Problem with OpenSAML decoding certificate

[Brent Putman]

On 6/18/13 5:37 PM, Brent Putman wrote:
> Hmmm... I don't have any recollection of us patching
> not-yet-commons-ssl.  And if we did, we probably would have given it a
> different version string, with something in it to indicate that in
> wasn't the standard version.  I'll do some research.  I'd be interested
> to know whether the jar we have in our (Shib project's) Maven repo and
> shipped in our distribution differs from what is in Maven central
> (assuming that's the repo to which you are referring).

Well, I see one "issue" already, although perhaps not significant to the
problem.  In our build.shibboleth.net repo, we have (for some reason
unknown to me) listed the not-yet-commons-ssl artifact with groupId of
'org.apache.commons.ssl'.  However, java-xmltooling's POM references it
with groupId 'ca.juliusdavies', as does Maven central.  So I suspected
and confirmed that we actually shipped  OpenSAML 2.5.2 and 2.6.0 with
the version from Maven central; we therefore don't appear to be using
the version of the artifact in our Maven repo at all. 

MD5 (not-yet-commons-ssl-0.3.9-CENTRAL.jar) =
478a6177330a0098435828a8409f49c1
MD5 (not-yet-commons-ssl-0.3.9-SHIB.jar) = 8063831d05fc6204a7c0c23a0f86b086
MD5 (opensaml-2.6.0/lib/not-yet-commons-ssl-0.3.9.jar) =
478a6177330a0098435828a8409f49c1
MD5 (opensaml-2.5.2/lib/not-yet-commons-ssl-0.3.9.jar) =
478a6177330a0098435828a8409f49c1


Note different file checksums between the central and Shib artifacts. 
The sizes differ by over 2000 bytes. 

I don't know where we got the one in our repo.  Maybe Chad built it from
source or something. But more to the OP's point:  the version we have
shipped in 2.5.2 and 2.6.0 is identical to the one from Maven central. 
So unless when you said "I was using not-yet-commons-ssl from maven
repository" you meant some repo other than Maven central, I don't think
this is significant, there must be something else going on.

--Brent