From b51f35729334bc3cd9835c59074db6715dbd14a7 Mon Sep 17 00:00:00 2001
From: David Shafer <dshafer@internet2.edu>
Date: Tue, 4 Dec 2018 15:37:56 -0600
Subject: [PATCH 1/5] Create new pipeline for MDQ and IdP-only aggregate

---
 build.xml                         |  28 ++++
 mdx/incommon/mdq-new-localkey.xml | 223 ++++++++++++++++++++++++++++++
 2 files changed, 251 insertions(+)
 create mode 100644 mdx/incommon/mdq-new-localkey.xml

diff --git a/build.xml b/build.xml
index 1c8348cf..a39183aa 100644
--- a/build.xml
+++ b/build.xml
@@ -2655,6 +2655,34 @@
         <echo>Generation complete.</echo>
     </target>
 
+    <!--
+        inc.mdq-new.localkey
+
+        Generate all required metadata for the InCommon MDQ service
+        using the localkey configuration:
+
+          * Per-entity metadata
+          * InCommon aggregate
+          * InCommon IdP-only aggregate
+
+        Properties:
+
+        Set sign.uk.keyPassword (note the slightly anomalous "uk" in that
+        identifier) to set the password to access the key resource. If not set,
+        this will be prompted for.
+    -->
+    <target name="inc.mdq-new.localkey" depends="get.sign.uk.keyPassword">
+      <property name="mda.mdq.input" value="${mda.inc.imported.xml}"/>
+      <property name="mda.sign.keyPassword" value="${sign.uk.keyPassword}"/>
+      <echo>Generating per-entity metadata in ${mda.mdq.output}</echo>
+      <echo>    (IdP-only aggregate in ${mda.mdq.output}/idps.xml)</echo>
+      <echo>    from unsigned aggregate in ${mda.mdq.input}</echo>
+      <delete dir="${mdq.output.dir}" quiet="true"/>
+      <mkdir dir="${mdq.output.dir}"/>
+      <CHANNEL.do channel="incommon" verb="mdq-new-localkey"/>
+      <echo>Generation complete.</echo>
+    </target>
+
     <!--
         inc.mdq.generate.localkey
 
diff --git a/mdx/incommon/mdq-new-localkey.xml b/mdx/incommon/mdq-new-localkey.xml
new file mode 100644
index 00000000..49174673
--- /dev/null
+++ b/mdx/incommon/mdq-new-localkey.xml
@@ -0,0 +1,223 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Generate and sign per-entity metadata using a local private key resource.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+    default-lazy-init="true"
+    xmlns:c="http://www.springframework.org/schema/c"
+    xmlns:p="http://www.springframework.org/schema/p"
+    xmlns:util="http://www.springframework.org/schema/util"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="
+        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">
+
+    <!--
+        Import commonly used beans.
+    -->
+    <import resource="classpath:common-beans.xml"/>
+
+    <!--
+        Import inc-mda beans. (from import.xml)
+    -->
+    <import resource="classpath:uk/org/iay/incommon/mda/beans.xml"/>
+
+    <!--
+        Import channel-specific beans.
+    -->
+    <import resource="classpath:incommon/beans.xml"/>
+
+    <!-- This bean MUST be called "conversionService" to work properly. -->
+    <bean id="conversionService" class="org.springframework.context.support.ConversionServiceFactoryBean">
+        <property name="converters">
+            <set>
+                <bean class="net.shibboleth.ext.spring.config.DurationToLongConverter" />
+                <bean class="net.shibboleth.ext.spring.config.StringToIPRangeConverter" />
+                <bean class="net.shibboleth.ext.spring.config.BooleanToPredicateConverter" />
+                <bean class="net.shibboleth.ext.spring.config.StringBooleanToPredicateConverter" />
+                <bean class="net.shibboleth.ext.spring.config.StringToResourceConverter" />
+            </set>
+        </property>
+    </bean>
+
+    <!--
+        ***********************************************************
+        ***                                                     ***
+        ***   C O M M O N   O U T P U T   P R O C E S S I N G   ***
+        ***                                                     ***
+        ***********************************************************
+    -->
+
+    <bean id="common.output" parent="mda.CompositeStage">
+        <property name="composedStages">
+            <list>
+                <!-- Construct a new aggregate from the collection of entities. -->
+                <bean id="inc.assemble" parent="mda.EntitiesDescriptorAssemblerStage">
+                    <property name="itemOrderingStrategy">
+                        <bean parent="inc.InCommonEntityOrderingStrategy"
+                            c:_-ref="us_incommon_registrar"/>
+                    </property>
+                </bean>
+
+                <!-- Apply final tweaks to the aggregate. -->
+                <bean id="finalise" parent="incommon_finalise_parent">
+                    <property name="transformParameters">
+                        <map>
+                            <entry key="extraText" value="Contains InCommon and eduGAIN metadata"/>
+                            <entry key="publisher" value-ref="us_incommon_registrar"/>
+                        </map>
+                    </property>
+                </bean>
+
+                <!-- Normalise the use of namespace prefixes in the resulting XML document. -->
+                <bean id="normalise" parent="mda.XSLTransformationStage"
+                    p:XSLResource="classpath:incommon/ns_norm_import.xsl"/>
+            </list>
+        </property>
+    </bean>
+
+    <!--
+        *****************************************
+        ***                                   ***
+        ***   I D P - O N L Y   O U T P U T   ***
+        ***                                   ***
+        *****************************************
+    -->
+
+    <!--
+        idp.serialize
+
+        Writes the IdP-only aggregate out to a file.
+    -->
+    <bean id="idp.serialize" parent="mda.SerializationStage">
+        <property name="serializer" ref="serializer"/>
+        <property name="outputFile">
+            <bean parent="File">
+                <constructor-arg value="${mdq.output}/idps.xml"/>
+            </bean>
+        </property>
+    </bean>
+
+    <!--
+        idp.selector
+
+        Entities in the IdP-only aggregate are restricted to identity providers.
+    -->
+    <bean id="idp.selector" parent="mda.XPathItemSelectionStrategy">
+        <constructor-arg value="/md:EntityDescriptor[md:IDPSSODescriptor]"/>
+        <constructor-arg ref="commonNamespaces"/>
+    </bean>
+
+    <!--
+        idp.pipeline
+
+        Generates the IdP-only aggregate. The selector has already taken care
+        of removing non-IdP entities.
+    -->
+    <bean id="idp.pipeline" parent="mda.SimplePipeline">
+        <property name="stages">
+            <list>
+                <!-- Perform common steps in constructing an output aggregate. -->
+                <ref bean="common.output"/>
+
+                <!-- Write the resulting aggregate out to a file. -->
+                <ref bean="idp.serialize"/>
+            </list>
+        </property>
+    </bean>
+
+    <!--
+        Generate all required metadata for the InCommon MDQ service
+        using the localkey configuration:
+
+          * Per-entity metadata
+          * InCommon aggregate
+          * InCommon IdP-only aggregate
+
+        Properties:
+
+        Set sign.uk.keyPassword (note the slightly anomalous "uk" in that
+        identifier) to set the password to access the key resource. If not set,
+        this will be prompted for.
+    -->
+    <bean id="mdq-new-localkey" parent="mda.SimplePipeline">
+        <property name="stages">
+            <list>
+                <!--
+                    Start with the unsigned production aggregate.
+                    TODO: For now, we're actually starting with a signed aggregate;
+                      this pipeline isn't configured to check the signature
+                -->
+                <bean id="production_aggregate" parent="mda.DOMResourceSourceStage">
+                    <property name="parserPool" ref="parserPool"/>
+                    <property name="DOMResource">
+                        <bean parent="FileSystemResource" c:_0="${mdq.input}"/>
+                    </property>
+                </bean>
+
+                <!-- Break down into individual entities. -->
+                <ref bean="disassemble"/>
+
+                <!-- Include a default registrationAuthority for each entity. -->
+                <ref bean="us_incommon_default_regauth"/>
+
+                <!-- Populate identifiers for future actions. -->
+                <ref bean="populateItemIds"/>
+                <ref bean="populateRegistrationAuthorities"/>
+
+                <!-- Discard entities in the InCommon entity blacklist. -->
+                <ref bean="remove_blacklisted_incommon_entities"/>
+
+                <!-- Fork new pipelines to generate special aggregates. -->
+                <bean id="demux" parent="mda.PipelineDemultiplexerStage">
+                    <property name="pipelineAndSelectionStrategies">
+                        <list>
+                            <!-- IdP-only aggregate. -->
+                            <bean class="net.shibboleth.utilities.java.support.collection.Pair">
+                                <constructor-arg ref="idp.pipeline"/>
+                                <constructor-arg ref="idp.selector"/>
+                            </bean>
+                        </list>
+                    </property>
+                    <property name="waitingForPipelines" value="true"/>
+                </bean>
+
+                <!-- Set ID, cacheDuration and validUntil attributes. -->
+                <bean parent="mda.GenerateIdStage"/>
+                <bean parent="mda.SetValidUntilStage" p:validityDuration="P14D"/>
+
+                <!-- Identity transform fixes signing issues. -->
+                <bean parent="mda.XSLTransformationStage"
+                    p:XSLResource="classpath:identity.xsl"/>
+
+                <!-- Sign each item. -->
+                <bean id="perform.signature" parent="mda.XMLSignatureSigningStage">
+                    <property name="privateKey">
+                        <bean parent="PrivateKeyFactoryBean"
+                            p:resource="${sign.keyResource}"
+                            p:privateKeyPassword="${sign.keyPassword}"
+                        />
+                    </property>
+                </bean>
+
+                <!-- Write individual entity documents to files. -->
+                <bean id="write.perentity" parent="mda.MultiOutputSerializationStage">
+                    <property name="serializer" ref="serializer"/>
+                    <property name="outputStrategy">
+                        <bean parent="mda.FilesInDirectoryMultiOutputStrategy" p:nameSuffix=".xml">
+                            <property name="directory">
+                                <bean parent="File" c:_="${mdq.output}"/>
+                            </property>
+                            <property name="nameTransformer">
+                                <bean parent="mda.PathSegmentStringTransformer"/>
+                            </property>
+                        </bean>
+                    </property>
+                </bean>
+
+            </list>
+        </property>
+
+    </bean>
+
+</beans>

From 581aaca492e122bb216c1f57fb85713ee798459e Mon Sep 17 00:00:00 2001
From: David Shafer <dshafer@internet2.edu>
Date: Tue, 4 Dec 2018 15:56:33 -0600
Subject: [PATCH 2/5] Move IdP-only aggregate to idps/all.xml

---
 build.xml                         | 1 +
 mdx/incommon/mdq-new-localkey.xml | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/build.xml b/build.xml
index a39183aa..e9b80c8c 100644
--- a/build.xml
+++ b/build.xml
@@ -2679,6 +2679,7 @@
       <echo>    from unsigned aggregate in ${mda.mdq.input}</echo>
       <delete dir="${mdq.output.dir}" quiet="true"/>
       <mkdir dir="${mdq.output.dir}"/>
+      <mkdir dir="${mdq.output.dir}/idps"/>
       <CHANNEL.do channel="incommon" verb="mdq-new-localkey"/>
       <echo>Generation complete.</echo>
     </target>
diff --git a/mdx/incommon/mdq-new-localkey.xml b/mdx/incommon/mdq-new-localkey.xml
index 49174673..d75071db 100644
--- a/mdx/incommon/mdq-new-localkey.xml
+++ b/mdx/incommon/mdq-new-localkey.xml
@@ -93,7 +93,7 @@
         <property name="serializer" ref="serializer"/>
         <property name="outputFile">
             <bean parent="File">
-                <constructor-arg value="${mdq.output}/idps.xml"/>
+                <constructor-arg value="${mdq.output}/idps/all.xml"/>
             </bean>
         </property>
     </bean>

From cf3f29c58c620be1ca3cd87c72c7070872d26d40 Mon Sep 17 00:00:00 2001
From: David Shafer <dshafer@internet2.edu>
Date: Wed, 5 Dec 2018 14:11:55 -0600
Subject: [PATCH 3/5] Working on IdP-only aggregate

---
 build.xml                         |  33 ++++-
 mdx/incommon/mdq-new-cloudhsm.xml | 224 ++++++++++++++++++++++++++++++
 2 files changed, 256 insertions(+), 1 deletion(-)
 create mode 100644 mdx/incommon/mdq-new-cloudhsm.xml

diff --git a/build.xml b/build.xml
index e9b80c8c..b9b670b2 100644
--- a/build.xml
+++ b/build.xml
@@ -2662,7 +2662,6 @@
         using the localkey configuration:
 
           * Per-entity metadata
-          * InCommon aggregate
           * InCommon IdP-only aggregate
 
         Properties:
@@ -2684,6 +2683,38 @@
       <echo>Generation complete.</echo>
     </target>
 
+    <!--
+        inc.mdq-new.cloudhsm
+
+        Generate all required metadata for the InCommon MDQ service
+        using the cloudhsm configuration:
+
+          * Per-entity metadata
+          * InCommon IdP-only aggregate
+
+        Properties:
+
+        Set sign.uk.keyPassword (note the slightly anomalous "uk" in that
+        identifier) to set the password to access the key resource. If not set,
+        this will be prompted for.
+    -->
+    <target name="inc.mdq-new.cloudhsm" depends="get.sign.uk.keyPassword">
+      <property name="mda.mdq.input" value="${mda.inc.imported.xml}"/>
+      <property name="mda.sign.keyHandle" value="${sign.keyHandle}"/>
+      <property name="mda.sign.keyUser" value="${sign.keyUser}"/>
+      <property name="mda.sign.keyPassword" value="${sign.keyPassword}"/>
+      <property name="mda.classpath.extra" value="inc-mda-cloudhsm"/>
+      <property name="mda.jni.path" value="/opt/cloudhsm/lib"/>
+      <echo>Generating per-entity metadata in ${mda.mdq.output}</echo>
+      <echo>    (IdP-only aggregate in ${mda.mdq.output}/idps.xml)</echo>
+      <echo>    from unsigned aggregate in ${mda.mdq.input}</echo>
+      <delete dir="${mdq.output.dir}" quiet="true"/>
+      <mkdir dir="${mdq.output.dir}"/>
+      <mkdir dir="${mdq.output.dir}/idps"/>
+      <CHANNEL.do channel="incommon" verb="mdq-new-cloudhsm"/>
+      <echo>Generation complete.</echo>
+    </target>
+
     <!--
         inc.mdq.generate.localkey
 
diff --git a/mdx/incommon/mdq-new-cloudhsm.xml b/mdx/incommon/mdq-new-cloudhsm.xml
new file mode 100644
index 00000000..a8519eb6
--- /dev/null
+++ b/mdx/incommon/mdq-new-cloudhsm.xml
@@ -0,0 +1,224 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Generate and sign per-entity metadata using a local private key resource.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+    default-lazy-init="true"
+    xmlns:c="http://www.springframework.org/schema/c"
+    xmlns:p="http://www.springframework.org/schema/p"
+    xmlns:util="http://www.springframework.org/schema/util"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="
+        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">
+
+    <!--
+        Import commonly used beans.
+    -->
+    <import resource="classpath:common-beans.xml"/>
+
+    <!--
+        Import inc-mda beans. (from import.xml)
+    -->
+    <import resource="classpath:uk/org/iay/incommon/mda/beans.xml"/>
+
+    <!--
+        Import channel-specific beans.
+    -->
+    <import resource="classpath:incommon/beans.xml"/>
+
+    <!-- This bean MUST be called "conversionService" to work properly. -->
+    <bean id="conversionService" class="org.springframework.context.support.ConversionServiceFactoryBean">
+        <property name="converters">
+            <set>
+                <bean class="net.shibboleth.ext.spring.config.DurationToLongConverter" />
+                <bean class="net.shibboleth.ext.spring.config.StringToIPRangeConverter" />
+                <bean class="net.shibboleth.ext.spring.config.BooleanToPredicateConverter" />
+                <bean class="net.shibboleth.ext.spring.config.StringBooleanToPredicateConverter" />
+                <bean class="net.shibboleth.ext.spring.config.StringToResourceConverter" />
+            </set>
+        </property>
+    </bean>
+
+    <!--
+        ***********************************************************
+        ***                                                     ***
+        ***   C O M M O N   O U T P U T   P R O C E S S I N G   ***
+        ***                                                     ***
+        ***********************************************************
+    -->
+
+    <bean id="common.output" parent="mda.CompositeStage">
+        <property name="composedStages">
+            <list>
+                <!-- Construct a new aggregate from the collection of entities. -->
+                <bean id="inc.assemble" parent="mda.EntitiesDescriptorAssemblerStage">
+                    <property name="itemOrderingStrategy">
+                        <bean parent="inc.InCommonEntityOrderingStrategy"
+                            c:_-ref="us_incommon_registrar"/>
+                    </property>
+                </bean>
+
+                <!-- Apply final tweaks to the aggregate. -->
+                <bean id="finalise" parent="incommon_finalise_parent">
+                    <property name="transformParameters">
+                        <map>
+                            <entry key="extraText" value="Contains InCommon and eduGAIN metadata"/>
+                            <entry key="publisher" value-ref="us_incommon_registrar"/>
+                        </map>
+                    </property>
+                </bean>
+
+                <!-- Normalise the use of namespace prefixes in the resulting XML document. -->
+                <bean id="normalise" parent="mda.XSLTransformationStage"
+                    p:XSLResource="classpath:incommon/ns_norm_import.xsl"/>
+            </list>
+        </property>
+    </bean>
+
+    <!--
+        *****************************************
+        ***                                   ***
+        ***   I D P - O N L Y   O U T P U T   ***
+        ***                                   ***
+        *****************************************
+    -->
+
+    <!--
+        idp.serialize
+
+        Writes the IdP-only aggregate out to a file.
+    -->
+    <bean id="idp.serialize" parent="mda.SerializationStage">
+        <property name="serializer" ref="serializer"/>
+        <property name="outputFile">
+            <bean parent="File">
+                <constructor-arg value="${mdq.output}/idps/all.xml"/>
+            </bean>
+        </property>
+    </bean>
+
+    <!--
+        idp.selector
+
+        Entities in the IdP-only aggregate are restricted to identity providers.
+    -->
+    <bean id="idp.selector" parent="mda.XPathItemSelectionStrategy">
+        <constructor-arg value="/md:EntityDescriptor[md:IDPSSODescriptor]"/>
+        <constructor-arg ref="commonNamespaces"/>
+    </bean>
+
+    <!--
+        idp.pipeline
+
+        Generates the IdP-only aggregate. The selector has already taken care
+        of removing non-IdP entities.
+    -->
+    <bean id="idp.pipeline" parent="mda.SimplePipeline">
+        <property name="stages">
+            <list>
+                <!-- Perform common steps in constructing an output aggregate. -->
+                <ref bean="common.output"/>
+
+                <!-- Write the resulting aggregate out to a file. -->
+                <ref bean="idp.serialize"/>
+            </list>
+        </property>
+    </bean>
+
+    <!--
+        Generate all required metadata for the InCommon MDQ service
+        using the localkey configuration:
+
+          * Per-entity metadata
+          * InCommon aggregate
+          * InCommon IdP-only aggregate
+
+        Properties:
+
+        Set sign.uk.keyPassword (note the slightly anomalous "uk" in that
+        identifier) to set the password to access the key resource. If not set,
+        this will be prompted for.
+    -->
+    <bean id="mdq-new-cloudhsm" parent="mda.SimplePipeline">
+        <property name="stages">
+            <list>
+                <!--
+                    Start with the unsigned production aggregate.
+                    TODO: For now, we're actually starting with a signed aggregate;
+                      this pipeline isn't configured to check the signature
+                -->
+                <bean id="production_aggregate" parent="mda.DOMResourceSourceStage">
+                    <property name="parserPool" ref="parserPool"/>
+                    <property name="DOMResource">
+                        <bean parent="FileSystemResource" c:_0="${mdq.input}"/>
+                    </property>
+                </bean>
+
+                <!-- Break down into individual entities. -->
+                <ref bean="disassemble"/>
+
+                <!-- Include a default registrationAuthority for each entity. -->
+                <ref bean="us_incommon_default_regauth"/>
+
+                <!-- Populate identifiers for future actions. -->
+                <ref bean="populateItemIds"/>
+                <ref bean="populateRegistrationAuthorities"/>
+
+                <!-- Discard entities in the InCommon entity blacklist. -->
+                <ref bean="remove_blacklisted_incommon_entities"/>
+
+                <!-- Fork new pipelines to generate special aggregates. -->
+                <bean id="demux" parent="mda.PipelineDemultiplexerStage">
+                    <property name="pipelineAndSelectionStrategies">
+                        <list>
+                            <!-- IdP-only aggregate. -->
+                            <bean class="net.shibboleth.utilities.java.support.collection.Pair">
+                                <constructor-arg ref="idp.pipeline"/>
+                                <constructor-arg ref="idp.selector"/>
+                            </bean>
+                        </list>
+                    </property>
+                    <property name="waitingForPipelines" value="true"/>
+                </bean>
+
+                <!-- Set ID, cacheDuration and validUntil attributes. -->
+                <bean parent="mda.GenerateIdStage"/>
+                <bean parent="mda.SetValidUntilStage" p:validityDuration="P14D"/>
+
+                <!-- Identity transform fixes signing issues. -->
+                <bean parent="mda.XSLTransformationStage"
+                    p:XSLResource="classpath:identity.xsl"/>
+
+                <!-- Sign each item. -->
+                <bean id="perform.signature" parent="mda.XMLSignatureSigningStage">
+                    <property name="privateKey">
+                      <bean class="uk.org.iay.incommon.mda.cloudhsm.CaviumPrivateKeyFactoryBean"
+                          p:username="${sign.keyUser}"
+                          p:password="${sign.keyPassword}"
+                          p:keyHandle="${sign.keyHandle}"
+                      />
+                    </property>
+                </bean>
+
+                <!-- Write individual entity documents to files. -->
+                <bean id="write.perentity" parent="mda.MultiOutputSerializationStage">
+                    <property name="serializer" ref="serializer"/>
+                    <property name="outputStrategy">
+                        <bean parent="mda.FilesInDirectoryMultiOutputStrategy" p:nameSuffix=".xml">
+                            <property name="directory">
+                                <bean parent="File" c:_="${mdq.output}"/>
+                            </property>
+                            <property name="nameTransformer">
+                                <bean parent="mda.PathSegmentStringTransformer"/>
+                            </property>
+                        </bean>
+                    </property>
+                </bean>
+
+            </list>
+        </property>
+
+    </bean>
+
+</beans>

From 7d60e86f23e23c8f54abec686b3a59f5b9173538 Mon Sep 17 00:00:00 2001
From: David Shafer <dshafer@internet2.edu>
Date: Fri, 7 Dec 2018 14:47:45 -0600
Subject: [PATCH 4/5] Rename mdq-new-* to mdq-combined-*

---
 build.xml                                            | 12 ++++++------
 ...dq-new-cloudhsm.xml => mdq-combined-cloudhsm.xml} |  2 +-
 ...dq-new-localkey.xml => mdq-combined-localkey.xml} |  2 +-
 3 files changed, 8 insertions(+), 8 deletions(-)
 rename mdx/incommon/{mdq-new-cloudhsm.xml => mdq-combined-cloudhsm.xml} (99%)
 rename mdx/incommon/{mdq-new-localkey.xml => mdq-combined-localkey.xml} (99%)

diff --git a/build.xml b/build.xml
index b9b670b2..ba49a694 100644
--- a/build.xml
+++ b/build.xml
@@ -2656,7 +2656,7 @@
     </target>
 
     <!--
-        inc.mdq-new.localkey
+        inc.mdq-combined.localkey
 
         Generate all required metadata for the InCommon MDQ service
         using the localkey configuration:
@@ -2670,7 +2670,7 @@
         identifier) to set the password to access the key resource. If not set,
         this will be prompted for.
     -->
-    <target name="inc.mdq-new.localkey" depends="get.sign.uk.keyPassword">
+    <target name="inc.mdq.combined.localkey" depends="get.sign.uk.keyPassword">
       <property name="mda.mdq.input" value="${mda.inc.imported.xml}"/>
       <property name="mda.sign.keyPassword" value="${sign.uk.keyPassword}"/>
       <echo>Generating per-entity metadata in ${mda.mdq.output}</echo>
@@ -2679,12 +2679,12 @@
       <delete dir="${mdq.output.dir}" quiet="true"/>
       <mkdir dir="${mdq.output.dir}"/>
       <mkdir dir="${mdq.output.dir}/idps"/>
-      <CHANNEL.do channel="incommon" verb="mdq-new-localkey"/>
+      <CHANNEL.do channel="incommon" verb="mdq-combined-localkey"/>
       <echo>Generation complete.</echo>
     </target>
 
     <!--
-        inc.mdq-new.cloudhsm
+        inc.mdq.combined.cloudhsm
 
         Generate all required metadata for the InCommon MDQ service
         using the cloudhsm configuration:
@@ -2698,7 +2698,7 @@
         identifier) to set the password to access the key resource. If not set,
         this will be prompted for.
     -->
-    <target name="inc.mdq-new.cloudhsm" depends="get.sign.uk.keyPassword">
+    <target name="inc.mdq.combined.cloudhsm" depends="get.sign.uk.keyPassword">
       <property name="mda.mdq.input" value="${mda.inc.imported.xml}"/>
       <property name="mda.sign.keyHandle" value="${sign.keyHandle}"/>
       <property name="mda.sign.keyUser" value="${sign.keyUser}"/>
@@ -2711,7 +2711,7 @@
       <delete dir="${mdq.output.dir}" quiet="true"/>
       <mkdir dir="${mdq.output.dir}"/>
       <mkdir dir="${mdq.output.dir}/idps"/>
-      <CHANNEL.do channel="incommon" verb="mdq-new-cloudhsm"/>
+      <CHANNEL.do channel="incommon" verb="mdq-combined-cloudhsm"/>
       <echo>Generation complete.</echo>
     </target>
 
diff --git a/mdx/incommon/mdq-new-cloudhsm.xml b/mdx/incommon/mdq-combined-cloudhsm.xml
similarity index 99%
rename from mdx/incommon/mdq-new-cloudhsm.xml
rename to mdx/incommon/mdq-combined-cloudhsm.xml
index a8519eb6..6b759d67 100644
--- a/mdx/incommon/mdq-new-cloudhsm.xml
+++ b/mdx/incommon/mdq-combined-cloudhsm.xml
@@ -140,7 +140,7 @@
         identifier) to set the password to access the key resource. If not set,
         this will be prompted for.
     -->
-    <bean id="mdq-new-cloudhsm" parent="mda.SimplePipeline">
+    <bean id="mdq-combined-cloudhsm" parent="mda.SimplePipeline">
         <property name="stages">
             <list>
                 <!--
diff --git a/mdx/incommon/mdq-new-localkey.xml b/mdx/incommon/mdq-combined-localkey.xml
similarity index 99%
rename from mdx/incommon/mdq-new-localkey.xml
rename to mdx/incommon/mdq-combined-localkey.xml
index d75071db..a78dd2e9 100644
--- a/mdx/incommon/mdq-new-localkey.xml
+++ b/mdx/incommon/mdq-combined-localkey.xml
@@ -140,7 +140,7 @@
         identifier) to set the password to access the key resource. If not set,
         this will be prompted for.
     -->
-    <bean id="mdq-new-localkey" parent="mda.SimplePipeline">
+    <bean id="mdq-combined-localkey" parent="mda.SimplePipeline">
         <property name="stages">
             <list>
                 <!--

From 4cc8432c55f147a2d51a40ae575c7f176d6352fa Mon Sep 17 00:00:00 2001
From: David Shafer <dshafer@internet2.edu>
Date: Mon, 28 Jan 2019 11:53:39 -0600
Subject: [PATCH 5/5] Reference JIRA issues in TODOs

---
 mdx/incommon/mdq-combined-cloudhsm.xml | 2 +-
 mdx/incommon/mdq-combined-localkey.xml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/mdx/incommon/mdq-combined-cloudhsm.xml b/mdx/incommon/mdq-combined-cloudhsm.xml
index 6b759d67..6a54503d 100644
--- a/mdx/incommon/mdq-combined-cloudhsm.xml
+++ b/mdx/incommon/mdq-combined-cloudhsm.xml
@@ -145,7 +145,7 @@
             <list>
                 <!--
                     Start with the unsigned production aggregate.
-                    TODO: For now, we're actually starting with a signed aggregate;
+                    TODO: (MDQ-177) For now, we're actually starting with a signed aggregate;
                       this pipeline isn't configured to check the signature
                 -->
                 <bean id="production_aggregate" parent="mda.DOMResourceSourceStage">
diff --git a/mdx/incommon/mdq-combined-localkey.xml b/mdx/incommon/mdq-combined-localkey.xml
index a78dd2e9..5e686953 100644
--- a/mdx/incommon/mdq-combined-localkey.xml
+++ b/mdx/incommon/mdq-combined-localkey.xml
@@ -145,7 +145,7 @@
             <list>
                 <!--
                     Start with the unsigned production aggregate.
-                    TODO: For now, we're actually starting with a signed aggregate;
+                    TODO: (MDQ-177) For now, we're actually starting with a signed aggregate;
                       this pipeline isn't configured to check the signature
                 -->
                 <bean id="production_aggregate" parent="mda.DOMResourceSourceStage">