Shibboleth Developer's Meeting, 2019-01-18

1. LDAPocalypse Now

Brent

Daniel

Ian

• Been defocused for the last couple of months for various reasons I won't get into, but should be back and more active now.
• Main activity is the push to Java 11. Will hold off making the actual change as long as possible, so that the java-parent-project master branch uses Java 8 as long as possible.
• What are known blockers, if any, in our code for a Java 11 transition? Or is it solely the tooling?
• Will use the MDA, as usual, as the canary for the transition when it comes.

Marvin

Phil

• Progressing IDP-1393
  
• Looking at Globus Auth as an OP. 

Rod

• 3.4.3
• Some rationalization in JIRA
• Keeping track with changes
• NOTE
  
  • I'll be travelling during the call and on a train.  I'll connect in as much as I can but even if I'm in the meeting I'll be silent.  Apologies.
    

Scott

• Fixed an SP macport issue
  • C++ modernization issue, might be dated to last OS X version or Xcode tools bump
  • Nobody reported it for weeks, implying to me we should be looking at dropping OS X support, officially speaking at least
• Started removed some dead features not involving large code changes
• Migrated "internal" AES-GCM calls to JCE
• IDP-1390 - Getting issue details... STATUS
  • Ended up with a less hacky version of my "reloadable" Spring scope, a Managed Bean service for user-defined reloadable beans

Tom

• JPAR-102 - Getting issue details... STATUS
  
  • New plan for "pin/key map" : fingerprint|checksum artifact-coordinate-pattern
    
    • Use checksum rather than PGP fingerprint when unsigned or bad signature
    • Use fingerprint rather than key ID because there could be collisions
    • Should we use wildcards/patterns in the artifact-coordinate-pattern ?
      • Yes for our artifacts
      • Maybe for other artifacts (like Spring)
    • Append to "pin" list or remove no longer used map entries ?
  • IdP 3.4.3 has 1150 artifact dependencies in the stack (including Maven plugins)
    • 250 are unsigned (22 %)
    • 3 have bad signatures (org.apache.struts:struts-taglib|core|tiles:pom:1.3.8)
    • no weak (as defined by the pgpverify plugin) signatures
    • The count of 1150 includes POMs
  • Need Jenkins to sign SNAPSHOTs (since checksums will change)
  • INFRA-196 - Getting issue details... STATUS  Initial install of Nexus NXRM 3 to take a look at capabilities
    
    • Should we proxy Maven Central ? (probably, so we can discontinue use of it directly)
  • Some links :
    • https://checker.apache.org/
    • https://www.apache.org/dev/release-distribution#sigs-and-sums
      
      

Other