From c1da52998aa403a44211a3715d1e4133b3174a8b Mon Sep 17 00:00:00 2001 From: Ian Young Date: Wed, 9 Jul 2014 12:36:01 +0000 Subject: [PATCH 1/5] Remove key authorities from production aggregate. --- mdx/uk/generate.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml index a06008ad..21a438f5 100644 --- a/mdx/uk/generate.xml +++ b/mdx/uk/generate.xml @@ -312,7 +312,6 @@ - From 1f36c7d44040750a556fc9335171364ba4683500 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Wed, 9 Jul 2014 15:56:34 +0000 Subject: [PATCH 2/5] Introduce a 2048-bit compromised keys list, and use it to block a key erroneously shipped with the Shibboleth IdP 3.0.0-alpha1 release. --- mdx/_openssl_blacklists/compromised-2048.txt | 15 +++++++++++++++ mdx/common-beans.xml | 2 +- mdx/uk/beans.xml | 2 +- mdx/uk/verbs.xml | 2 +- mdx/validation-beans.xml | 13 +++++++++++++ 5 files changed, 31 insertions(+), 3 deletions(-) create mode 100644 mdx/_openssl_blacklists/compromised-2048.txt diff --git a/mdx/_openssl_blacklists/compromised-2048.txt b/mdx/_openssl_blacklists/compromised-2048.txt new file mode 100644 index 00000000..dc152d35 --- /dev/null +++ b/mdx/_openssl_blacklists/compromised-2048.txt @@ -0,0 +1,15 @@ +# +# This is a list of known-compromised 2048-bit keys in OpenSSL format. +# +# Derive new values from a private key file as follows: +# +# openssl rsa -noout -modulus -in /tmp/key.pem | sha1sum | \ +# cut -d ' ' -f 1 | cut -c 21- +# +# You can also derive a new blacklist value from an X.509 certificate as follows: +# +# openssl x509 -noout -modulus -in /tmp/cert.pem | sha1sum | \ +# cut -d ' ' -f 1 | cut -c 21- +# +# Shibboleth IdP dummy key, shipped in 3.0.0-alpha1 release +959a1a153444578d010b diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml index 31b300e1..47b4e23d 100644 --- a/mdx/common-beans.xml +++ b/mdx/common-beans.xml @@ -1052,8 +1052,8 @@ Compromised key blacklists. Again, don't need to check for keys below our minimum key size. - This currently means there are no compromised keys to check for. --> + diff --git a/mdx/uk/beans.xml b/mdx/uk/beans.xml index bd9cfab4..f8ac9411 100644 --- a/mdx/uk/beans.xml +++ b/mdx/uk/beans.xml @@ -458,8 +458,8 @@ Compromised key blacklists. Again, don't need to check for keys below our minimum key size. - This currently means there are no compromised keys to check for. --> + diff --git a/mdx/uk/verbs.xml b/mdx/uk/verbs.xml index 294733ee..d73497a7 100644 --- a/mdx/uk/verbs.xml +++ b/mdx/uk/verbs.xml @@ -321,8 +321,8 @@ Compromised key blacklists. Again, don't need to check for keys below our minimum key size. - This currently means there are no compromised keys to check for. --> + diff --git a/mdx/validation-beans.xml b/mdx/validation-beans.xml index c5f5a995..03d84531 100644 --- a/mdx/validation-beans.xml +++ b/mdx/validation-beans.xml @@ -758,6 +758,19 @@ + + + + + + + + + + + - + @@ -193,7 +193,7 @@ - + @@ -241,7 +241,7 @@ p:id="check_ukreg"> - + @@ -259,7 +259,7 @@ p:id="check_uk_keydesc_key"> - + @@ -272,7 +272,7 @@ p:id="check_uk_mdattr"> - + @@ -285,7 +285,7 @@ p:id="check_uk_mdrps"> - + @@ -298,7 +298,7 @@ p:id="check_uk_urlenc"> - + @@ -313,7 +313,7 @@ - + @@ -505,7 +505,7 @@ p:id="uk_normaliseNamespaces"> - + @@ -566,7 +566,7 @@ p:id="uk_serializeStatistics"> - + diff --git a/mdx/uk/collect.xml b/mdx/uk/collect.xml index a8ff9f36..2f5a99d9 100644 --- a/mdx/uk/collect.xml +++ b/mdx/uk/collect.xml @@ -26,7 +26,7 @@ p:id="serializeCollected"> - + diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml index 3c955f01..1f94848e 100644 --- a/mdx/uk/generate.xml +++ b/mdx/uk/generate.xml @@ -150,7 +150,7 @@ p:id="check_fixup_encmethod"> - + @@ -162,7 +162,7 @@ p:id="check_fixup_keyuse"> - + @@ -293,7 +293,7 @@ p:id="serializeUnsignedProductionAggregate"> - + @@ -342,7 +342,7 @@ p:id="serializeUnsignedWayfAggregate"> - + @@ -434,7 +434,7 @@ p:id="CDSNormaliseNamespaces"> - + @@ -461,7 +461,7 @@ p:id="serializeCDSAllAggregate"> - + @@ -516,7 +516,7 @@ p:id="uk_normaliseFallback"> - + @@ -525,7 +525,7 @@ p:id="serializeUnsignedFallbackAggregate"> - + @@ -581,7 +581,7 @@ p:id="uk_normaliseTest"> - + @@ -590,7 +590,7 @@ p:id="serializeUnsignedTestAggregate"> - + @@ -641,7 +641,7 @@ p:id="uk_normaliseExport"> - + @@ -655,7 +655,7 @@ p:id="serializeUnsignedExportAggregate"> - + @@ -762,7 +762,7 @@ p:id="serializeCMSaggregate"> - + diff --git a/mdx/uk/verbs.xml b/mdx/uk/verbs.xml index 6b033af7..21669b66 100644 --- a/mdx/uk/verbs.xml +++ b/mdx/uk/verbs.xml @@ -71,7 +71,7 @@ p:id="serialize"> - + @@ -208,7 +208,7 @@ p:id="fetchImportMetadata"> - + @@ -222,7 +222,7 @@ p:id="serializeImportedMetadata"> - + @@ -264,7 +264,7 @@ p:id="normalizeFragment"> - + @@ -352,7 +352,7 @@ p:id="serializeImported"> - + diff --git a/mdx/uk_eduserv/beans.xml b/mdx/uk_eduserv/beans.xml index 04461722..14f4cb3c 100644 --- a/mdx/uk_eduserv/beans.xml +++ b/mdx/uk_eduserv/beans.xml @@ -31,7 +31,7 @@ - + diff --git a/mdx/uk_eduserv/verbs.xml b/mdx/uk_eduserv/verbs.xml index a98e13cb..fa7c5ada 100644 --- a/mdx/uk_eduserv/verbs.xml +++ b/mdx/uk_eduserv/verbs.xml @@ -26,7 +26,7 @@ p:id="serializeImported"> - + diff --git a/mdx/us_incommon/beans.xml b/mdx/us_incommon/beans.xml index 6813e747..b64b0d3e 100644 --- a/mdx/us_incommon/beans.xml +++ b/mdx/us_incommon/beans.xml @@ -47,7 +47,7 @@ - + diff --git a/mdx/us_incommon/verbs.xml b/mdx/us_incommon/verbs.xml index d48d075a..b7d551a5 100644 --- a/mdx/us_incommon/verbs.xml +++ b/mdx/us_incommon/verbs.xml @@ -29,7 +29,7 @@ p:id="serializeImported"> - + diff --git a/mdx/validation-beans.xml b/mdx/validation-beans.xml index 16d8b3fa..c6b9b4d4 100644 --- a/mdx/validation-beans.xml +++ b/mdx/validation-beans.xml @@ -39,7 +39,7 @@ p:id="check_future_0"> - + @@ -51,7 +51,7 @@ p:id="check_future_1"> - + @@ -63,7 +63,7 @@ p:id="check_future_2"> - + @@ -75,7 +75,7 @@ p:id="check_future_3"> - + @@ -87,7 +87,7 @@ p:id="check_future_4"> - + @@ -99,7 +99,7 @@ p:id="check_future_5"> - + @@ -111,7 +111,7 @@ p:id="check_future_6"> - + @@ -123,7 +123,7 @@ p:id="check_future_7"> - + @@ -135,7 +135,7 @@ p:id="check_future_8"> - + @@ -147,7 +147,7 @@ p:id="check_future_9"> - + @@ -192,7 +192,7 @@ p:id="check_algsupport"> - + @@ -214,7 +214,7 @@ p:id="check_adfs"> - + @@ -226,7 +226,7 @@ p:id="check_bindings"> - + @@ -238,7 +238,7 @@ p:id="check_filtered"> - + @@ -250,7 +250,7 @@ p:id="check_hoksso"> - + @@ -262,7 +262,7 @@ p:id="check_idpdisc"> - + @@ -274,7 +274,7 @@ p:id="check_imported"> - + @@ -286,7 +286,7 @@ p:id="check_init"> - + @@ -298,7 +298,7 @@ p:id="check_mdiop"> - + @@ -318,7 +318,7 @@ p:id="check_mdattr"> - + @@ -340,7 +340,7 @@ p:id="check_mdrpi_xslt"> - + @@ -370,7 +370,7 @@ - + @@ -384,7 +384,7 @@ p:id="check_hasreginfo"> - + @@ -416,7 +416,7 @@ p:id="check_mdui_xslt"> - + @@ -433,7 +433,7 @@ p:id="mdui_dn_en_match"> - + @@ -448,7 +448,7 @@ p:id="mdui_dn_en_present"> - + @@ -489,7 +489,7 @@ p:id="check_misc"> - + @@ -501,7 +501,7 @@ p:id="check_namespaces"> - + @@ -515,7 +515,7 @@ p:id="check_regscope"> - + @@ -527,7 +527,7 @@ p:id="check_reqattr"> - + @@ -539,7 +539,7 @@ p:id="check_saml2int"> - + @@ -551,7 +551,7 @@ p:id="check_saml1"> - + @@ -563,7 +563,7 @@ p:id="check_saml2"> - + @@ -575,7 +575,7 @@ p:id="check_saml2meta"> - + @@ -587,7 +587,7 @@ p:id="check_shibboleth"> - + @@ -619,7 +619,7 @@ p:id="check_vhosts"> - + @@ -639,7 +639,7 @@ p:id="check_incmd"> - + @@ -659,7 +659,7 @@ p:id="check_uk_trust"> - + @@ -688,7 +688,7 @@ p:id="check_aggregate"> - + From 0947c2c3a3c01ae4e01da815fd37b4bf47cba940 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Mon, 14 Jul 2014 19:18:07 +0000 Subject: [PATCH 5/5] Rework how system properties are passed into an mda invocation. This allows new properties to be injected more easily, and allows Ant's property hierarchy (including external property files) to be used to create new ones or override old ones. --- build.xml | 37 ++++++++++++++++++++++++++++++++++--- 1 file changed, 34 insertions(+), 3 deletions(-) diff --git a/build.xml b/build.xml index d4b272fb..c896cdf9 100644 --- a/build.xml +++ b/build.xml @@ -442,6 +442,30 @@ *************************** --> + + + + + + + + + + + @@ -471,9 +495,9 @@ - - - + + + @@ -1383,7 +1407,14 @@ List all the properties ant is using. --> + All properties: + MDA properties: + + + + + \ No newline at end of file