Shibboleth Developer's Meeting, January 12, 2012

Attendees: Scott Cantor, Jim Fox, Chad La Joie, Brent Putman, Rod Widdowson, Ian Young, Tom Zeller

Next Face-to-Face Meeting

VT-LDAP SSL/TLS Issue

VT LDAP library does not verify the hostname against the certificate it receives for LDAPS
Per Sun/Oracle's docs, the JDK does not do hostname verification for protocols other than HTTPS because those specifications don't explicitly say to do so
Scott, Chad, Daniel talked about various options
Daniel will do an exact match implementation and may take code from the apache http components for wild card support and will do a new release with the fix
Chad will do an IdP 2.x release and security advisory once the new VT-LDAP lib is available

OpenSAML v3 Update

Java Support Lib

a new library, built on top of Google Guava, containing the utility classes from the opensaml-util, IDP, and Metadata Aggregator projects
java-support is a new project in the utilities SVN repo
1.0.0 release expected in 2-3 weeks

WiX Update

Scott and Rod may meet up to discuss this in March when they are co-located
Less of a concern for Java software because those products are more self-contained
Scott and Rod have been emailing back and forth about the use of WiX installers and the depths of how it operates
There are various ways in which WiX can operate when upgrading an install - some methods aren't great and will require a modest amount of work
Moonshot folks have asked Scott if we can generate merge-module installer
Merge modules do allow for cleaner bug fixes of dependent libraries but creating them is an effort
One thing to be investigated is whether MS MSI is going to be dumped?
AI Rod will ask about this when at MS next month
AI Rod will think about risk reduction in case installer doesn't work as expected
Rod will probably begin building a test installer either early Feb or early March
AI Rod will make some sensible estimates on how long the test installer will take

Release Engineering

Chad is document release process for Java products
Scott will document release for C++ products
We should designate a back-up build engineer for both Java and C++ products
- Proposed Rod as backup for Scott and Brent as backup for Chad
Some C++ products have had false positives from virus checkers. Probably should have a clean VM to do release builds for C++ and Java products.
What VM product/format should we use? Everyone except Scott seems to have VMWare.

GoToMeeting Performance

Seems to work okay, couple people said they liked it better than current conferencing service
GoToMeeting had previously been a Java WebStart application which meant all it's executed code was pulled down from the web. Now it's a standalone desktop app so less of concern there.
When do meeting IDs change? Whenever a new event is scheduled. If an event is scheduled as reoccuring it will have the same ID (and thus the meeting initiation URL can be bookmarked) for each instance of the meeting

Next Meeting: January 26, 1600UTC

Browser not supported