SP downloading and xmldsig-validating remote XML metadata on every start

[Cantor, Scott]

> I.e., it's not just the log line about "listener service starting"
> that comes well after the signature validation filter finishes, shibd
> is actually not listening before.

I really am going from memory and if my memory's wrong, so be it. I can say it hasn't changed, and if it's never been useful...I guess it's never been useful. That was my recollection of the compromise that got made and how it interacted.

I can say from the log that it's clear that the reason the setting isn't mattering is that it isn't loading the backup file there, it's clear from the log that there's a curl fetch of the file ahead of that step.

The main function of the backup originally of course was as a fallback for errors, but I really can't see why the setting would have been added at all if not for the intent that it would initialize from the backup file if it were present. I recall all the conversations about it being " it's still slow, but only the first time through, then it's faster" and all that. That's consistent with the idea that it worked that way.

It just hasn't changed in several years, so if it doesn't work, it never did. I'm definitely not about to go anywhere near that code at this stage, so if it's broken, filing a bug will serve as a record of it at least.

Once I have a second I can stand it up and see what it does, but that's probably not going to happen on a Friday.

-- Scott