From 502cfe3612b8ff471f499983cfa51b66b5de2332 Mon Sep 17 00:00:00 2001 From: Clemens Lang Date: Aug 20 2024 16:00:48 +0000 Subject: Fix broken link to Fedora Security Team The crypto team was probably always a better point of contact to review new crypto libs, considering they also maintain the crypto-policies packages and all the other crypto libraries. --- diff --git a/guidelines/modules/ROOT/pages/CryptoPolicies.adoc b/guidelines/modules/ROOT/pages/CryptoPolicies.adoc index cf3a089..68e26cc 100644 --- a/guidelines/modules/ROOT/pages/CryptoPolicies.adoc +++ b/guidelines/modules/ROOT/pages/CryptoPolicies.adoc @@ -2,7 +2,7 @@ == Enforcing system crypto policies -In Fedora there are policies for the usage of cryptographic protocols such as TLS that are enforced system-wide. Each application being added in Fedora must be checked to comply with the policies. Currently the policies are restricted to major libraries such as GnuTLS, OpenSSL, NSS, libkrb5, languages such as Java and major applications like OpenSSH and bind. The rpmlint tool will warn when it detects that some action has to be taken; that detection is based on heuristics and limited to C programs, so manual inspection is recommended. Note however, that there are applications which intentionally set weaker, or custom settings on a purpose (e.g., postfix); those need not adhere to the policy. When in doubt, discuss with the https://lists.fedoraproject.org/mailman/listinfo/security[Fedora security team]. +In Fedora there are policies for the usage of cryptographic protocols such as TLS that are enforced system-wide. Each application being added in Fedora must be checked to comply with the policies. Currently the policies are restricted to major libraries such as GnuTLS, OpenSSL, NSS, libkrb5, languages such as Java and major applications like OpenSSH and bind. The rpmlint tool will warn when it detects that some action has to be taken; that detection is based on heuristics and limited to C programs, so manual inspection is recommended. Note however, that there are applications which intentionally set weaker, or custom settings on a purpose (e.g., postfix); those need not adhere to the policy. When in doubt, discuss with the https://lists.fedoraproject.org/admin/lists/crypto-team.lists.fedoraproject.org/[Fedora crypto team]. === New crypto libraries