From fdabcbc481d995676d74d7449834e3a38de7fb13 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Fri, 10 Mar 2017 15:34:53 +0000
Subject: [PATCH] Retire key use fixup in fallback aggregate

See ukf/ukf-meta#109.
---
 mdx/uk/README.md              |  3 --
 mdx/uk/check_fixup_keyuse.xsl | 44 -----------------------------
 mdx/uk/fixup_keyuse.xsl       | 52 -----------------------------------
 mdx/uk/generate.xml           | 43 +----------------------------
 4 files changed, 1 insertion(+), 141 deletions(-)
 delete mode 100644 mdx/uk/check_fixup_keyuse.xsl
 delete mode 100644 mdx/uk/fixup_keyuse.xsl

diff --git a/mdx/uk/README.md b/mdx/uk/README.md
index e10c6d8f..d0bd2d04 100644
--- a/mdx/uk/README.md
+++ b/mdx/uk/README.md
@@ -69,7 +69,4 @@ Status (2017-03-10):
 
 * the production aggregate implements a _blacklisting_ approach to entity attributes imported from eduGAIN,
 while the production aggregate implements the traditional entity attribute _whitelist_. (2017-03-02)
-* the production aggregate no longer implements the "key use" fixup required for pre-1.3.1 Shibboleth SPs.
-This adds the `use="signing"` XML attribute to `<KeyDescriptor>` elements present in IdP metadata
-without a `use` attribute. It is not needed for later releases of the Shibboleth SP. (2017-02-10)
 * The production aggregate normalises the `xenc` namespace to not use a prefix, as it is not very commonly used. (2017-02-13)
diff --git a/mdx/uk/check_fixup_keyuse.xsl b/mdx/uk/check_fixup_keyuse.xsl
deleted file mode 100644
index cb91fe5d..00000000
--- a/mdx/uk/check_fixup_keyuse.xsl
+++ /dev/null
@@ -1,44 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-
-	check_fixup_keyuse.xsl
-
--->
-<xsl:stylesheet version="1.0"
-	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
-	xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
-	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
-	xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
-	xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
-	xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
-
-	<!--
-		Common support functions.
-	-->
-	<xsl:import href="../_rules/check_framework.xsl"/>
-
-	
-	<!--
-        Checks for an IdP whose KeyDescriptor elements do not include a @use attribute.
-        This causes problems with the Shibboleth 1.3 SP prior to V1.3.1, which
-        interprets this as "no use permitted" rather than "either signing or encryption use
-        permitted".
-        
-        Two checks are required, one for each of the IdP role descriptors.
-    -->
-	
-	<xsl:template match="md:IDPSSODescriptor/md:KeyDescriptor[not(@use)]">
-		<xsl:call-template name="error">
-			<xsl:with-param name="m">IdP SSO KeyDescriptor lacking @use</xsl:with-param>
-		</xsl:call-template>
-	</xsl:template>
-	
-	<xsl:template match="md:AttributeAuthorityDescriptor/md:KeyDescriptor[not(@use)]">
-		<xsl:call-template name="error">
-			<xsl:with-param name="m">IdP AA KeyDescriptor lacking @use</xsl:with-param>
-		</xsl:call-template>
-	</xsl:template>
-		
-</xsl:stylesheet>
diff --git a/mdx/uk/fixup_keyuse.xsl b/mdx/uk/fixup_keyuse.xsl
deleted file mode 100644
index 126069b6..00000000
--- a/mdx/uk/fixup_keyuse.xsl
+++ /dev/null
@@ -1,52 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-
-	fixup_keyuse.xsl
-	
--->
-<xsl:stylesheet version="1.0"
-	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
-	
-	xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
-    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
-	exclude-result-prefixes="xsl">
-
-	<!--Force UTF-8 encoding for the output.-->
-	<xsl:output omit-xml-declaration="no" method="xml" encoding="UTF-8" indent="yes"/>
-
-	
-	<!--
-		Patch any @use-less KeyDescriptor elements in IdP roles
-		for the benefit of Shib SPs pre-1.3.1.
-	-->
-	<xsl:template match="md:IDPSSODescriptor/md:KeyDescriptor[not(@use)] |
-		md:AttributeAuthorityDescriptor/md:KeyDescriptor[not(@use)]">
-		<xsl:copy>
-			<xsl:attribute name="use">signing</xsl:attribute>
-			<xsl:apply-templates/>
-		</xsl:copy>
-	</xsl:template>
-	
-	
-	<!--
-        *********************************************
-        ***                                       ***
-        ***   D E F A U L T   T E M P L A T E S   ***
-        ***                                       ***
-        *********************************************
-    -->
-    
-
-	<!--By default, copy text blocks, comments and attributes unchanged.-->
-	<xsl:template match="text()|comment()|@*">
-		<xsl:copy/>
-	</xsl:template>
-	
-	<!--By default, copy all elements from the input to the output, along with their attributes and contents.-->
-	<xsl:template match="*">
-		<xsl:copy>
-			<xsl:apply-templates select="node()|@*"/>
-		</xsl:copy>
-	</xsl:template>
-	
-</xsl:stylesheet>
diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml
index e90a33c6..9a5bcb41 100644
--- a/mdx/uk/generate.xml
+++ b/mdx/uk/generate.xml
@@ -61,46 +61,6 @@
         </property>
     </bean>
     
-    
-    <!--
-        ***********************
-        ***                 ***
-        ***   F I X U P S   ***
-        ***                 ***
-        ***********************
-    -->
-    
-    <!--
-        Published UK federation metadata for consumption by federation
-        members has a couple of restrictions arising from known bugs in
-        early software.  We address these by "fixups" which transform the
-        metadata into a form which doesn't trigger the bug, and verify that
-        each constraints is met before publication.
-        
-        We apply fixups "late" in each publication pipeline, so that
-        the metadata is only transformed if required for a particular
-        output document.  Our export aggregate, for example, does
-        not have any of the fixups applied.
-        
-        In the long term, we'd hope to retire these fixups entirely as the
-        software they to cater for is retired.
-    -->
-    
-    <!--
-        fixup_keyuse
-        
-        Patch any @use-less KeyName descriptors in IdP roles
-        for the benefit of Shib SPs pre-1.3.1.
-    -->
-    <bean id="fixup_keyuse" parent="XSLTransformationStage"
-        p:XSLResource="classpath:uk/fixup_keyuse.xsl"/>
-    
-    <!--
-        check_fixup_keyuse
-    -->
-    <bean id="check_fixup_keyuse" parent="XSLValidationStage"
-        p:XSLResource="classpath:uk/check_fixup_keyuse.xsl"/>
-    
     <!--
         checkPublishable
         
@@ -120,6 +80,7 @@
         </property>
     </bean>
 
+    
     <!--
         *****************************************
         ***                                   ***
@@ -573,13 +534,11 @@
                 <ref bean="entityAttributes.whitelist"/>
                 <ref bean="uk_assemble"/>
                 <ref bean="stripWayfNamespace"/>
-                <ref bean="fixup_keyuse"/>
                 <ref bean="stripEmptyExtensions"/>
                 <ref bean="uk_finaliseFallback"/>
                 <ref bean="uk_normaliseFallback"/>
                 
                 <!-- fallback aggregate MUST pass publishability test -->
-                <ref bean="check_fixup_keyuse"/>
                 <ref bean="checkPublishable"/>
                 <ref bean="errorTerminatingFilter"/>