The dist target should be fixed, though I don't know if this is the best fix. It excludes what it should for now anyway.

The full networked test is slow obviously, but since it's no longer the default I can live with it for now.

I've applied all these patches from salsa/build and I updated my cxxtest install and finally got a modern version working on the Mac so I can hopefully track that better.

I did go ahead and flip the networked test option so it's now SAMLTEST_NETWORKED and skips by default.

All those tests are now pointing to the backed up copy of the downloaded IC metadata.

I'll review what the dist target ends up with before closing out.

The patch series skips the test conditionally via skipNetworked(). Maybe the logic should be reversed so that it defaults to skip unless the appropriate environment variable is set? I'm fine with either; currently the Debian packages are built with SAMLTEST_SKIP_NETWORKED=1, because the build servers don't provide network access, but the built packages could be automatically tested in another environment, which does. It isn't configured for OpenSAML yet, but I plan to enable it, and downloading fresh metadata will be perfectly fine in that setting.

No issue, I realized it's the same problem as always, those metadata files expire. I need to just produce a signed sample or dump the signature check from the test.

The GitLab link in the description is still valid, but I rebased the build branch onto the current master now. We're talking about the top 9 commits.
If you want to clone/fetch the repo, please get the build branch of https://salsa.debian.org/shib-team/opensaml2.git. It may be in conflict with your planned InCommon MDQ change, but that should be easy fix up if needed.
Thanks.