"Patching" the V3 IdP in windows.

[Rod Widdowson]

I'm wanting to avoid getting into patching the IdP for windows (the
mechanisms we use don't really fit and MSP generation always seems a bit
fraught).

For the SP, under Windows have to issue patches because we ship packages
which come for free on other operating systems.  When SSL has a secadv,
non-Windows users do not need to upgrade Shibboleth, but Window users do.
So we need to maintain the version and thus so we end up with the mess which
is shipping patches and a new installer with the upgraded contents.

We have a similar situation with the IdP - on windows users have the option
to install jetty.  So if this gets a security alert we need to issue a new
package.

What I'd like to do is to use the sub-sub-version numbers in the MSI and
allow "same version" upgrades.  

That is to say we ship IdP V3.2.2 with certain jetty version.    The MSI is
known as V3.2.2.0.

If we need to patch just Jetty then we reissue with version V3.2.2 but with
an MSI known as V3.2.2.1.  By the "version rules" you cannot go backwards in
a release (so you cannot go from 3.2.2 to 3.2.1) but you can go from 3.2.2
to 3.2.2.  The fourth number (.0 -> .1) is not used for version checking and
because we allow same version upgrades the user can upgrade the jetty
version just by installing the newer release.  The (non configuration)
Shibboleth contents will be refreshed, but they won't have changed so it’s a
safe operation.

This avoids the whole troubled issue of generating msps, at the cost of
providing a gun/bullet configuration whereby users can also downgrade by
reapplying an older version of the same installer.  But this is the moral
equivalent of uninstalling a patch from control panel.

/Rod