gnutls-lib-x509-verify.c

    if (is_level_acceptable(cert, issuer, sigalg, flags) == 0) {
        gnutls_assert(); /* this didn't exist before */
        out =
            GNUTLS_CERT_INSECURE_ALGORITHM |
            GNUTLS_CERT_INVALID;
        if (output)
            *output |= out;
        result = 0;
        goto cleanup; /* or this */
    }

    /* If the certificate is not self signed check if the algorithms
     * used are secure. If the certificate is self signed it doesn't
     * really matter.
     */
    if (gnutls_sign_is_secure(sigalg) == 0 &&
        is_broken_allowed(sigalg, flags) == 0 &&
        is_issuer(cert, cert) == 0) {
        gnutls_assert(); /* or this */
        out =
            GNUTLS_CERT_INSECURE_ALGORITHM |
            GNUTLS_CERT_INVALID;
        if (output)
            *output |= out;
        result = 0;
        goto cleanup; /* or this */
    }

    hash_algo = gnutls_sign_get_hash_algorithm(sigalg);

    /* or the next 6 lines */
    me = mac_to_entry(hash_algo);
    if (me == NULL) {
        gnutls_assert();
        result = 0;
        goto cleanup;
    }