<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<div></div>
<p dir="auto">The approach of gnutls is to deprecate deprecate algorithms like SHA1 in the library, and change TLS settings on various versions which improve the security. However there are cases which these items are handled on the operating system level (e.g., fedora crypto-policies), and as such it would be beneficial to allow such settings to switch system-wide.</p>
<p dir="auto">Currently we only provide a way to create application-specific or system-specific priority strings and modify the default priority string set with <code>gnutls_set_default_priority</code>; this only affects a subset of applications that use gnutls (i.e., not the ones that specifically set a priority string).</p>
<p dir="auto">We should enhance the currently provided configuration file (system priority file), to be able to configure:</p>
<ul dir="auto">
<li>Set/Unset deprecated hashes for signature algorithms</li>
<li>Set global TLS options which no application could override; this should include</li>
</ul>
<ul dir="auto">
<li>disallowed TLS versions</li>
<li>disallowed signature algorithms</li>
<li>disallowed ciphers</li>
<li>disallowed macs</li>
</ul>
<p dir="auto">c.f., <a href="https://github.com/benhoyt/inih" rel="nofollow noreferrer noopener" target="_blank">inih</a></p>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #777777;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/issues/587">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/sent_notifications/4864e1f19676ea1a27ec68a44bf79f10/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/issues/587"}}</script>
</p>
</div>
</body>
</html>