New Shibboleth 5.1.3 IdP installation - status.sh failing

[Peter Schober]

o haya via users <users at shibboleth.net> [2025-03-25 03:13 CET]:
> 2025-03-24 21:58:58,477 - 127.0.0.1 - ERROR
> [jakarta.servlet.ServletException:144] -
> jakarta.servlet.ServletException: Handler dispatch failed:
> java.lang.NoClassDefFoundError: jakarta/servlet/jsp/jstl/core/Config

See "JSTL Support" in the IDP notes for Tomcat:
https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3269689345/Tomcat+10.1

Or from my own local documentation:

> In order to make the IDP's status.sh script work (which is optional
> and not required for the IDP to function but may come in handy for a
> superficial test whether the IDP is "working") add the required Jakarta
> Server Tag Library and rebuild the IDP Web Archive:
> 
>   cd /opt/shibboleth-idp/
>   mkdir -p edit-webapp/WEB-INF/lib
>   curl -O --output-dir edit-webapp/WEB-INF/lib/ https://repo.maven.apache.org/maven2/jakarta/servlet/jsp/jstl/jakarta.servlet.jsp.jstl-api/3.0.0/jakarta.servlet.jsp.jstl-api-3.0.0.jar
>   ./bin/build.sh

The latest version at this time seems to be 3.0.2:
https://repo.maven.apache.org/maven2/jakarta/servlet/jsp/jstl/jakarta.servlet.jsp.jstl-api/
and there's a gpg signature file available for the jar:
https://repo.maven.apache.org/maven2/jakarta/servlet/jsp/jstl/jakarta.servlet.jsp.jstl-api/3.0.2/
but the key from that signature is not available on a keyserver and so
there's no web-of-trust-checking of the trustworthiness of the key:

$ gpg --verify jakarta.servlet.jsp.jstl-api-3.0.2.jar.asc
gpg: assuming signed data in 'jakarta.servlet.jsp.jstl-api-3.0.2.jar'
gpg: Signature made Thu 22 Aug 2024 06:52:23 PM CEST
gpg:                using RSA key 36E1F5E7FF8824BA809BE239E8CAE3F985718751
gpg: requesting key E8CAE3F985718751 from hkps://keys.openpgp.org
gpg: Can't check signature: No public key

HTH,
-peter