TODO.txt

================================================================================
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
================================================================================


            Apache Tomcat Native Library

                        TODO


SSL Renegotiation
-----------------

It is unclear to me, what the current state is. It looks like we support
the unsafe legacy reneg whenever the OpenSSL used during build time
supports it. There is no configuration option to switch it off during
runtime. Right?

Is it correct, that client initiated reneg is not supported and thus the
known attacks will not work even with old OpenSSL?

Should we add a remark about this topic to the docs?


Java Tests and Examples
-----------------------

- "ant run-echo": what is the expected behaviour of this example.
  I couldn't get it to do something understandable.
  Document the example in the README.txt.

- "ant run-ssl-server": Could't we include a test certificate in the
  distribution?

- "ant run-ssl-server": What should the test produce, if run successfully?
  Document the example in the README.txt.

- "ant run-local-server": Creates a unix socket "\\.\PIPE\test" in the
  examples directory, then waits. How is the test expected to work?
  And the file name doesn't seem to be appropriate for Unix.
  Document the example in the README.txt.


Java Classes Source Distribution
--------------------------------

Check on how to handle the test and examples classes.
I think they have no other home.

Furthermore some of the Java files do not exist inside TC:
- Apr.java, apr.properties, jni/Buffer.java and jni/Thread.java
I don't know their purpose and whether we can delete them.


Releasing
---------

- Document how to release.

- Add info about updating config.guess and config.sub from 

http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD

- ZIP download seems to have group write permissions set
  (at least after I extract it on Solaris).
  It's a bit strange that permissions differ between the
  tar and zip archives.

- OCSP enabled Windows binary
  - Document build
  - Use consistent naming
    (1.1.22 used ...win32-ocsp..., 1.1.24 used ...ocsp-win32...)