x509roots: remove list hash and generation date, change ordering

This makes the automated update workflow simpler.

Also switch the ordering from human readable subject (which is not
necessarily unique), to the raw SPKI (which should always be unique).
This makes it somewhat harder to read to a human (since it'll appear a
little jumbled) but results in a stable sort.

Note this results in adding two new roots, which were added since we
last generated the bundle.

Change-Id: Id4d34bf9e98164e7b2fc4f06f9b46b63c0013d23
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/504597
Run-TryBot: Roland Shoemaker <roland@golang.org>
Reviewed-by: Heschi Kreinick <heschi@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>

x509roots/gen_fallback_bundle.go

@@ -21,13 +21,11 @@ import (
 	"net/http"
 	"os"
 	"sort"
-	"time"
 
 	"golang.org/x/crypto/x509roots/nss"
 )
 
-const tmpl = `// Code generated by gen.go at %s; DO NOT EDIT.
-// list hash: %x
+const tmpl = `// Code generated by gen_fallback_bundle.go; DO NOT EDIT.
 
 package fallback
 
@@ -96,17 +94,11 @@ func main() {
 	}
 
 	sort.Slice(certs, func(i, j int) bool {
-		return certs[i].X509.Subject.String() < certs[j].X509.Subject.String()
+		return string(certs[i].X509.RawSubjectPublicKeyInfo) < string(certs[j].X509.RawSubjectPublicKeyInfo)
 	})
 
-	h := sha256.New()
-	for _, c := range certs {
-		h.Write(c.X509.Raw)
-	}
-	listHash := h.Sum(nil)
-
 	b := bytes.NewBuffer(nil)
-	b.Write([]byte(fmt.Sprintf(tmpl, time.Now().Format(time.RFC1123), listHash)))
+	b.Write([]byte(tmpl))
 	b.Write([]byte("const pemRoots = `\n"))
 	for _, c := range certs {
 		if len(c.Constraints) > 0 {