New Shibboleth 5.1.3 IdP installation - status.sh failing

[Peter Schober]

Peter Schober via users <users at shibboleth.net> [2025-03-25 11:16 CET]:
> >   cd /opt/shibboleth-idp/
> >   mkdir -p edit-webapp/WEB-INF/lib
> >   curl -O --output-dir edit-webapp/WEB-INF/lib/ https://repo.maven.apache.org/maven2/jakarta/servlet/jsp/jstl/jakarta.servlet.jsp.jstl-api/3.0.0/jakarta.servlet.jsp.jstl-api-3.0.0.jar
> >   ./bin/build.sh
> 
> The latest version at this time seems to be 3.0.2:
> https://repo.maven.apache.org/maven2/jakarta/servlet/jsp/jstl/jakarta.servlet.jsp.jstl-api/
> and there's a gpg signature file available for the jar:
> https://repo.maven.apache.org/maven2/jakarta/servlet/jsp/jstl/jakarta.servlet.jsp.jstl-api/3.0.2/
> but the key from that signature is not available on a keyserver and so
> there's no web-of-trust-checking of the trustworthiness of the key:

https://keyserver.ubuntu.com/ has the key. The only signature (other
than a self-signature) on that is from Eclipse Webmaster <webmaster at eclipse.org>.

$ gpg --keyserver keyserver.ubuntu.com --verify  jakarta.servlet.jsp.jstl-api-3.0.2.jar.asc
gpg: assuming signed data in 'jakarta.servlet.jsp.jstl-api-3.0.2.jar'
gpg: Signature made Thu 22 Aug 2024 06:52:23 PM CEST
gpg:                using RSA key 36E1F5E7FF8824BA809BE239E8CAE3F985718751
gpg: requesting key E8CAE3F985718751 from hkp://keyserver.ubuntu.com
gpg: key 296863EC7506AB74: public key "Eclipse Project for JSTL <jstl-dev at eclipse.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: Good signature from "Eclipse Project for JSTL <jstl-dev at eclipse.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 7BE1 BB0B 4DE4 CFB8 72E9  0E51 2968 63EC 7506 AB74
     Subkey fingerprint: 36E1 F5E7 FF88 24BA 809B  E239 E8CA E3F9 8571 8751

-peter