[JIRA] (JCOMOIDC-24) Observations about the packaging of oidc-commont

[Rod Widdowson (Jira)]

Rod Widdowson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=59fb32bbc24efb3c4ed3c977 ) *created* an issue

Java Common OIDC Library ( https://shibboleth.atlassian.net/browse/JCOMOIDC?atlOrigin=eyJpIjoiN2NkMjBhMjhiOWUyNGJmOTgyMDRlOGZhNDVkYTU3NWEiLCJwIjoiaiJ9 ) / Task ( https://shibboleth.atlassian.net/browse/JCOMOIDC-24?atlOrigin=eyJpIjoiN2NkMjBhMjhiOWUyNGJmOTgyMDRlOGZhNDVkYTU3NWEiLCJwIjoiaiJ9 ) JCOMOIDC-24 ( https://shibboleth.atlassian.net/browse/JCOMOIDC-24?atlOrigin=eyJpIjoiN2NkMjBhMjhiOWUyNGJmOTgyMDRlOGZhNDVkYTU3NWEiLCJwIjoiaiJ9 ) Observations about the packaging of oidc-commont ( https://shibboleth.atlassian.net/browse/JCOMOIDC-24?atlOrigin=eyJpIjoiN2NkMjBhMjhiOWUyNGJmOTgyMDRlOGZhNDVkYTU3NWEiLCJwIjoiaiJ9 )

Issue Type: Task Affects Versions: 1.1.0 Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Attachments: signatureReport.txt Created: 25/Sep/21 8:53 AM Priority: Trivial Reporter: Rod Widdowson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=59fb32bbc24efb3c4ed3c977 )

I am adding the signature checking to the plugin as part if JPAR-182 ( https://shibboleth.atlassian.net/browse/JPAR-182 ) Open.

FYI Attached is the signing report signatureReport.txt ( https://shibboleth.atlassian.net/secure/attachment/10639/10639_signatureReport.txt )

In preparing this I stumbled upon four minor nits. I'm reporting them but that does not mean I feel any change is needed

* The assembly includes the contents of oidc-common-attribute-impl/target/dependency – but it doesn’t exist.
* The assembly includes the contents of oidc-common-saml-api/target/dependency – but it doesn’t exist
* The assembly includes the contents of oidc-common-saml-impl/target/dependency – but it doesn’t exist

The enforcer plugin cares that these directories do not exist (because not having something is bad). But this means that the rules of what goes into the package doesn't match what is tested against.

* There is a great deal of duplication in the contents of the dependency trees (both oauth2-oidc-sdk and nimbus-jose-jwt appear three times.

Again this doesn't matter because we do not run the dependency checking bit of the enforce on plugins (plugin dependencies are usually very heavily managed). But if we did this would be a failure - because in the cases like the IdP (where the enforcer is looking at the unpacked distribution) it would be.

All of these cases only arise because the enforcer has been instructed to look at the folders which are combined into the assembly. If the enforcer could look at the unpacked assembly none of these would matter - so I suspect that there might be some clever pom manipulatio you could do to unpack the tgz file after the package phase and before the verify phase, you could then point thenforcer at the unpacked distribution.

But life is too short,

( https://shibboleth.atlassian.net/browse/JCOMOIDC-24#add-comment?atlOrigin=eyJpIjoiN2NkMjBhMjhiOWUyNGJmOTgyMDRlOGZhNDVkYTU3NWEiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JCOMOIDC-24#add-comment?atlOrigin=eyJpIjoiN2NkMjBhMjhiOWUyNGJmOTgyMDRlOGZhNDVkYTU3NWEiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100178- sha1:b30d6b7 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20210925/0b6c8738/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-165b2abd-ea56-4292-9619-ba43c9e34684
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210925/0b6c8738/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-5528c72e-5da9-44af-b7e4-06f404d04266
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210925/0b6c8738/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-link_attachment_7-83ee31ca-8d21-48a3-902f-45f1cfdb23e3
Type: image/gif
Size: 163 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210925/0b6c8738/attachment-0001.gif>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-5f8fe042-79dd-43fb-807c-238605f66f33
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210925/0b6c8738/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-aca81828-1db2-4d04-a481-dbbdad7a5ef3
Type: image/png
Size: 468 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210925/0b6c8738/attachment-0007.png>