...
- If you are upgrading an IdP or SP which is registered with a federation, you should contact the federation operators, give them access to the new metadata for the entity, and tell them what version of the software you have installed. (Otherwise, they have no way of knowing that you have changed your configuration, and will continue to include your old metadata in any federation metadata aggregate which they publish.)
- After installation, you should also subscribe to the Shibboleth Announcement mailing list. This is where announcements about new releases, end-of-life of past releases, and security advisories are distributed.
All software, including archived releases, is available from http://shibboleth.net/downloads/ and each release is accompanied by a detached PGP signature using one of the keys listed in the project's KEYS file.
Installation Instructions
...