Shibboleth Developer's Meeting, 2021-08-20

Call Administrivia

09:00 Central US / 10:00 Eastern US / 15:00 UK / 17:00 FI

Calls are normally the 1st and 3rd Fridays of each month. Next call would be Friday 2021-09-03. Any reason to deviate from this?

60 to 90 minute call window.

This week's call will use the Zoom system at GU, see ZoomGU for access info.

Add items for discussion here

Java 17 RC is out, final RC imminent, GA on 2021-09-14
Proposed to target Java 18: https://openjdk.java.net/jeps/400
Debian 11 (Bullseye) released
- Includes an up-to-date Java 11.
- Includes an earlier EA of Java 17, to be upgraded.
- See https://shibboleth.atlassian.net/browse/GEN-281 for details of evaluation.
- I think we can add this to the “partially supported” list in https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/1177321655/Java+Distributions#Java-Distributions-for-the-Java-11-Platform (but only for Java 11 for now, of course) and call it a day.

JavaScript
- IDP-1853 - Getting issue details... STATUS
- JSCRIPTING-9 - Getting issue details... STATUS
  - What to call it?
Supply Chain attack. Hibernate and JBOSS worry me
- Dependency on a 8 year old and 3 major versions out of date parser (ANTLR)
- Recent, required jars are unsigned.
- Do we shake their tree or suck it up? If the latter can someone sign these jars and pop the asc files into our repository)
  - NOTE that this trick only works for as long as build.shibboleth.net remains definitive for our builds. If we move to a site we don’t own we are back being open to attack at any time. (Modulo hard wired overrides for insecure jars)