OpenSAML v4.0.1 Artifacts in Central Repository

[Cris Rockwell]

Hi,

I work on an open source project [0] with Apache Sling [1] that uses the OpenSAML 
v4 library. The pre-release includes the Shibboleth repository [2] in the pom.xml

We are near the point in the project where this project may be released to Maven Central 
as is common practice for all Apache Software Foundation Java artifacts.

Central has the following guidance regarding 3rd party artifacts [3]
we discourage the usage of <repositories> and <pluginRepositories> and instead 
publish any required components to the Central Repository. 
This applies for your own components as well as for 3rd party artifacts.

But I have also read the Shibboleth wiki about Maven Central [4]
So there is tension between these two recommendations.

My PMC questions whether the Shibboleth repository is needed for our project,  
because v4.0.1 is available from Central.  It came as a bit of surprise, so I’m suspicious 
about the veracity of the OpenSAML artifacts from Central, given the aforementioned 
wiki post.

As an example, the OpenSAML artifacts currently uploaded to Maven Central are not 
provided by the Shibboleth project nor are they artifacts that we've released (i.e., 
the jars out there have been changed in some unknown way).


I have started calculating the sha1 hashes for the artifacts as obtained from Maven 
Central and comparing to the hashes published to the Shibboleth repo [6]. 
So far, they indicate the artifacts contents are indeed the same. 
I may continue verifying the artifact's integrity.

Please let me know...

Has anything changed with respect to publishing artifacts to Maven Central as compared to the wiki?

Do you have any knowledge about how OpenSAML v4.0.1 artifacts were uploaded to Central in Feb 2021? 

Is it still presumed these were modified in some way as the wiki suggests?

Please let me know if you have any other suggestions.

Best regards,
Cris R


[0] https://github.com/apache/sling-org-apache-sling-auth-saml2
[1] https://sling.apache.org/
[2] https://github.com/apache/sling-org-apache-sling-auth-saml2/blob/c3442267abeffad22e411fb1149cb8f80ef9361a/pom.xml#L404-L413 
[3] https://central.sonatype.org/publish/requirements/
[4] https://wiki.shibboleth.net/confluence/display/DEV/Use+of+Maven+Central
[5] https://mvnrepository.com/artifact/org.opensaml/opensaml-core/4.0.1
[6] https://build.shibboleth.net/nexus/content/groups/public/org/opensaml/opensaml-core/4.0.1/opensaml-core-4.0.1.jar.sha1

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20210423/129a3bd2/attachment.htm>