include SignatureValidation filter with FileBackedHTTPMetadataProvider

[Tom Scavo]

On Tue, Dec 19, 2017 at 1:13 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
> Simply having the option to skip the verification of the signature, as the SP has, is the reason what you're saying isn't true from the perspective of the software. You can skip it under the presumption that the backup can only get there "safely".

There are two separate cases to consider:

If the metadata is signed, and a SignatureValidation filter is
included, the software defaults correctly IMO. If the deployer wishes
to turn off verification of the backup file at startup, s/he can do so
by performing an explicit config action.

OTOH, if the metadata is not signed, what should the default action of
the software be? I believe it should go out to the network by default.
If the deployer makes an explicit decision to grab a locally trusted
file instead, then that's fine. All I'm saying is that shouldn't be
the default behavior of the software (which is it if the deployer
happens to use FileBackedHTTPMetadataProvider).

Tom