class, RuntimeSchema.getSchema(Domain.class),
-              Host.class, RuntimeSchema.getSchema(Host.class));
+              Host.class, RuntimeSchema.getSchema(Host.class, createIdStrategy()));
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
@@ -151,4 +170,46 @@ public class SimplifiedJedisClient {
     checkArgument(VALUE_SCHEMAS.containsKey(clazz), "Unknown class type %s", clazz);
     return (Schema<V>) VALUE_SCHEMAS.get(clazz);
   }
+
+  /**
+   * A custom Protostuff {@link Delegate} for {@link InetAddress} and its subclasses.
+   *
+   * <p>This is required in Java 17+ because Protostuff's default runtime schema serialization
+   * relies on reflection. Since {@link InetAddress} is part of the encapsulated {@code java.base}
+   * module, reflective access is restricted and throws {@link
+   * java.lang.reflect.InaccessibleObjectException}.
+   *
+   * <p>This delegate serializes the IP address as a raw byte array using {@link
+   * InetAddress#getAddress()} and reconstructs it using {@link InetAddress#getByAddress(byte[])}
+   */
+  private record GenericInetAddressDelegate<T extends InetAddress>(Class<T> clazz)
+      implements Delegate<T> {
+
+    @Override
+    public WireFormat.FieldType getFieldType() {
+      return WireFormat.FieldType.BYTES;
+    }
+
+    @Override
+    public Class<T> typeClass() {
+      return clazz;
+    }
+
+    @SuppressWarnings("unchecked")
+    @Override
+    public T readFrom(Input input) throws IOException {
+      return (T) InetAddress.getByAddress(input.readByteArray());
+    }
+
+    @Override
+    public void writeTo(Output output, int number, T value, boolean repeated) throws IOException {
+      output.writeByteArray(number, value.getAddress(), repeated);
+    }
+
+    @Override
+    public void transfer(Pipe pipe, Input input, Output output, int number, boolean repeated)
+        throws IOException {
+      output.writeByteArray(number, input.readByteArray(), repeated);
+    }
+  }
 }

core/src/main/java/google/registry/flows/ResourceFlowUtils.java

@@ -44,6 +44,8 @@ import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.host.Host;
 import google.registry.model.transfer.TransferStatus;
 import google.registry.persistence.VKey;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
 import java.time.Instant;
 import java.util.List;
 import java.util.Objects;
@@ -134,7 +136,9 @@ public final class ResourceFlowUtils {
     }
     String authPassword = authInfo.getPw().getValue();
     String domainPassword = domain.getAuthInfo().getPw().getValue();
-    if (!domainPassword.equals(authPassword)) {
+    if (!MessageDigest.isEqual(
+        authPassword.getBytes(StandardCharsets.UTF_8),
+        domainPassword.getBytes(StandardCharsets.UTF_8))) {
       throw new BadAuthInfoForResourceException();
     }
   }

core/src/main/java/google/registry/flows/domain/DomainFlowUtils.java

@@ -389,6 +389,10 @@ public class DomainFlowUtils {
     if (alg > 255 || alg < 0) {
       return true;
     }
+    if (DomainDsData.FORBIDDEN_ALGORITHMS.contains(alg)
+        && FeatureFlag.isActiveNow(FORBID_INSECURE_ALGORITHMS_RFC_9904)) {
+      return true;
+    }
     // Algorithms that are reserved or unassigned will just return a string representation of their
     // integer wire value.
     String algorithm = Algorithm.string(alg);

core/src/main/java/google/registry/model/domain/secdns/DomainDsDataBase.java

@@ -14,6 +14,7 @@
 
 package google.registry.model.domain.secdns;
 
+import com.google.common.collect.ImmutableSet;
 import google.registry.model.ImmutableObject;
 import google.registry.model.UnsafeSerializable;
 import jakarta.persistence.Access;
@@ -26,6 +27,7 @@ import jakarta.xml.bind.annotation.XmlTransient;
 import jakarta.xml.bind.annotation.XmlType;
 import jakarta.xml.bind.annotation.adapters.HexBinaryAdapter;
 import jakarta.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
+import org.xbill.DNS.DNSSEC.Algorithm;
 
 /** Base class for {@link DomainDsData} and {@link DomainDsDataHistory}. */
 @MappedSuperclass
@@ -33,6 +35,16 @@ import jakarta.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
 @XmlType(propOrder = {"keyTag", "algorithm", "digestType", "digest"})
 public abstract class DomainDsDataBase extends ImmutableObject implements UnsafeSerializable {
 
+  // A set of algorithms that we do not allow. See RFC 9904 for more details.
+  public static final ImmutableSet<Integer> FORBIDDEN_ALGORITHMS =
+      ImmutableSet.of(
+          Algorithm.RSAMD5,
+          Algorithm.RSASHA1,
+          Algorithm.RSA_NSEC3_SHA1,
+          Algorithm.DSA,
+          Algorithm.DSA_NSEC3_SHA1,
+          Algorithm.ECC_GOST);
+
   @XmlTransient @Transient @Insignificant String domainRepoId;
 
   /** The identifier for this particular key in the domain. */

core/src/main/java/google/registry/rde/RdeResourceType.java

@@ -30,7 +30,7 @@ public enum RdeResourceType {
   REGISTRAR("urn:ietf:params:xml:ns:rdeRegistrar-1.0", EnumSet.of(FULL, THIN)),
   IDN("urn:ietf:params:xml:ns:rdeIDN-1.0", EnumSet.of(FULL)),
   HEADER("urn:ietf:params:xml:ns:rdeHeader-1.0", EnumSet.of(FULL, THIN)),
-  EPP_PARAMS("urn:ietf:params:xml:ns:rdeEppParams-1.0", EnumSet.of(FULL, THIN));
+  EPP_PARAMS("urn:ietf:params:xml:ns:rdeEppParams-1.0", EnumSet.of(FULL));
 
   private final String uri;
   private final ImmutableSet<RdeMode> modes;

core/src/main/java/google/registry/security/XsrfTokenManager.java

@@ -25,6 +25,7 @@ import com.google.common.hash.Hashing;
 import google.registry.model.server.ServerSecret;
 import google.registry.util.Clock;
 import jakarta.inject.Inject;
+import java.security.MessageDigest;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.List;
@@ -102,7 +103,7 @@ public final class XsrfTokenManager {
     }
     // Reconstruct the token to verify validity.
     String reconstructedToken = encodeToken(ServerSecret.get().asBytes(), email, timestampMillis);
-    if (!token.equals(reconstructedToken)) {
+    if (!MessageDigest.isEqual(token.getBytes(UTF_8), reconstructedToken.getBytes(UTF_8))) {
       logger.atWarning().log(
           "Reconstructed XSRF mismatch (got != expected): %s != %s", token, reconstructedToken);
       return false;

core/src/main/java/google/registry/tools/DsRecord.java

@@ -15,6 +15,7 @@
 package google.registry.tools;
 
 import static com.google.common.base.Preconditions.checkArgument;
+import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.PreconditionsUtils.checkArgumentPresent;
 
 import com.beust.jcommander.IStringConverter;
@@ -46,7 +47,7 @@ record DsRecord(int keyTag, int alg, int digestType, String digest) {
           String.format("DS record has an invalid digest length: %s", digest));
     }
 
-    if (DomainFlowUtils.algorithmIsInvalid(alg)) {
+    if (tm().reTransact(() -> DomainFlowUtils.algorithmIsInvalid(alg))) {
       throw new IllegalArgumentException(
           String.format("DS record uses an unrecognized algorithm: %d", alg));
     }

core/src/test/java/google/registry/cache/SimplifiedJedisClientTest.java

@@ -19,6 +19,7 @@ import static google.registry.model.ImmutableObjectSubject.assertAboutImmutableO
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistActiveDomain;
 import static google.registry.testing.DatabaseHelper.persistActiveHost;
+import static google.registry.testing.DatabaseHelper.persistActiveSubordinateHost;
 import static google.registry.testing.DatabaseHelper.persistDeletedDomain;
 
 import com.google.common.collect.ImmutableList;
@@ -67,7 +68,8 @@ public class SimplifiedJedisClientTest {
 
   @Test
   void testClient_roundTrip_host() {
-    Host host = persistActiveHost("ns1.example.tld");
+    Domain domain = persistActiveDomain("example.tld");
+    Host host = persistActiveSubordinateHost("ns1.example.tld", domain);
     SimplifiedJedisClient client = createJedisClient();
     client.set(new SimplifiedJedisClient.JedisResource<>("repoId1", host));
     assertThat(client.get(Host.class, "repoId1")).hasValue(host);

core/src/test/java/google/registry/export/ExportDomainListsActionTest.java

@@ -21,8 +21,8 @@ import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistActiveDomain;
 import static google.registry.testing.DatabaseHelper.persistDeletedDomain;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.testing.DatabaseHelper.persistResource;
-import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static google.registry.util.DateTimeUtils.plusDays;
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.junit.jupiter.api.Assertions.assertThrows;
@@ -35,10 +35,8 @@ import com.google.cloud.storage.BlobId;
 import com.google.cloud.storage.StorageException;
 import com.google.cloud.storage.contrib.nio.testing.LocalStorageHelper;
 import com.google.common.collect.ImmutableList;
-import com.google.common.collect.ImmutableSortedMap;
 import com.google.common.net.MediaType;
 import google.registry.gcs.GcsUtils;
-import google.registry.model.common.FeatureFlag;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.GracePeriod;
 import google.registry.model.domain.rgp.GracePeriodStatus;
@@ -80,7 +78,7 @@ class ExportDomainListsActionTest {
     action.gcsUtils = gcsUtils;
     action.clock = clock;
     action.driveConnection = driveConnection;
-    persistFeatureFlag(INACTIVE);
+    persistFeatureFlag(INCLUDE_PENDING_DELETE_DATE_FOR_DOMAINS, INACTIVE);
   }
 
   private void verifyExportedToDrive(String folderId, String filename, String domains)
@@ -110,7 +108,7 @@ class ExportDomainListsActionTest {
 
   @Test
   void test_outputsOnlyActiveDomains_csv() throws Exception {
-    persistFeatureFlag(ACTIVE);
+    persistFeatureFlag(INCLUDE_PENDING_DELETE_DATE_FOR_DOMAINS, ACTIVE);
     persistActiveDomain("onetwo.tld");
     persistActiveDomain("rudnitzky.tld");
     persistDeletedDomain("mortuary.tld", Instant.parse("2001-03-14T10:11:12Z"));
@@ -144,7 +142,7 @@ class ExportDomainListsActionTest {
 
   @Test
   void test_outputsOnlyDomainsOnRealTlds_csv() throws Exception {
-    persistFeatureFlag(ACTIVE);
+    persistFeatureFlag(INCLUDE_PENDING_DELETE_DATE_FOR_DOMAINS, ACTIVE);
     persistActiveDomain("onetwo.tld");
     persistActiveDomain("rudnitzky.tld");
     persistActiveDomain("wontgo.testtld");
@@ -164,7 +162,7 @@ class ExportDomainListsActionTest {
 
   @Test
   void test_outputIncludesDeletionTimes_forPendingDeletes_notRdemption() throws Exception {
-    persistFeatureFlag(ACTIVE);
+    persistFeatureFlag(INCLUDE_PENDING_DELETE_DATE_FOR_DOMAINS, ACTIVE);
     // Domains pending delete (meaning the 5 day period, not counting the 30 day redemption period)
     // should include their pending deletion date
     persistActiveDomain("active.tld");
@@ -227,7 +225,7 @@ class ExportDomainListsActionTest {
 
   @Test
   void test_outputsDomainsFromDifferentTldsToMultipleFiles_csv() throws Exception {
-    persistFeatureFlag(ACTIVE);
+    persistFeatureFlag(INCLUDE_PENDING_DELETE_DATE_FOR_DOMAINS, ACTIVE);
     createTld("tldtwo");
     persistResource(Tld.get("tldtwo").asBuilder().setDriveFolderId("hooray").build());
 
@@ -255,13 +253,4 @@ class ExportDomainListsActionTest {
     // tldthree does not have a drive id, so no export to drive is performed.
     verifyNoMoreInteractions(driveConnection);
   }
-
-  private void persistFeatureFlag(FeatureFlag.FeatureStatus status) {
-    persistResource(
-        new FeatureFlag()
-            .asBuilder()
-            .setFeatureName(INCLUDE_PENDING_DELETE_DATE_FOR_DOMAINS)
-            .setStatusMap(ImmutableSortedMap.of(START_INSTANT, status))
-            .build());
-  }
 }

core/src/test/java/google/registry/flows/domain/DomainCreateFlowTest.java

@@ -53,6 +53,7 @@ import static google.registry.testing.DatabaseHelper.loadRegistrar;
 import static google.registry.testing.DatabaseHelper.newHost;
 import static google.registry.testing.DatabaseHelper.persistActiveDomain;
 import static google.registry.testing.DatabaseHelper.persistActiveHost;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.testing.DatabaseHelper.persistReservedList;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.DomainSubject.assertAboutDomains;
@@ -151,7 +152,6 @@ import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingBase.RenewalPriceBehavior;
 import google.registry.model.billing.BillingEvent;
 import google.registry.model.billing.BillingRecurrence;
-import google.registry.model.common.FeatureFlag;
 import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
@@ -798,7 +798,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
         .hasExactlyDsData(
             DomainDsData.create(
                     12345,
-                    3,
+                    8,
                     2,
                     base16()
                         .decode("D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A"))
@@ -968,11 +968,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
   void testFailure_secDnsSha1DigestType() throws Exception {
     setEppInput("domain_create_dsdata_sha1.xml");
     persistHosts();
-    DatabaseHelper.persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(FORBID_INSECURE_ALGORITHMS_RFC_9904)
-            .setStatusMap(ImmutableSortedMap.of(START_INSTANT, FeatureStatus.ACTIVE))
-            .build());
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.ACTIVE);
     EppException thrown = assertThrows(InvalidDsRecordException.class, this::runFlow);
     assertAboutEppExceptions().that(thrown).marshalsToXml();
   }
@@ -981,18 +977,14 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
   void testSuccess_secDnsSha1_flagInactive() throws Exception {
     setEppInput("domain_create_dsdata_sha1.xml");
     persistHosts();
-    DatabaseHelper.persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(FORBID_INSECURE_ALGORITHMS_RFC_9904)
-            .setStatusMap(ImmutableSortedMap.of(START_INSTANT, FeatureStatus.INACTIVE))
-            .build());
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.INACTIVE);
     doSuccessfulTest("tld");
     Domain domain = reloadResourceByForeignKey();
     assertAboutDomains()
         .that(domain)
         .hasExactlyDsData(
             DomainDsData.create(
-                    12345, 3, 1, base16().decode("49FD46E6C4B45C55D4AC49FD46E6C4B45C55D4AC"))
+                    12345, 8, 1, base16().decode("49FD46E6C4B45C55D4AC49FD46E6C4B45C55D4AC"))
                 .cloneWithDomainRepoId(domain.getRepoId()));
   }
 
@@ -1004,6 +996,34 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     assertAboutEppExceptions().that(thrown).marshalsToXml();
   }
 
+  @Test
+  void testFailure_secDnsForbiddenAlgorithm() throws Exception {
+    setEppInput("domain_create_dsdata_forbidden_algorithm.xml");
+    persistHosts();
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.ACTIVE);
+    EppException thrown = assertThrows(InvalidDsRecordException.class, this::runFlow);
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
+  @Test
+  void testSuccess_secDnsForbiddenAlgorithm_flagInactive() throws Exception {
+    setEppInput("domain_create_dsdata_forbidden_algorithm.xml");
+    persistHosts();
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.INACTIVE);
+    doSuccessfulTest("tld");
+    Domain domain = reloadResourceByForeignKey();
+    assertAboutDomains()
+        .that(domain)
+        .hasExactlyDsData(
+            DomainDsData.create(
+                    12345,
+                    1,
+                    2,
+                    base16()
+                        .decode("D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A"))
+                .cloneWithDomainRepoId(domain.getRepoId()));
+  }
+
   @Test
   void testFailure_wrongExtension() {
     setEppInput("domain_create_wrong_extension.xml");

core/src/test/java/google/registry/flows/domain/DomainInfoFlowTest.java

@@ -98,6 +98,8 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
           "UNIT", "y");
 
   private static final Pattern OK_PATTERN = Pattern.compile("\"ok\"");
+  private static final String SHA_256_DIGEST =
+      "D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A";
 
   private Host host1;
   private Host host2;
@@ -314,8 +316,7 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
         domain
             .asBuilder()
             .setDsData(
-                ImmutableSet.of(
-                    DomainDsData.create(12345, 3, 1, base16().decode("49FD46E6C4B45C55D4AC"))))
+                ImmutableSet.of(DomainDsData.create(12345, 8, 2, base16().decode(SHA_256_DIGEST))))
             .setNameservers(ImmutableSet.of(host1.createVKey(), host3.createVKey()))
             .build());
     doSuccessfulTest("domain_info_response_dsdata.xml", false);
@@ -519,8 +520,7 @@ class DomainInfoFlowTest extends ResourceFlowTestCase<DomainInfoFlow, Domain> {
                     "TheRegistrar",
                     null))
             .setDsData(
-                ImmutableSet.of(
-                    DomainDsData.create(12345, 3, 1, base16().decode("49FD46E6C4B45C55D4AC"))))
+                ImmutableSet.of(DomainDsData.create(12345, 8, 2, base16().decode(SHA_256_DIGEST))))
             .build());
     doSuccessfulTest("domain_info_response_dsdata_addperiod.xml", false);
   }

core/src/test/java/google/registry/flows/domain/DomainUpdateFlowTest.java

@@ -47,6 +47,7 @@ import static google.registry.testing.DatabaseHelper.persistActiveDomain;
 import static google.registry.testing.DatabaseHelper.persistActiveHost;
 import static google.registry.testing.DatabaseHelper.persistActiveSubordinateHost;
 import static google.registry.testing.DatabaseHelper.persistDeletedDomain;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.DomainSubject.assertAboutDomains;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
@@ -95,7 +96,6 @@ import google.registry.flows.exceptions.ResourceStatusProhibitsOperationExceptio
 import google.registry.model.ImmutableObject;
 import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingEvent;
-import google.registry.model.common.FeatureFlag;
 import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainAuthInfo;
@@ -130,7 +130,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
   private static final ImmutableMap<String, String> OTHER_DSDATA_TEMPLATE_MAP =
       ImmutableMap.of(
           "KEY_TAG", "12346",
-          "ALG", "3",
+          "ALG", "8",
           "DIGEST_TYPE", "2",
           "DIGEST", SHA_256_DIGEST);
 
@@ -459,9 +459,9 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
     doSecDnsSuccessfulTest(
         "domain_update_dsdata_add.xml",
         null,
-        ImmutableSet.of(DomainDsData.create(12346, 3, 2, base16().decode(SHA_256_DIGEST))),
+        ImmutableSet.of(DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST))),
         ImmutableMap.of(
-            "KEY_TAG", "12346", "ALG", "3", "DIGEST_TYPE", "2", "DIGEST", SHA_256_DIGEST),
+            "KEY_TAG", "12346", "ALG", "8", "DIGEST_TYPE", "2", "DIGEST", SHA_256_DIGEST),
         true);
   }
 
@@ -471,9 +471,9 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
         "domain_update_dsdata_add.xml",
         ImmutableSet.of(SOME_DSDATA),
         ImmutableSet.of(
-            SOME_DSDATA, DomainDsData.create(12346, 3, 2, base16().decode(SHA_256_DIGEST))),
+            SOME_DSDATA, DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST))),
         ImmutableMap.of(
-            "KEY_TAG", "12346", "ALG", "3", "DIGEST_TYPE", "2", "DIGEST", SHA_256_DIGEST),
+            "KEY_TAG", "12346", "ALG", "8", "DIGEST_TYPE", "2", "DIGEST", SHA_256_DIGEST),
         true);
   }
 
@@ -648,7 +648,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
             union(
                 commonDsData,
                 ImmutableSet.of(
-                    DomainDsData.create(12346, 3, 2, base16().decode(SHA_256_DIGEST))))),
+                    DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST))))),
         true);
   }
 
@@ -657,7 +657,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
     doSecDnsSuccessfulTest(
         "domain_update_dsdata_rem.xml",
         ImmutableSet.of(
-            SOME_DSDATA, DomainDsData.create(12346, 3, 2, base16().decode(SHA_256_DIGEST))),
+            SOME_DSDATA, DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST))),
         ImmutableSet.of(SOME_DSDATA),
         true);
   }
@@ -668,7 +668,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
     doSecDnsSuccessfulTest(
         "domain_update_dsdata_rem_all.xml",
         ImmutableSet.of(
-            SOME_DSDATA, DomainDsData.create(12346, 3, 2, base16().decode(SHA_256_DIGEST))),
+            SOME_DSDATA, DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST))),
         ImmutableSet.of(),
         true);
   }
@@ -678,9 +678,9 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
     doSecDnsSuccessfulTest(
         "domain_update_dsdata_add_rem.xml",
         ImmutableSet.of(
-            SOME_DSDATA, DomainDsData.create(12345, 3, 2, base16().decode(SHA_256_DIGEST))),
+            SOME_DSDATA, DomainDsData.create(12345, 8, 2, base16().decode(SHA_256_DIGEST))),
         ImmutableSet.of(
-            SOME_DSDATA, DomainDsData.create(12346, 3, 2, base16().decode(SHA_256_DIGEST))),
+            SOME_DSDATA, DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST))),
         true);
   }
 
@@ -703,12 +703,12 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
             union(
                 commonDsData,
                 ImmutableSet.of(
-                    DomainDsData.create(12345, 3, 2, base16().decode(SHA_256_DIGEST))))),
+                    DomainDsData.create(12345, 8, 2, base16().decode(SHA_256_DIGEST))))),
         ImmutableSet.copyOf(
             union(
                 commonDsData,
                 ImmutableSet.of(
-                    DomainDsData.create(12346, 3, 2, base16().decode(SHA_256_DIGEST))))),
+                    DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST))))),
         true);
   }
 
@@ -893,11 +893,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
             "DIGEST_TYPE", "1",
             "DIGEST", "A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"));
     persistResource(DatabaseHelper.newDomain(getUniqueIdFromCommand()));
-    DatabaseHelper.persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(FORBID_INSECURE_ALGORITHMS_RFC_9904)
-            .setStatusMap(ImmutableSortedMap.of(START_INSTANT, FeatureStatus.ACTIVE))
-            .build());
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.ACTIVE);
     EppException thrown = assertThrows(InvalidDsRecordException.class, this::runFlow);
     assertAboutEppExceptions().that(thrown).marshalsToXml();
   }
@@ -912,11 +908,7 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
             "DIGEST_TYPE", "1",
             "DIGEST", "A94A8FE5CCB19BA61C4C0873D391E987982FBBD3"));
     persistResource(DatabaseHelper.newDomain(getUniqueIdFromCommand()));
-    DatabaseHelper.persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(FORBID_INSECURE_ALGORITHMS_RFC_9904)
-            .setStatusMap(ImmutableSortedMap.of(START_INSTANT, FeatureStatus.INACTIVE))
-            .build());
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.INACTIVE);
     runFlow();
     Domain domain = reloadResourceByForeignKey();
     assertAboutDomains()
@@ -990,6 +982,70 @@ class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, Domain
     assertAboutEppExceptions().that(thrown).marshalsToXml();
   }
 
+  @Test
+  void testFailure_secDnsForbiddenAlgorithm() throws Exception {
+    setEppInput("domain_update_dsdata_add.xml", OTHER_DSDATA_TEMPLATE_MAP);
+    persistResource(
+        DatabaseHelper.newDomain(getUniqueIdFromCommand())
+            .asBuilder()
+            .setDsData(
+                ImmutableSet.of(DomainDsData.create(1, 1, 2, base16().decode(SHA_256_DIGEST))))
+            .build());
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.ACTIVE);
+    EppException thrown = assertThrows(InvalidDsRecordException.class, this::runFlow);
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
+  @Test
+  void testSuccess_secDnsForbiddenAlgorithm_flagInactive() throws Exception {
+    setEppInput("domain_update_dsdata_add.xml", OTHER_DSDATA_TEMPLATE_MAP);
+    persistResource(
+        DatabaseHelper.newDomain(getUniqueIdFromCommand())
+            .asBuilder()
+            .setDsData(
+                ImmutableSet.of(DomainDsData.create(1, 1, 2, base16().decode(SHA_256_DIGEST))))
+            .build());
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.INACTIVE);
+    runFlow();
+    Domain domain = reloadResourceByForeignKey();
+    assertAboutDomains()
+        .that(domain)
+        .hasExactlyDsData(
+            DomainDsData.create(1, 1, 2, base16().decode(SHA_256_DIGEST)),
+            DomainDsData.create(12346, 8, 2, base16().decode(SHA_256_DIGEST)));
+  }
+
+  @Test
+  void testFailure_unrelatedUpdate_existingForbiddenAlgorithm() throws Exception {
+    persistReferencedEntities();
+    persistResource(
+        persistDomain()
+            .asBuilder()
+            .setDsData(
+                ImmutableSet.of(DomainDsData.create(1, 1, 2, base16().decode(SHA_256_DIGEST))))
+            .build());
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.ACTIVE);
+    assertAboutEppExceptions()
+        .that(assertThrows(InvalidDsRecordException.class, this::runFlow))
+        .marshalsToXml();
+  }
+
+  @Test
+  void testSuccess_unrelatedUpdate_existingForbiddenAlgorithm_flagInactive() throws Exception {
+    persistReferencedEntities();
+    persistResource(
+        persistDomain()
+            .asBuilder()
+            .setDsData(
+                ImmutableSet.of(DomainDsData.create(1, 1, 2, base16().decode(SHA_256_DIGEST))))
+            .build());
+    runFlow();
+    Domain updatedDomain = reloadResourceByForeignKey();
+    assertAboutDomains()
+        .that(updatedDomain)
+        .hasExactlyDsData(DomainDsData.create(1, 1, 2, base16().decode(SHA_256_DIGEST)));
+  }
+
   @Test
   void testFailure_secDnsMultipleInvalidAlgorithms() throws Exception {
     setEppInput("domain_update_dsdata_add.xml", OTHER_DSDATA_TEMPLATE_MAP);

core/src/test/java/google/registry/flows/session/LoginFlowTestCase.java

@@ -20,13 +20,12 @@ import static google.registry.model.common.FeatureFlag.FeatureName.PROHIBIT_CONT
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.deleteResource;
 import static google.registry.testing.DatabaseHelper.loadRegistrar;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.EppExceptionSubject.assertAboutEppExceptions;
-import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import com.google.common.collect.ImmutableMap;
-import com.google.common.collect.ImmutableSortedMap;
 import google.registry.flows.EppException;
 import google.registry.flows.EppException.UnimplementedExtensionException;
 import google.registry.flows.EppException.UnimplementedObjectServiceException;
@@ -39,7 +38,6 @@ import google.registry.flows.session.LoginFlow.BadRegistrarIdException;
 import google.registry.flows.session.LoginFlow.RegistrarAccountNotActiveException;
 import google.registry.flows.session.LoginFlow.TooManyFailedLoginsException;
 import google.registry.flows.session.LoginFlow.UnsupportedLanguageException;
-import google.registry.model.common.FeatureFlag;
 import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.model.eppoutput.EppOutput;
 import google.registry.model.registrar.Registrar;
@@ -61,11 +59,7 @@ public abstract class LoginFlowTestCase extends FlowTestCase<LoginFlow> {
     sessionMetadata.setRegistrarId(null); // Don't implicitly log in (all other flows need to).
     registrar = loadRegistrar("NewRegistrar");
     registrarBuilder = registrar.asBuilder();
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(PROHIBIT_CONTACT_OBJECTS_ON_LOGIN)
-            .setStatusMap(ImmutableSortedMap.of(START_INSTANT, FeatureStatus.ACTIVE))
-            .build());
+    persistFeatureFlag(PROHIBIT_CONTACT_OBJECTS_ON_LOGIN, FeatureStatus.ACTIVE);
   }
 
   // Can't inline this since it may be overridden in subclasses.

core/src/test/java/google/registry/testing/DatabaseHelper.java

@@ -69,6 +69,9 @@ import google.registry.model.billing.BillingCancellation;
 import google.registry.model.billing.BillingEvent;
 import google.registry.model.billing.BillingRecurrence;
 import google.registry.model.common.DnsRefreshRequest;
+import google.registry.model.common.FeatureFlag;
+import google.registry.model.common.FeatureFlag.FeatureName;
+import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.model.console.GlobalRole;
 import google.registry.model.console.User;
 import google.registry.model.console.UserRoles;
@@ -682,6 +685,32 @@ public final class DatabaseHelper {
     return newRegistrars.build();
   }
 
+  /** Persists and returns a {@link FeatureFlag} with a single status starting from the epoch. */
+  public static FeatureFlag persistFeatureFlag(FeatureName featureName, FeatureStatus status) {
+    return persistFeatureFlag(featureName, ImmutableSortedMap.of(START_INSTANT, status));
+  }
+
+  /** Persists and returns a {@link FeatureFlag} with an initial status and one transition. */
+  public static FeatureFlag persistFeatureFlag(
+      FeatureName featureName,
+      FeatureStatus initialStatus,
+      Instant transitionTime,
+      FeatureStatus status) {
+    return persistFeatureFlag(
+        featureName,
+        ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
+            .put(START_INSTANT, initialStatus)
+            .put(transitionTime, status)
+            .build());
+  }
+
+  /** Persists and returns a {@link FeatureFlag} with a custom status map. */
+  public static FeatureFlag persistFeatureFlag(
+      FeatureName featureName, ImmutableSortedMap<Instant, FeatureStatus> statusMap) {
+    return persistResource(
+        new FeatureFlag.Builder().setFeatureName(featureName).setStatusMap(statusMap).build());
+  }
+
   public static Iterable<BillingBase> getBillingEvents() {
     return tm().transact(
             () ->

core/src/test/java/google/registry/tools/ConfigureFeatureFlagCommandTest.java

@@ -19,7 +19,7 @@ import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATAS
 import static google.registry.model.common.FeatureFlag.FeatureName.TEST_FEATURE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.ACTIVE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
-import static google.registry.testing.DatabaseHelper.persistResource;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static google.registry.util.DateTimeUtils.plusWeeks;
 import static org.junit.jupiter.api.Assertions.assertThrows;
@@ -27,7 +27,6 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
 import com.beust.jcommander.ParameterException;
 import com.google.common.collect.ImmutableSortedMap;
 import google.registry.model.common.FeatureFlag;
-import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.model.common.TimedTransitionProperty;
 import google.registry.testing.FakeClock;
 import java.time.Instant;
@@ -81,14 +80,7 @@ public class ConfigureFeatureFlagCommandTest extends CommandTestCase<ConfigureFe
 
   @Test
   void testUpdate() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .build())
-            .build());
+    persistFeatureFlag(TEST_FEATURE, INACTIVE);
 
     Instant featureStart = plusWeeks(clock.now(), 6);
     assertThat(FeatureFlag.get(TEST_FEATURE).getStatusMap())
@@ -110,14 +102,7 @@ public class ConfigureFeatureFlagCommandTest extends CommandTestCase<ConfigureFe
 
   @Test
   void testConfigure_multipleFlags() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .build())
-            .build());
+    persistFeatureFlag(TEST_FEATURE, INACTIVE);
 
     Instant featureStart = plusWeeks(clock.now(), 6);
     assertThat(FeatureFlag.get(TEST_FEATURE).getStatusMap())
@@ -179,14 +164,7 @@ public class ConfigureFeatureFlagCommandTest extends CommandTestCase<ConfigureFe
 
   @Test
   void testUpdate_invalidStatusMap() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .build())
-            .build());
+    persistFeatureFlag(TEST_FEATURE, INACTIVE);
 
     Instant featureStart = plusWeeks(clock.now(), 6);
     assertThat(FeatureFlag.get(TEST_FEATURE).getStatusMap())

core/src/test/java/google/registry/tools/CreateDomainCommandTest.java

@@ -15,8 +15,10 @@
 package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.common.FeatureFlag.FeatureName.FORBID_INSECURE_ALGORITHMS_RFC_9904;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.createTld;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.testing.DatabaseHelper.persistPremiumList;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static org.joda.money.CurrencyUnit.JPY;
@@ -25,6 +27,7 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
 import com.beust.jcommander.ParameterException;
 import com.google.common.collect.ImmutableSet;
 import google.registry.dns.writer.VoidDnsWriter;
+import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.model.pricing.StaticPremiumListPricingEngine;
 import google.registry.model.tld.Tld;
 import google.registry.model.tld.label.PremiumListDao;
@@ -49,9 +52,9 @@ class CreateDomainCommandTest extends EppToolCommandTestCase<CreateDomainCommand
         "--period=1",
         "--nameservers=ns1.zdns.google,ns2.zdns.google,ns3.zdns.google,ns4.zdns.google",
         "--password=2fooBAR",
-        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 5 2"
+        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 8 2"
             + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
-        "--ds_records=60485 5  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
+        "--ds_records=60485 8  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "example.tld");
     eppVerifier.verifySent("domain_create_complete.xml");
   }
@@ -63,9 +66,9 @@ class CreateDomainCommandTest extends EppToolCommandTestCase<CreateDomainCommand
         "--period=1",
         "--nameservers=NS1.zdns.google,ns2.ZDNS.google,ns3.zdns.gOOglE,ns4.zdns.google",
         "--password=2fooBAR",
-        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 5 2"
+        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 8 2"
             + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
-        "--ds_records=60485 5  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
+        "--ds_records=60485 8  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "example.tld");
     eppVerifier.verifySent("domain_create_complete.xml");
   }
@@ -77,9 +80,9 @@ class CreateDomainCommandTest extends EppToolCommandTestCase<CreateDomainCommand
         "--period=1",
         "--nameservers=ns[1-4].zdns.google",
         "--password=2fooBAR",
-        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 5 2"
+        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 8 2"
             + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
-        "--ds_records=60485 5  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
+        "--ds_records=60485 8  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "example.tld");
     eppVerifier.verifySent("domain_create_complete.xml");
   }
@@ -91,9 +94,9 @@ class CreateDomainCommandTest extends EppToolCommandTestCase<CreateDomainCommand
         "--period=1",
         "--nameservers=NS[1-4].zdns.google",
         "--password=2fooBAR",
-        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 5 2"
+        "--ds_records=1 2 2 9F86D081884C7D659A2FEAA0C55AD015A3BF4F1B2B0B822CD15D6C15B0F00A08,4 8 2"
             + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
-        "--ds_records=60485 5  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
+        "--ds_records=60485 8  2  D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
         "example.tld");
     eppVerifier.verifySent("domain_create_complete.xml");
   }
@@ -279,6 +282,21 @@ class CreateDomainCommandTest extends EppToolCommandTestCase<CreateDomainCommand
     assertThat(thrown).hasMessageThat().isEqualTo("DS record uses an unrecognized digest type: 3");
   }
 
+  @Test
+  void testFailure_forbiddenAlgorithm() {
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.ACTIVE);
+    IllegalArgumentException thrown =
+        assertThrows(
+            IllegalArgumentException.class,
+            () ->
+                runCommandForced(
+                    "--client=NewRegistrar",
+                    "--ds_records=1 1 2"
+                        + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
+                    "example.tld"));
+    assertThat(thrown).hasMessageThat().isEqualTo("DS record uses an unrecognized algorithm: 1");
+  }
+
   @Test
   void testFailure_invalidDigestLength() {
     IllegalArgumentException thrown =

core/src/test/java/google/registry/tools/DeleteFeatureFlagCommandTest.java

@@ -18,10 +18,8 @@ import static com.google.common.truth.Truth.assertThat;
 import static google.registry.model.common.FeatureFlag.FeatureName.TEST_FEATURE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.ACTIVE;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
-import static google.registry.testing.DatabaseHelper.persistResource;
-import static google.registry.util.DateTimeUtils.START_INSTANT;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 
-import com.google.common.collect.ImmutableSortedMap;
 import google.registry.model.common.FeatureFlag;
 import org.junit.jupiter.api.Test;
 
@@ -30,12 +28,7 @@ public class DeleteFeatureFlagCommandTest extends CommandTestCase<DeleteFeatureF
 
   @Test
   void testSimpleSuccess() throws Exception {
-    persistResource(
-        new FeatureFlag()
-            .asBuilder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(ImmutableSortedMap.of(START_INSTANT, ACTIVE))
-            .build());
+    persistFeatureFlag(TEST_FEATURE, ACTIVE);
     assertThat(tm().transact(() -> FeatureFlag.isActiveNow(TEST_FEATURE))).isTrue();
     runCommandForced("TEST_FEATURE");
     assertThat(FeatureFlag.getUncached(TEST_FEATURE)).isEmpty();

core/src/test/java/google/registry/tools/GetFeatureFlagCommandTest.java

@@ -19,7 +19,7 @@ import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATAS
 import static google.registry.model.common.FeatureFlag.FeatureName.TEST_FEATURE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.ACTIVE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
-import static google.registry.testing.DatabaseHelper.persistResource;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static google.registry.util.DateTimeUtils.plusWeeks;
 import static org.junit.jupiter.api.Assertions.assertThrows;
@@ -27,7 +27,6 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
 import com.beust.jcommander.ParameterException;
 import com.google.common.collect.ImmutableSortedMap;
 import google.registry.model.EntityYamlUtils;
-import google.registry.model.common.FeatureFlag;
 import google.registry.model.common.FeatureFlag.FeatureFlagNotFoundException;
 import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.testing.FakeClock;
@@ -47,15 +46,7 @@ public class GetFeatureFlagCommandTest extends CommandTestCase<GetFeatureFlagCom
 
   @Test
   void testSuccess() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .put(plusWeeks(clock.now(), 8), ACTIVE)
-                    .build())
-            .build());
+    persistFeatureFlag(TEST_FEATURE, INACTIVE, plusWeeks(clock.now(), 8), ACTIVE);
     runCommand("TEST_FEATURE");
     assertInStdout(
         """
@@ -68,24 +59,13 @@ public class GetFeatureFlagCommandTest extends CommandTestCase<GetFeatureFlagCom
 
   @Test
   void testSuccess_multipleArguments() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .put(plusWeeks(clock.now(), 8), ACTIVE)
-                    .build())
-            .build());
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(MINIMUM_DATASET_CONTACTS_OPTIONAL)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .put(plusWeeks(clock.now(), 3), ACTIVE)
-                    .put(plusWeeks(clock.now(), 6), INACTIVE)
-                    .build())
+    persistFeatureFlag(TEST_FEATURE, INACTIVE, plusWeeks(clock.now(), 8), ACTIVE);
+    persistFeatureFlag(
+        MINIMUM_DATASET_CONTACTS_OPTIONAL,
+        ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
+            .put(START_INSTANT, INACTIVE)
+            .put(plusWeeks(clock.now(), 3), ACTIVE)
+            .put(plusWeeks(clock.now(), 6), INACTIVE)
             .build());
     runCommand("TEST_FEATURE", "MINIMUM_DATASET_CONTACTS_OPTIONAL");
     assertInStdout(
@@ -114,15 +94,7 @@ public class GetFeatureFlagCommandTest extends CommandTestCase<GetFeatureFlagCom
 
   @Test
   void testFailure_oneFlagDoesNotExist() {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .put(plusWeeks(clock.now(), 8), ACTIVE)
-                    .build())
-            .build());
+    persistFeatureFlag(TEST_FEATURE, INACTIVE, plusWeeks(clock.now(), 8), ACTIVE);
     assertThrows(
         FeatureFlagNotFoundException.class,
         () -> runCommand("TEST_FEATURE", "MINIMUM_DATASET_CONTACTS_OPTIONAL"));

core/src/test/java/google/registry/tools/ListFeatureFlagsCommandTest.java

@@ -18,14 +18,13 @@ import static google.registry.model.common.FeatureFlag.FeatureName.MINIMUM_DATAS
 import static google.registry.model.common.FeatureFlag.FeatureName.TEST_FEATURE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.ACTIVE;
 import static google.registry.model.common.FeatureFlag.FeatureStatus.INACTIVE;
-import static google.registry.testing.DatabaseHelper.persistResource;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.testing.TestDataHelper.loadFile;
 import static google.registry.util.DateTimeUtils.START_INSTANT;
 import static google.registry.util.DateTimeUtils.plusWeeks;
 
 import com.google.common.collect.ImmutableSortedMap;
 import google.registry.model.EntityYamlUtils;
-import google.registry.model.common.FeatureFlag;
 import google.registry.model.common.FeatureFlag.FeatureStatus;
 import java.time.Instant;
 import org.junit.jupiter.api.BeforeEach;
@@ -41,49 +40,23 @@ public class ListFeatureFlagsCommandTest extends CommandTestCase<ListFeatureFlag
 
   @Test
   void testSuccess_oneFlag() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .put(plusWeeks(fakeClock.now(), 8), ACTIVE)
-                    .build())
-            .build());
+    persistFeatureFlag(TEST_FEATURE, INACTIVE, plusWeeks(fakeClock.now(), 8), ACTIVE);
     runCommand();
     assertInStdout(loadFile(getClass(), "oneFlag.yaml"));
   }
 
   @Test
   void test_success_manyFlags() throws Exception {
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(TEST_FEATURE)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .put(plusWeeks(fakeClock.now(), 8), ACTIVE)
-                    .build())
-            .build());
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(MINIMUM_DATASET_CONTACTS_OPTIONAL)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, INACTIVE)
-                    .put(plusWeeks(fakeClock.now(), 1), ACTIVE)
-                    .put(plusWeeks(fakeClock.now(), 8), INACTIVE)
-                    .put(plusWeeks(fakeClock.now(), 10), ACTIVE)
-                    .build())
-            .build());
-    persistResource(
-        new FeatureFlag.Builder()
-            .setFeatureName(MINIMUM_DATASET_CONTACTS_PROHIBITED)
-            .setStatusMap(
-                ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
-                    .put(START_INSTANT, ACTIVE)
-                    .build())
+    persistFeatureFlag(TEST_FEATURE, INACTIVE, plusWeeks(fakeClock.now(), 8), ACTIVE);
+    persistFeatureFlag(
+        MINIMUM_DATASET_CONTACTS_OPTIONAL,
+        ImmutableSortedMap.<Instant, FeatureStatus>naturalOrder()
+            .put(START_INSTANT, INACTIVE)
+            .put(plusWeeks(fakeClock.now(), 1), ACTIVE)
+            .put(plusWeeks(fakeClock.now(), 8), INACTIVE)
+            .put(plusWeeks(fakeClock.now(), 10), ACTIVE)
             .build());
+    persistFeatureFlag(MINIMUM_DATASET_CONTACTS_PROHIBITED, ACTIVE);
     runCommand();
     assertInStdout(loadFile(getClass(), "threeFlags.yaml"));
   }

core/src/test/java/google/registry/tools/UpdateDomainCommandTest.java

@@ -15,6 +15,7 @@
 package google.registry.tools;
 
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.model.common.FeatureFlag.FeatureName.FORBID_INSECURE_ALGORITHMS_RFC_9904;
 import static google.registry.model.domain.rgp.GracePeriodStatus.AUTO_RENEW;
 import static google.registry.model.eppcommon.StatusValue.PENDING_DELETE;
 import static google.registry.model.eppcommon.StatusValue.SERVER_UPDATE_PROHIBITED;
@@ -22,6 +23,7 @@ import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_CREATE;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistActiveDomain;
 import static google.registry.testing.DatabaseHelper.persistActiveHost;
+import static google.registry.testing.DatabaseHelper.persistFeatureFlag;
 import static google.registry.testing.DatabaseHelper.persistResource;
 import static google.registry.testing.TestLogHandlerUtils.assertLogMessage;
 import static google.registry.testing.TestLogHandlerUtils.assertNoLogMessage;
@@ -36,6 +38,7 @@ import com.google.common.collect.ImmutableSet;
 import google.registry.model.billing.BillingBase.Flag;
 import google.registry.model.billing.BillingBase.Reason;
 import google.registry.model.billing.BillingRecurrence;
+import google.registry.model.common.FeatureFlag.FeatureStatus;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.domain.GracePeriod;
@@ -535,6 +538,21 @@ class UpdateDomainCommandTest extends EppToolCommandTestCase<UpdateDomainCommand
     assertThat(thrown).hasMessageThat().isEqualTo("DS record uses an unrecognized digest type: 3");
   }
 
+  @Test
+  void testFailure_forbiddenDsRecordAlgorithm() {
+    persistFeatureFlag(FORBID_INSECURE_ALGORITHMS_RFC_9904, FeatureStatus.ACTIVE);
+    IllegalArgumentException thrown =
+        assertThrows(
+            IllegalArgumentException.class,
+            () ->
+                runCommandForced(
+                    "--client=NewRegistrar",
+                    "--add_ds_records=1 1 2"
+                        + " D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A",
+                    "example.tld"));
+    assertThat(thrown).hasMessageThat().isEqualTo("DS record uses an unrecognized algorithm: 1");
+  }
+
   @Test
   void testFailure_invalidDigestLength() {
     IllegalArgumentException thrown =

core/src/test/resources/google/registry/beam/rde/reducer_brda.xml

@@ -4,7 +4,6 @@
     <rde:rdeMenu>
         <rde:version>1.0</rde:version>
         <rde:objURI>urn:ietf:params:xml:ns:rdeDomain-1.0</rde:objURI>
-        <rde:objURI>urn:ietf:params:xml:ns:rdeEppParams-1.0</rde:objURI>
         <rde:objURI>urn:ietf:params:xml:ns:rdeHeader-1.0</rde:objURI>
         <rde:objURI>urn:ietf:params:xml:ns:rdeRegistrar-1.0</rde:objURI>
     </rde:rdeMenu>
@@ -12,45 +11,10 @@
 <rdeDomain:domain/>
 <rdeRegistrar:registrar/>
 
-<rdeEppParams:eppParams>
-    <rdeEppParams:version>1.0</rdeEppParams:version>
-    <rdeEppParams:lang>en</rdeEppParams:lang>
-    <rdeEppParams:objURI>urn:ietf:params:xml:ns:rdeDomain-1.0</rdeEppParams:objURI>
-    <rdeEppParams:objURI>urn:ietf:params:xml:ns:rdeHost-1.0</rdeEppParams:objURI>
-    <rdeEppParams:svcExtension>
-        <epp:extURI>urn:ietf:params:xml:ns:launch-1.0</epp:extURI>
-        <epp:extURI>urn:ietf:params:xml:ns:rgp-1.0</epp:extURI>
-        <epp:extURI>urn:ietf:params:xml:ns:secDNS-1.1</epp:extURI>
-        <epp:extURI>urn:ietf:params:xml:ns:fee-0.6</epp:extURI>
-        <epp:extURI>urn:ietf:params:xml:ns:fee-0.11</epp:extURI>
-        <epp:extURI>urn:ietf:params:xml:ns:fee-0.12</epp:extURI>
-        <epp:extURI>urn:ietf:params:xml:ns:epp:fee-1.0</epp:extURI>
-    </rdeEppParams:svcExtension>
-    <rdeEppParams:dcp>
-        <epp:access>
-            <epp:all/>
-        </epp:access>
-        <epp:statement>
-            <epp:purpose>
-                <epp:admin/>
-                <epp:prov/>
-            </epp:purpose>
-            <epp:recipient>
-                <epp:ours/>
-                <epp:public/>
-            </epp:recipient>
-            <epp:retention>
-                <epp:stated/>
-            </epp:retention>
-        </epp:statement>
-    </rdeEppParams:dcp>
-</rdeEppParams:eppParams>
-
 <rdeHeader:header>
     <rdeHeader:tld>soy</rdeHeader:tld>
     <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeDomain-1.0">1</rdeHeader:count>
     <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeRegistrar-1.0">1</rdeHeader:count>
-    <rdeHeader:count uri="urn:ietf:params:xml:ns:rdeEppParams-1.0">1</rdeHeader:count>
 </rdeHeader:header>
 
 </rde:contents>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata.xml

@@ -22,7 +22,7 @@
         <secDNS:maxSigLife>604800</secDNS:maxSigLife>
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata_8_records.xml

@@ -21,49 +21,49 @@
        xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>2</secDNS:digestType>
           <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12346</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>2</secDNS:digestType>
           <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12347</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>2</secDNS:digestType>
           <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12348</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>2</secDNS:digestType>
           <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12349</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>2</secDNS:digestType>
           <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12350</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>2</secDNS:digestType>
           <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12351</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>2</secDNS:digestType>
           <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12352</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>2</secDNS:digestType>
           <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata_9_records.xml

@@ -21,55 +21,55 @@
        xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12346</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12347</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12348</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12349</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12350</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12351</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12352</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12353</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata_bad_algorithms.xml

@@ -27,19 +27,19 @@
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12346</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12347</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12348</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
@@ -51,19 +51,19 @@
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12350</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12351</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12352</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata_bad_digest_types.xml

@@ -21,49 +21,49 @@
           xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>100</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12346</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>3</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12347</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12348</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12349</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12350</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12351</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>12352</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata_forbidden_algorithm.xml

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+  <command>
+    <create>
+      <domain:create
+          xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
+        <domain:name>example.tld</domain:name>
+        <domain:period unit="y">2</domain:period>
+        <domain:ns>
+          <domain:hostObj>ns1.example.net</domain:hostObj>
+          <domain:hostObj>ns2.example.net</domain:hostObj>
+        </domain:ns>
+        <domain:authInfo>
+          <domain:pw>2fooBAR</domain:pw>
+        </domain:authInfo>
+      </domain:create>
+    </create>
+    <extension>
+      <secDNS:create
+          xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
+        <secDNS:dsData>
+          <secDNS:keyTag>12345</secDNS:keyTag>
+          <secDNS:alg>1</secDNS:alg>
+          <secDNS:digestType>2</secDNS:digestType>
+          <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
+        </secDNS:dsData>
+      </secDNS:create>
+    </extension>
+    <clTRID>ABC-12345</clTRID>
+  </command>
+</epp>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata_no_maxsiglife.xml

@@ -21,7 +21,7 @@
        xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>2</secDNS:digestType>
           <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_create_dsdata_sha1.xml

@@ -21,7 +21,7 @@
           xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_create_wrong_extension.xml

@@ -20,7 +20,7 @@
         <secDNS:add>
           <secDNS:dsData>
             <secDNS:keyTag>12345</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
+            <secDNS:alg>8</secDNS:alg>
             <secDNS:digestType>1</secDNS:digestType>
             <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
           </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_info_response_dsdata.xml

@@ -34,9 +34,9 @@
        xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
-          <secDNS:digestType>1</secDNS:digestType>
-          <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
+          <secDNS:alg>8</secDNS:alg>
+          <secDNS:digestType>2</secDNS:digestType>
+          <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
       </secDNS:infData>
     </extension>

core/src/test/resources/google/registry/flows/domain/domain_info_response_dsdata_addperiod.xml

@@ -33,9 +33,9 @@
        xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
-          <secDNS:digestType>1</secDNS:digestType>
-          <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
+          <secDNS:alg>8</secDNS:alg>
+          <secDNS:digestType>2</secDNS:digestType>
+          <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
       </secDNS:infData>
       <rgp:infData xmlns:rgp="urn:ietf:params:xml:ns:rgp-1.0">

core/src/test/resources/google/registry/flows/domain/domain_update_dsdata_add_rem.xml

@@ -14,7 +14,7 @@
         <secDNS:rem>
           <secDNS:dsData>
             <secDNS:keyTag>12345</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
+            <secDNS:alg>8</secDNS:alg>
             <secDNS:digestType>2</secDNS:digestType>
             <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
           </secDNS:dsData>
@@ -22,7 +22,7 @@
         <secDNS:add>
           <secDNS:dsData>
             <secDNS:keyTag>12346</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
+            <secDNS:alg>8</secDNS:alg>
             <secDNS:digestType>2</secDNS:digestType>
             <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
           </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_update_dsdata_add_rem_same.xml

@@ -14,7 +14,7 @@
         <secDNS:rem>
           <secDNS:dsData>
             <secDNS:keyTag>12345</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
+            <secDNS:alg>8</secDNS:alg>
             <secDNS:digestType>1</secDNS:digestType>
             <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
           </secDNS:dsData>
@@ -22,7 +22,7 @@
         <secDNS:add>
           <secDNS:dsData>
             <secDNS:keyTag>12345</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
+            <secDNS:alg>8</secDNS:alg>
             <secDNS:digestType>1</secDNS:digestType>
             <secDNS:digest>A94A8FE5CCB19BA61C4C0873D391E987982FBBD3</secDNS:digest>
           </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_update_dsdata_rem.xml

@@ -14,7 +14,7 @@
         <secDNS:rem>
           <secDNS:dsData>
             <secDNS:keyTag>12346</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
+            <secDNS:alg>8</secDNS:alg>
             <secDNS:digestType>2</secDNS:digestType>
             <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
           </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_update_dsdata_urgent.xml

@@ -17,7 +17,7 @@
         <secDNS:add>
           <secDNS:dsData>
             <secDNS:keyTag>12346</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
+            <secDNS:alg>8</secDNS:alg>
             <secDNS:digestType>1</secDNS:digestType>
             <secDNS:digest>38EC35D5B3A34B44C39B</secDNS:digest>
           </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_update_restore_request_with_secdns.xml

@@ -16,7 +16,7 @@
         <secDNS:add>
           <secDNS:dsData>
             <secDNS:keyTag>12346</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
+            <secDNS:alg>8</secDNS:alg>
             <secDNS:digestType>1</secDNS:digestType>
             <secDNS:digest>38EC35D5B3A34B44C39B</secDNS:digest>
           </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain/domain_update_wrong_extension.xml

@@ -13,7 +13,7 @@
        xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain_update_dsdata_add.xml

@@ -14,7 +14,7 @@
         <secDNS:add>
           <secDNS:dsData>
             <secDNS:keyTag>12346</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
+            <secDNS:alg>8</secDNS:alg>
             <secDNS:digestType>2</secDNS:digestType>
             <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
           </secDNS:dsData>

core/src/test/resources/google/registry/flows/domain_update_dsdata_rem.xml

@@ -14,7 +14,7 @@
         <secDNS:rem>
           <secDNS:dsData>
             <secDNS:keyTag>12346</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
+            <secDNS:alg>8</secDNS:alg>
             <secDNS:digestType>2</secDNS:digestType>
             <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
           </secDNS:dsData>

core/src/test/resources/google/registry/model/domain_create_dsdata.xml

@@ -23,7 +23,7 @@
         <secDNS:maxSigLife>604800</secDNS:maxSigLife>
         <secDNS:dsData>
           <secDNS:keyTag>12345</secDNS:keyTag>
-          <secDNS:alg>3</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>1</secDNS:digestType>
           <secDNS:digest>49FD46E6C4B45C55D4AC</secDNS:digest>
         </secDNS:dsData>

core/src/test/resources/google/registry/model/domain_update_with_secdns.xml

@@ -16,7 +16,7 @@
         <secDNS:add>
           <secDNS:dsData>
             <secDNS:keyTag>12346</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
+            <secDNS:alg>8</secDNS:alg>
             <secDNS:digestType>1</secDNS:digestType>
             <secDNS:digest>38EC35D5B3A34B44C39B</secDNS:digest>
           </secDNS:dsData>

core/src/test/resources/google/registry/tools/server/domain_create_complete.xml

@@ -27,13 +27,13 @@
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>4</secDNS:keyTag>
-          <secDNS:alg>5</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>2</secDNS:digestType>
           <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>
         <secDNS:dsData>
           <secDNS:keyTag>60485</secDNS:keyTag>
-          <secDNS:alg>5</secDNS:alg>
+          <secDNS:alg>8</secDNS:alg>
           <secDNS:digestType>2</secDNS:digestType>
           <secDNS:digest>D4B7D520E7BB5F0F67674A0CCEB1E3E0614B93C4F9E99B8383F6A1E4469DA50A</secDNS:digest>
         </secDNS:dsData>

release/cloudbuild-clouddeploy.yaml

@@ -38,7 +38,7 @@ steps:
   - -c
   - |
     set -e
-    for env in crash; do
+    for env in crash sandbox; do
       config_file="release/clouddeploy/${env}-config.yaml"
       if [ -f "$config_file" ]; then
         echo "Extracting checks from $config_file..."
@@ -52,8 +52,8 @@ steps:
         ' "$config_file" > checks.tmp
         
         # Insert the checks where the placeholder is located and remove the placeholder
-        sed -i '/stableDeploymentAlertPolicyChecks/r checks.tmp' release/clouddeploy/delivery-pipeline.yaml
-        sed -i '/stableDeploymentAlertPolicyChecks/d' release/clouddeploy/delivery-pipeline.yaml
+        sed -i "/${env}StableDeploymentAlertPolicyChecks/r checks.tmp" release/clouddeploy/delivery-pipeline.yaml
+        sed -i "/${env}StableDeploymentAlertPolicyChecks/d" release/clouddeploy/delivery-pipeline.yaml
         rm -f checks.tmp
 
         # Extract only the indented block under partialDeploymentAlertPolicyChecks.
@@ -68,8 +68,8 @@ steps:
           ' "$config_file" > partial_checks.tmp
           
           # Insert the checks where the placeholder is located and remove the placeholder
-          sed -i '/partialDeploymentAlertPolicyChecks/r partial_checks.tmp' release/clouddeploy/delivery-pipeline.yaml
-          sed -i '/partialDeploymentAlertPolicyChecks/d' release/clouddeploy/delivery-pipeline.yaml
+          sed -i "/${env}PartialDeploymentAlertPolicyChecks/r partial_checks.tmp" release/clouddeploy/delivery-pipeline.yaml
+          sed -i "/${env}PartialDeploymentAlertPolicyChecks/d" release/clouddeploy/delivery-pipeline.yaml
           rm -f partial_checks.tmp
         fi
         
@@ -95,7 +95,7 @@ steps:
   - -c
   - |
     set -e
-    for env in crash; do
+    for env in crash sandbox; do
       target_file="release/clouddeploy/${env}-target.yaml"
       if [ -f "$target_file" ]; then
         echo "Applying target $target_file..."

release/clouddeploy/delivery-pipeline.yaml

@@ -19,7 +19,7 @@ serialPipeline:
               duration: 600s
               googleCloud:
                 alertPolicyChecks:
-                    partialDeploymentAlertPolicyChecks
+                    crashPartialDeploymentAlertPolicyChecks
           - phaseId: "canary-5"
             profiles: ["crash-partial-phase-5"]
             percentage: 50
@@ -28,7 +28,7 @@ serialPipeline:
               duration: 600s
               googleCloud:
                 alertPolicyChecks:
-                    partialDeploymentAlertPolicyChecks
+                    crashPartialDeploymentAlertPolicyChecks
           - phaseId: "stable"
             profiles: ["crash"]
             percentage: 100
@@ -51,4 +51,50 @@ serialPipeline:
               duration: 600s
               googleCloud:
                 alertPolicyChecks:
-                    stableDeploymentAlertPolicyChecks
+                    crashStableDeploymentAlertPolicyChecks
+  - targetId: sandbox
+    strategy:
+      canary:
+        customCanaryDeployment:
+          phaseConfigs:
+          - phaseId: "canary-1"
+            profiles: ["sandbox-partial-phase-1"]
+            percentage: 10
+            analysis:
+              # 10 minutes.
+              duration: 600s
+              googleCloud:
+                alertPolicyChecks:
+                    sandboxPartialDeploymentAlertPolicyChecks
+          - phaseId: "canary-5"
+            profiles: ["sandbox-partial-phase-5"]
+            percentage: 50
+            analysis:
+              # 10 minutes.
+              duration: 600s
+              googleCloud:
+                alertPolicyChecks:
+                    sandboxPartialDeploymentAlertPolicyChecks
+          - phaseId: "stable"
+            profiles: ["sandbox"]
+            percentage: 100
+            postdeploy:
+              tasks:
+              - type: container
+                image: gcr.io/google.com/cloudsdktool/google-cloud-cli:stable
+                env:
+                  DEPLOYED_IMAGE: ${{ deploy_params['deployed_image'] }}
+                  BASE_IMAGE: ${{ deploy_params['base_image'] }}
+                  TARGET_ID: ${{ target.id }}
+                command: ["/bin/bash"]
+                args:
+                - "-c"
+                - |
+                  gcloud artifacts docker tags add $DEPLOYED_IMAGE \
+                    ${BASE_IMAGE}:live-cd-${TARGET_ID}
+            analysis:
+              # 10 minutes.
+              duration: 600s
+              googleCloud:
+                alertPolicyChecks:
+                    sandboxStableDeploymentAlertPolicyChecks

release/clouddeploy/sandbox-target.yaml

@@ -0,0 +1,20 @@
+apiVersion: deploy.cloud.google.com/v1
+kind: Target
+metadata:
+  name: sandbox
+requireApproval: true
+executionConfigs:
+- usages:
+  - RENDER
+  - DEPLOY
+  - ANALYSIS
+  - POSTDEPLOY
+  executionTimeout: 3600s
+  defaultPool:
+    # Placeholder: Replace with artifact bucket name.
+    artifactStorage: artifactStorage
+    # Placeholder: Replace with project number.
+    serviceAccount: serviceAccount
+gke:
+  # Placeholder: Replace with project ID, location, and cluster name.
+  cluster: cluster

release/clouddeploy/skaffold.yaml

@@ -7,27 +7,54 @@ profiles:
 - name: crash
   manifests:
     rawYaml:
-    - ../jetty/kubernetes/nomulus-crash-backend.yaml
-    - ../jetty/kubernetes/nomulus-crash-console.yaml
-    - ../jetty/kubernetes/nomulus-crash-frontend.yaml
-    - ../jetty/kubernetes/nomulus-crash-pubapi.yaml
+    - ../../jetty/kubernetes/nomulus-crash-backend.yaml
+    - ../../jetty/kubernetes/nomulus-crash-console.yaml
+    - ../../jetty/kubernetes/nomulus-crash-frontend.yaml
+    - ../../jetty/kubernetes/nomulus-crash-pubapi.yaml
   deploy:
     kubectl: { }
 - name: crash-partial-phase-1
   manifests:
     rawYaml:
-    - ../jetty/kubernetes/nomulus-crash-backend-partial-phase-1.yaml
-    - ../jetty/kubernetes/nomulus-crash-console-partial-phase-1.yaml
-    - ../jetty/kubernetes/nomulus-crash-frontend-partial-phase-1.yaml
-    - ../jetty/kubernetes/nomulus-crash-pubapi-partial-phase-1.yaml
+    - ../../jetty/kubernetes/nomulus-crash-backend-partial-phase-1.yaml
+    - ../../jetty/kubernetes/nomulus-crash-console-partial-phase-1.yaml
+    - ../../jetty/kubernetes/nomulus-crash-frontend-partial-phase-1.yaml
+    - ../../jetty/kubernetes/nomulus-crash-pubapi-partial-phase-1.yaml
   deploy:
     kubectl: { }
 - name: crash-partial-phase-5
   manifests:
     rawYaml:
-    - ../jetty/kubernetes/nomulus-crash-backend-partial-phase-5.yaml
-    - ../jetty/kubernetes/nomulus-crash-console-partial-phase-5.yaml
-    - ../jetty/kubernetes/nomulus-crash-frontend-partial-phase-5.yaml
-    - ../jetty/kubernetes/nomulus-crash-pubapi-partial-phase-5.yaml
+    - ../../jetty/kubernetes/nomulus-crash-backend-partial-phase-5.yaml
+    - ../../jetty/kubernetes/nomulus-crash-console-partial-phase-5.yaml
+    - ../../jetty/kubernetes/nomulus-crash-frontend-partial-phase-5.yaml
+    - ../../jetty/kubernetes/nomulus-crash-pubapi-partial-phase-5.yaml
+  deploy:
+    kubectl: { }
+- name: sandbox
+  manifests:
+    rawYaml:
+    - ../../jetty/kubernetes/nomulus-sandbox-backend.yaml
+    - ../../jetty/kubernetes/nomulus-sandbox-console.yaml
+    - ../../jetty/kubernetes/nomulus-sandbox-frontend.yaml
+    - ../../jetty/kubernetes/nomulus-sandbox-pubapi.yaml
+  deploy:
+    kubectl: { }
+- name: sandbox-partial-phase-1
+  manifests:
+    rawYaml:
+    - ../../jetty/kubernetes/nomulus-sandbox-backend-partial-phase-1.yaml
+    - ../../jetty/kubernetes/nomulus-sandbox-console-partial-phase-1.yaml
+    - ../../jetty/kubernetes/nomulus-sandbox-frontend-partial-phase-1.yaml
+    - ../../jetty/kubernetes/nomulus-sandbox-pubapi-partial-phase-1.yaml
+  deploy:
+    kubectl: { }
+- name: sandbox-partial-phase-5
+  manifests:
+    rawYaml:
+    - ../../jetty/kubernetes/nomulus-sandbox-backend-partial-phase-5.yaml
+    - ../../jetty/kubernetes/nomulus-sandbox-console-partial-phase-5.yaml
+    - ../../jetty/kubernetes/nomulus-sandbox-frontend-partial-phase-5.yaml
+    - ../../jetty/kubernetes/nomulus-sandbox-pubapi-partial-phase-5.yaml
   deploy:
     kubectl: { }

util/src/main/java/google/registry/util/PasswordUtils.java

@@ -22,8 +22,8 @@ import static java.nio.charset.StandardCharsets.US_ASCII;
 import com.google.common.base.Supplier;
 import com.google.common.flogger.FluentLogger;
 import com.google.common.primitives.Bytes;
+import java.security.MessageDigest;
 import java.security.SecureRandom;
-import java.util.Arrays;
 import java.util.Optional;
 import org.bouncycastle.crypto.generators.Argon2BytesGenerator;
 import org.bouncycastle.crypto.generators.SCrypt;
@@ -143,11 +143,11 @@ public final class PasswordUtils {
     byte[] decodedSalt = base64().decode(salt);
     byte[] decodedPassword = password.getBytes(US_ASCII);
 
-    if (Arrays.equals(decodedHash, ARGON_2_ID.hash(decodedPassword, decodedSalt))) {
+    if (MessageDigest.isEqual(decodedHash, ARGON_2_ID.hash(decodedPassword, decodedSalt))) {
       logger.atInfo().log("ARGON_2_ID hash verified.");
       return Optional.of(ARGON_2_ID);
     }
-    if (Arrays.equals(decodedHash, SCRYPT_P_1.hash(decodedPassword, decodedSalt))) {
+    if (MessageDigest.isEqual(decodedHash, SCRYPT_P_1.hash(decodedPassword, decodedSalt))) {
       logger.atInfo().log("SCRYPT_P_1 hash verified.");
       return Optional.of(SCRYPT_P_1);
     }