OpenSAML 2.6+ missing xml-api dependency in pom.

[Cantor, Scott]

On 2/26/14, 10:26 AM, "Randall,Matt" <MRANDALL at CERNER.COM> wrote:

>I can certainly sympathize with your perspective on the Maven Central
>repository.  Is it Internet2's recommendation to use the Shibboleth
>repository for sourcing the other artifacts that OpenSAML is dependent
>upon into our own Nexus server, or perhaps to build them directly from
>the secure source?

Internet2 isn't involved, Shibboleth is an indepenent project now.

We would advise either of those options, yes, but we're still in process
of getting that done ourselves. The V3 stack will be built with Central
disabled in the POMs, but the V2 stack doesn't have all its dependencies
in our repository. Most of the V3 dep jars are there, but not all yet.

For now all we're saying is that if you want to pull in *our* code, we
only take responsibility for the artifacts at shibboleth.net, and we sign
those ourselves. Anything you find elsewhere isn't from us.

Maven is just broken, unfortunately, and getting to a place where you can
avoid the brokenness is a process. Our main concern is not with the
provenance of any given artifact in Central, but with the fact that at any
time, during any build, you could end up pulling in a tampered-with
version of something even if it's only there for a minute or two.

-- Scott