Shibboleth Developer's Meeting, 2018-11-16

Call Administrivia

10:00 Central US / 11:00 Eastern US / 16:00 UK

Calls are normally the 1st and 3rd Fridays of each month. Next call would be Friday 2018-12-07. Any reason to deviate from this?

60 to 90 minute call window.

Call Details

This week's call will use the Zoom system at GU, see ZoomGU for access info.

AGENDA

1. V4 scope/schedule (follow up from prev. call)

Attendees:

Brent

Daniel

• Can't attend, ice storm knocked out my ISP.

• Reviewing work items for ldaptive v2, potential release for IDP v4.

Ian

• Java:

  • Amazon Corretto: OpenJDK 8 and 11 LTS

Marvin

Phil

• Unable to attend, will circulate document on OIDC authN on Monday. 

Rod

• Out, so apologies as well.

• Last few odds and ends of <ds:KeyInfo> testing

Scott

• SP still on hold waiting for next curl and openssl releases

• Spring / POM bump done

  • Several MVC classes I know nothing about were removed from Spring 5

  • Replaced with apparent new versions but no idea of impact

• Jetty 9.4 testing - port 80 off by default?

• IDP-964 - Getting issue details... STATUS

Tom

• Made progress on Jetty integ tests

  • File permissions were incorrect on OpenJDK I installed to the Windows VM

  • Next up : Tomcat on Windows

• IdP branches : given a typo to fix, commit to master and cherry-pick to branch(es) ?

• JPAR-102 - Getting issue details... STATUS
  Pin instead of proxy

  • What do we pin ?

    • artifact to artifact hash

    • artifact to pgp keyID of artifact signature

  • Scope : 

    • Maven plugins : yes

    • test artifacts : ?

  • Probably need to combine :

    • https://github.com/gary-rowe/BitcoinjEnforcerRules

    • https://github.com/s4u/pgpverify-maven-plugin

      • Some notes : How to Validate Signatures of Maven Dependencies

• Maven 3.6.0 upgrade on shibboleth.net

Other