- Update the update-crypto-policies(8) man pages and README.SUSE to mention the supported back-end policies. [bsc#1209998] * Add crypto-policies-supported.patch - Update to version 20230420.3d08ae7: * openssl, alg_lists: add brainpool support * openssl: set Groups explicitly * codespell: ignore aNULL * rpm-sequoia: allow 1024 bit DSA and SHA-1 per FeSCO decision 2960 * sequoia: add separate rpm-sequoia backend * crypto-policies.7: state upfront that FUTURE is not so interoperable * Makefile: update for asciidoc 10 * Skip the LibreswanGenerator and SequoiaGenerator: - Add crypto-policies-policygenerators.patch * Remove crypto-policies-test_supported_modules_only.patch * Rebase crypto-policies-no-build-manpages.patch - Update to version 20221214.a4c31a3: * bind: expand the list of disableable algorithms * libssh: Add support for openssh fido keys * .gitlab-ci.yml: install krb5-devel for krb5-config * sequoia: check using sequoia-policy-config-check * sequoia: introduce new back-end * Makefile: support overriding asciidoc executable name * openssh: make none and auto explicit and different * openssh: autodetect and allow forcing RequiredRSASize presence/name * openssh: remove _pre_8_5_ssh * pylintrc: update * Revert "disable SHA-1 further for a Fedora 38 Rawhide "jump scare"..." * disable SHA-1 further for a Fedora 38 Rawhide "jump scare"... OBS-URL: https://build.opensuse.org/request/show/1086482 OBS-URL: https://build.opensuse.org/package/show/security:tls/crypto-policies?expand=0&rev=15
38 lines
1.4 KiB
Diff
38 lines
1.4 KiB
Diff
Index: fedora-crypto-policies-20230420.3d08ae7/update-crypto-policies.8.txt
|
|
===================================================================
|
|
--- fedora-crypto-policies-20230420.3d08ae7.orig/update-crypto-policies.8.txt
|
|
+++ fedora-crypto-policies-20230420.3d08ae7/update-crypto-policies.8.txt
|
|
@@ -54,23 +54,23 @@ are configured to follow the default pol
|
|
The generated back-end policies will be placed in /etc/crypto-policies/back-ends.
|
|
Currently the supported back-ends (and directive scopes they respect) are:
|
|
|
|
-* GnuTLS library (GnuTLS, SSL, TLS)
|
|
+* GnuTLS library (GnuTLS, SSL, TLS) (Supported)
|
|
|
|
-* OpenSSL library (OpenSSL, SSL, TLS)
|
|
+* OpenSSL library (OpenSSL, SSL, TLS) (Supported)
|
|
|
|
-* NSS library (NSS, SSL, TLS)
|
|
+* NSS library (NSS, SSL, TLS) (Not supported)
|
|
|
|
-* OpenJDK (java-tls, SSL, TLS)
|
|
+* OpenJDK (java-tls, SSL, TLS) (Supported only for java-1_8_0-openjdk and java-11-openjdk)
|
|
|
|
-* Libkrb5 (krb5, kerberos)
|
|
+* Libkrb5 (krb5, kerberos) (Not supported)
|
|
|
|
-* BIND (BIND, DNSSec)
|
|
+* BIND (BIND, DNSSec) (Not supported)
|
|
|
|
-* OpenSSH (OpenSSH, SSH)
|
|
+* OpenSSH (OpenSSH, SSH) (Not supported)
|
|
|
|
-* Libreswan (libreswan, IKE, IPSec)
|
|
+* Libreswan (libreswan, IKE, IPSec) (Not supported)
|
|
|
|
-* libssh (libssh, SSH)
|
|
+* libssh (libssh, SSH) (Not supported)
|
|
|
|
Applications and languages which rely on any of these back-ends will follow
|
|
the system policies as well. Examples are apache httpd, nginx, php, and
|