<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi Cris,<br>
</p>
<div class="moz-cite-prefix">On 4/4/20 11:44 AM, Cris Rockwell
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:A01CE987-2EA5-43F8-993C-0FC0B5C151AE@umich.edu">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</blockquote>
<br>
<blockquote type="cite"
cite="mid:A01CE987-2EA5-43F8-993C-0FC0B5C151AE@umich.edu">
<div class=""><br class="">
</div>
<div class="">I heard about V4 and see the release notes, but the
new version is not in the Maven Central repository. My project
is a Maven Reactor module for Apache Sling, and the Slings devs
asked me not to add the shib<a
href="https://wiki.shibboleth.net/confluence/display/IDP30/GettingStarted#GettingStarted-AddShibbolethrepositoriestoyourPOM"
class="" moz-do-not-send="true"> artifact repositories</a> for
OpenSAML. Because there is <a
href="https://mvnrepository.com/artifact/org.opensaml/opensaml-core"
class="" moz-do-not-send="true">precedent</a> of them being in
Maven Central, this is where they wanted to get it. If you
pushed V4 to Central, then I would upgrade to that version.</div>
</blockquote>
<p><br>
</p>
<p>We actually have an entire Wiki page about Maven Central because
it's a FAQ:</p>
<p><a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/DEV/Use+of+Maven+Central">https://wiki.shibboleth.net/confluence/display/DEV/Use+of+Maven+Central</a><br>
</p>
<p>TL;DR: We have never added any of our project's artifacts there,
and we won't be putting any up there (anytime soon, at least).
You don't know where those binaries came from, and in our security
middleware project's opinion they aren't safe to use. (That might
change if/when the Maven community wakes up to this problem, and
starts mandating both that artifacts are signed and that Maven by
default validates the signatures. So far they haven't seemed
interested.)<br>
</p>
<br>
<blockquote type="cite"
cite="mid:A01CE987-2EA5-43F8-993C-0FC0B5C151AE@umich.edu">
<div class="">
<div class="">OSGI offers some advantages over traditional Java
runtime environments. Major players are building on platforms
like these. Others might prefer Spring or commercial products.
Those is not interesting to me right now. I am doing this for
the sake of the open-source projects that I believe in.<br>
</div>
</div>
<br>
</blockquote>
<p><br>
</p>
<p>My references to Spring were not intended to imply that you
should be using Spring in your project. Merely that if you want
to look at how an SP should work using OpenSAML components, the
only thing to which we can point you as an example is the
Shibboleth IdP, and that uses Spring. So reading and understanding
our SP code requires some Spring knowledge, or at least
willingness to learn it as you go. That's all.<br>
</p>
</body>
</html>