x509roots/fallback/bundle: make subjectsEqual stricter on Go 1.27+

This gradual step towards removing/inlining subjectsEqual can happen
after Go 1.27.0 is released and the bundle starts being generated
with it.

Change-Id: Ib315bae69c45922c3f0aac5d2c0155fb5d94229f
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/775782
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>

x509roots/fallback/bundle/bundle_test.go

@@ -7,9 +7,7 @@ package bundle
 import (
 	"crypto/sha256"
 	"crypto/x509"
-	"encoding/asn1"
 	"encoding/hex"
-	"regexp"
 	"testing"
 )
 
@@ -32,34 +30,3 @@ func TestBundle(t *testing.T) {
 		}
 	}
 }
-
-// subjectsEqual reports whether two RFC 2253 DN strings match.
-//
-// It tolerates the rendering difference introduced in Go 1.27, where
-// string-typed attribute values for OIDs outside attributeTypeNames are
-// rendered as strings rather than hex-encoded DER (see Go CL 773800).
-//
-// This can be removed when Go 1.25/1.26 are no longer supported.
-func subjectsEqual(a, b string) bool {
-	return a == b || normalizeHexValues(a) == normalizeHexValues(b)
-}
-
-// normalizeHexValues rewrites any "oid=#hex" to the equivalent "oid=value"
-// rendering produced by Go 1.27+.
-func normalizeHexValues(s string) string {
-	return hexAttrRE.ReplaceAllStringFunc(s, func(match string) string {
-		m := hexAttrRE.FindStringSubmatch(match)
-		der, err := hex.DecodeString(m[2])
-		if err != nil {
-			return match
-		}
-		var v string
-		if rest, err := asn1.Unmarshal(der, &v); err != nil || len(rest) != 0 {
-			return match
-		}
-		return m[1] + "=" + v
-	})
-}
-
-// hexAttrRE matches a "oid=#hex" attribute value in an RFC 2253 DN string.
-var hexAttrRE = regexp.MustCompile(`([\d.]+)=#([[:xdigit:]]+)`)