shibd unable to verify signature when metadata is cached

[Cantor, Scott]

> I note that an eduGAIN entity also started publishing a description containing
> `
` within the last few days. This initially broke the eduGAIN signing
> process but once that was corrected the values eventually flowed out to SP
> which then had problems.

Yes, it seemed weirdly coincidental that this happened independently after so many years. I wonder if some tool is involved somewhere?

> I'll be adding some further filtering to our raw metadata ingest routines (for
> sources such as eduGAIN) before we re-publish them as Shibboleth SP is
> such a critical component for us. This might be a useful consideration for
> other operators as well, should they have the capability.

I don't think this got filed as a bug. It is one, if not so easy to fix.

-- Scott