Shibboleth Developer's Meeting, 2018-12-21

Call Administrivia

10:00 Central US / 11:00 Eastern US / 16:00 UK

Calls are normally the 1st and 3rd Fridays of each month. Next call would be Friday 2019-01-04. Any reason to deviate from this?

60 to 90 minute call window.

Call Details

This week's call will use the Zoom system at GU, see ZoomGU for access info.

AGENDA

1. CA/tests

2. 3.x branch and logging dependencies with Eclipse
   
   

   1. also

      IDP-1373 - Getting issue details... STATUS

3. Java 11 barriers

4. Brexit : do we need to do something ?

Attendees:

Brent

Daniel

• Cutting ldaptive release early next year to fix: https://github.com/vt-middleware/ldaptive/issues/144

Ian

Marvin

Phil

Rod

• IDP-1380 - Getting issue details... STATUS
   and eyeballed Java7 failures for other potential new key issues.

  • issues.shibboleth.net (for "well known metadata") and build.shibboleth.net (for maven) need System trust.

    • Some SP jiggery pokery might persuade an existing SP to provide suitable metadata under issues.shibboleth.net 

    • Not sure what to do about build

    • But @Scott Cantor has a truatble cert ready to roll in.

  • Observation: although I hate them, the <sec:TrustEngine> elements do make for an easy config (of the MetadataProviders) ; but the Spring wiring for the HTTPDataConnector is hardly challenging.

    • I believe we want to work out which is our favored solution and push than ((Spring wiring is deprecated for the Metadata Providers and <TrustEngine> is not available for the data connector

• IDP-1121 - Getting issue details... STATUS
  I have a branch on a private repository {{git@git.shibboleth.net:rdw/testidp.git}} which has all the deprecated custom namespace support removed (plus some tidying).  I'mm keepimng this rebases against master.
  
  

  • Note that there are open issues arising from 

    IDP-1383 - Getting issue details... STATUS
     and 
    IDP-1361 - Getting issue details... STATUS
     Which need discussed (just not today)

Scott

• SP release / advisory

• IDP-929 - Getting issue details... STATUS

• Test cleanup

  • Will attempt Let's Encrypt certs for shibboleth.net, build, git, issues, wiki next week and fix whatever breaks

• Upgrade to postgres  from 9.2 to 9.6 some time in the next week or two

• Will start eval'ing Freemarker
  
  

Tom

• Pin every artifact in a local Maven repository (directory) :

  <keymap>groupId:artifactId:version:type:classifier|SHA-1|0xPGPKeyId</keymap>
  For example :
  <keymap>org.slf4j:slf4j-api:1.5.6:pom:|b79729ffc12292c0ec755db12360486066f6fd34|0x2C7B12F2A511E325</keymap>

  • avoid regexes

  • too hard to programatically figure out Maven dependencies/plugins/reportPlugins etc

  • ~20% of artifacts are unsigned

  • store in parent POM