Shibboleth Metadata Aggregator V1.0.0 now available

[Ian Young]

The Shibboleth Project is pleased to announce that V1.0.0 of the Metadata Aggregator
software is now available.[1]

With this release, the Metadata Aggregator project transitions to the normal
Shibboleth project version numbering conventions, based on Semantic Versioning.[2]
In particular, the API provided can be relied upon until at least version 2.0.0.

V1.0.0 should be a direct drop-in replacement for all users of V0.10.0, provided that
all deprecations have been addressed. Upgrading from earlier releases to V1.0.0 is
not supported; deployers should first upgrade to V0.10.0 to gain access to the
migration assistance and then upgrade to V1.0.0 after any deprecations have been resolved.

This release contains one enhancement and one fix for a long-standing bug in the software:

- A new generic ElementValidationStage applies a sequence of Validator<Element>
  beans to DOM elements selected by QName. A new RejectMixedContentTextValidator
  can be used with this to handle a specific use case in the XML DSIG specification
  where text in mixed content is permitted in certain elements but should not be used.

- The XMLSignatureSigningStage now normalises the document it is signing, ensuring
  that all namespaces nodes are present and therefore that signatures generated by
  the stage can always be correctly verified. This change reduces performance to a
  small degree (under a second of CPU time for a 100MB document). Configurations using
  the previous mitigation for this issue (performing an identity XSL transform prior to
  signature) should now be able to remove that step.

Please see the release notes [3] or the complete issues list [4] for full details.

Note that this release is built on the same dependencies as Shibboleth Identity
Provider V5.1.2, and uses the same component model and Spring resource classes.
In particular, it incorporates Spring Framework V7.0.4.

-- Ian Young


[1] https://shibboleth.net/downloads/metadata-aggregator/1.0.0/
[2] https://semver.org
[3] https://shibboleth.atlassian.net/wiki/spaces/MA1/pages/3775234049/Version+1.0.x
[4] https://shibboleth.atlassian.net/projects/MDA/versions/10153/tab/release-report-all-issues

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4151 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20260313/18b5712e/attachment.p7s>