Updating the Duo 2FA Plugin

[Cantor, Scott]

On 6/12/17, 11:00 AM, "dev on behalf of Xander Desai" <dev-bounces at shibboleth.net on behalf of xdesai at duo.com> wrote:

> I'm an engineer at Duo Security and we have a new update to the Duo WebSDK that we'd like to roll out to the Duo plugin for
> Shibboleth. Currently Shibboleth is on WebSDK v2.3 and we'd like to get on the latest v2.6.

I'm still not seeing the projects in github with clearly marked and tagged releases, can you maybe give me a pointer to were there's a piece of code labeled with that version?

Or are you saying that your back-end API has that version, and the untagged/unversioned code in github is now altered to reflect that?

In which case, we really need to see that code versioned and tagged.

> What is the best way for me to assist with this change? Is a pull request the appropriate way to handle this update?

You can file an issue in our Jira, but our normal course of work includes reviewing dependencies for updates when we do new releases, and because it's a core feature people rely on it would get updated as a normal matter of business when 3.4 is released. If there were a security issue, then we would do it as a patch release because it was necessary.

The notion of a cloud dependency is not one we have a lot of past experience with, but a compatibility issue where the code would stop working at some point in between normal upgrades would require us to do a patch as well, which I'm hoping isn't the case here but if I've missed some announcement, I'll take a look. I'll make sure I'm on the right lists, which I'm probably not.

It's definitely a problem for us to be asked to update to unreleased code. That means a signed tag in github, if that's where the code lives.

-- Scott