Shibboleth Developer's Meeting, 2021-07-02

Brent

• Back from vacation. No progress to report. Next up is continuing to look at the Java socket server question.

Daniel

Henri

Ian

• Java 17: now being tested in -multi jobs; all seems well.
  • Nashorn 15.3: "The most notable change is that Nashorn now works with JDK 17.", see see https://twitter.com/OpenJDK/status/1410603091490054166
  • This is something to do with Unsafe.defineAnonymousClass I think, not clear why we aren't seeing issues in -multi jobs.
• SKS (PGP/GPG) keyservers are defunct (RTBF/GDPR, apparently). Acronyms much?

John

Marvin

Phil

•  added test, fixed, and deployed 1.1.1 of the Duo plugin
• Maven cleanup
  •  - we can get rid of our patched one from Nexus.
  •  - thanks to the work Scott put in, I think this is done, other than testing (and some possible adjustment of server-side scripts) during a release.
• OIDC-RP
  • Slow progress, hopefully have more time now the Maven stuff is done.
  • Spent a small amount of time on Webfinger for OP discovery - can not see much support for this. 
    • The plugin probably should provide some support? to support OP discovery on the flow (like SAML proxying does with IdP disco).
    • Strategy-based lookup for now.

Rod

• 'test' to check against our poms is complete and in place.  Scott Cantormade some changes to our parent pom.
• 'test' to check war contents signing is ongoing.
• We are going to have to have a conversation about jar signing & supply chain attacks.  

Scott

• Started wiki migration, member pages "in production"
• 
• 
• A few more 4.2 odds and ends

Tom

• Regrets - will miss call
• Green lights on browser tests
  • Run latest-browsers vs latest-Jetty vs IdP-latest and IdP-next nightly ?
    • don't need to re-run tests against static versions
    • Sauce Labs tests are slower than local headless Firefox

Other