[glib/mcatanzaro/validation-flags: 2/3] gtlsclientconnection: deprecate validation-flags property

[Michael Catanzaro <mcatanzaro src gnome org>]

commit bc5e04523ebac988cde22f8f42cf096541fa8e15
Author: Michael Catanzaro <mcatanzaro redhat com>
Date:   Wed Aug 4 15:20:03 2021 -0500

    gtlsclientconnection: deprecate validation-flags property
    
    It doesn't work as expected, and you shouldn't be trying to use it
    anyway.

 gio/gtlsclientconnection.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)
---
diff --git a/gio/gtlsclientconnection.c b/gio/gtlsclientconnection.c
index d0a740f4f..de2fe7679 100644
--- a/gio/gtlsclientconnection.c
+++ b/gio/gtlsclientconnection.c
@@ -59,7 +59,20 @@ g_tls_client_connection_default_init (GTlsClientConnectionInterface *iface)
    * ways indicated here will be rejected unless the application
    * overrides the default via #GTlsConnection::accept-certificate.
    *
+   * GLib guarantees that if certificate verification fails, at least one
+   * flag will be set, but it does not guarantee that all possible flags
+   * will be set. Accordingly, you may not safely decide to ignore any
+   * particular type of error. For example, it would be incorrect to mask
+   * %G_TLS_CERTIFICATE_EXPIRED if you want to allow expired certificates,
+   * because this could potentially be the only error flag set even if
+   * other problems exist with the certificate. Therefore, there is no
+   * safe way to use this property. This is not a horrible problem,
+   * though, because you should not be attempting to ignore validation
+   * errors anyway.
+   *
    * Since: 2.28
+   *
+   * Deprecated: 2.70. Do not attempt to ignore validation errors.
    */
   g_object_interface_install_property (iface,
                                       g_param_spec_flags ("validation-flags",
@@ -69,7 +82,8 @@ g_tls_client_connection_default_init (GTlsClientConnectionInterface *iface)
                                                           G_TLS_CERTIFICATE_VALIDATE_ALL,
                                                           G_PARAM_READWRITE |
                                                           G_PARAM_CONSTRUCT |
-                                                          G_PARAM_STATIC_STRINGS));
+                                                          G_PARAM_STATIC_STRINGS |
+                                                          G_PARAM_DEPRECATED));
 
   /**
    * GTlsClientConnection:server-identity:
@@ -207,7 +221,11 @@ g_tls_client_connection_get_validation_flags (GTlsClientConnection *conn)
  * checks performed when validating a server certificate. By default,
  * %G_TLS_CERTIFICATE_VALIDATE_ALL is used.
  *
+ * See #GTlsClientConnection:validation-flags for more information.
+ *
  * Since: 2.28
+ *
+ * Deprecated: 2.70. Do not attempt to ignore validation errors.
  */
 void
 g_tls_client_connection_set_validation_flags (GTlsClientConnection  *conn,