Exception during in-place 4.2.1 to 4.3.1 upgrade

[Max Spicer]

Our 4.2.1 IdP is configured to use multiple signing credentials following
the examples at
https://shibboleth.atlassian.net/wiki/spaces/KB/pages/3043917826/IdP+Key+and+Certificate+Management.
As such, we don't have idp.signing.cert defined in idp.properties and
instead have idp.signing.cert.2013 and idp.signing.cert.2023. The 4.2.1 IdP
is fully functional with this configuration.

I'm trying out an in-place upgrade to 4.3.1 on this install using a dev
box. When I run bin/install.sh, it reports "Update from version 4.2.1 to
version 4.3.1" but then fails with:

WARN  - Exception encountered during context initialization - cancelling
refresh attempt:
org.springframework.beans.factory.BeanDefinitionStoreException: Invalid
bean definition with name 'IdPConfiguration' defined in class path resource
[net/shibboleth/idp/installer/metada
ta-generator.xml]: Could not resolve placeholder 'idp.signing.cert' in
value "%{idp.signing.cert}"; nested exception is
java.lang.IllegalArgumentException: Could not resolve placeholder
'idp.signing.cert' in value "%{idp.signing.cert}"

As it only seems to be the metadata generation that is failing, I resolved
this by temporarily defining idp.signing.cert and pointing it to our
default cert. After that, the upgrade appears to complete successfully
(pending testing).

Am I safe to proceed with this workaround and can I safely remove the
property again afterwards? Is this a bug in the installer or in our
installation?

Thanks,

Max Spicer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231017/36def4e2/attachment.htm>