Joe Groocock

`ssl_profile` option uses less secure cryptography than Mozilla documents

10

### The problem I have `ssl_profile` set to `modern` and according to Mozilla's site https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility linked from the docs https://www.home-assistant.io/integrations/http/#ssl_profile it should only support TLS1.3 with authenticated/forward-secret ciphers: ``` 0x13,0x01...

[BUG] v3005rc2: Highstate slows to a crawl/never terminates with state_aggregate enabled

2

**Description** Highstate on v3005rc2 is marginally slower than v3004, but still within the acceptable range (I measured about ~5% slower). Adding `state_aggregate: true` to minion conf causes the highstate to...

Support for XDG Base Directory spec. (aka stop filling my ~ up)

2

https://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html We should be trying for `$XDG_CONFIG_HOME/cloudflared` first instead of `~/.cloudflared` etc. This is a pretty well accepted standard by now. Please consider revising how the directories are structured

`step ca renew` fails when existing certificate doesn't have `clientAuth` extended attribute

2

### Subject of the issue Issuing an immediately attempting to renew the certificate causes the following error ``` frebib@:~$ STEPPATH=/tmp/step step ca certificate $HOSTNAME /tmp/step/$HOSTNAME.crt /tmp/step/$HOSTNAME.key --token $TOKEN ✔ CA:...

- lang: correctly handle stat(2) errors on directories/files Differentiate between ENOENT and other errors returned by stat(2) to prevent confusing parse errors when the path provided is a directory path....

blah blah TBD WIP ETC Signed-off-by: Joe Groocock

Constant propagation can somewhat/significantly reduce the complexity of the function graph by "merging" vertexes of constant and/or pure functions together. Some things that could be simplified are: - Numbers (ints/floats)...

Feature: Sensitive/secret (mcl) values should be flagged and never logged/exposed

3

mgmt should be able to handle secret values. Things like passwords, API keys and other sensitive data. mcl should probably have some notion of "sensitive"- possibly only strings need this?...

Use fmt.Errorf and replace errwrap.Wrapf

5

Go 1.13 adds `%w` to fmt.Errorf which is a first-party replacement for the mgmt errwrap package. https://blog.golang.org/go1.13-errors The argument ordering differs slightly, but porting it should be entirely doable.

Add nftables (+iptables) resource to set rules

4

nftables would be a more suitable candidate for mgmt because: - `nft monitor` provides an event to watch for changes in rules (https://wiki.nftables.org/wiki-nftables/index.php/Monitoring_ruleset_updates) - nft rule swaps are atomic (https://wiki.nftables.org/wiki-nftables/index.php/Atomic_rule_replacement)...