I have committed dev/JPAR-234 branches to the following repositories:

• java-parent-project referencing the new milestone. The Spring project are including milestones in Maven Central now, so that’s all that is required.

• java-ship-shared removing the reference to spring-jcl

• java-identity-provider commenting out the signature enforcement in idp-distribution for probably obvious reasons (I disable the .m2 check in my test environment anyway)

With this in place, our unit tests run all the way up to the IdP and into the plugins. So, not too bad for now. I imagine there are other disruptions to come, of course.

For what it’s worth, the tests all the way up to the IdP and some plugins seem to have passed with spring-jcl just removed from the one place it’s referenced. That’s not real, but it’s not the testbed either.

There are of course new dependencies all over the place with new keys. I’m not going to track those until later, I’ve just commented the enforcer out of the idp-distribution module for now.

The claim I guess is that commons-logging-1.3.0 does the “same” inference about use of SLF4J that spring-jcl did so they could include that in its place. The proof of course remains to be seen. We’d have to do some real world testing for sure, the testbed tends to contaminate the results (both for good and bad).

First observation in an initial exploration of this is that the spring-jcl module has disappeared.

Hopefully this just simplifies things a little for us.