ismisepaul · Oct 23, 2026 · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -35,6 +35,7 @@ jobs:
             src:
               - 'src/**'
               - 'pom.xml'
+              - '.mvn/**'
               - 'docker-compose.yml'
               - 'docker/**'
               - '.env'
@@ -75,6 +76,8 @@ jobs:
           cache: maven
       - name: Build Maven with Docker Profile
         run: mvn clean install -Pdocker -DskipTests -B
+      - name: Check PGP verification rejects tampered and wrongly-signed OpenSAML
+        run: bash src/test/scripts/pgp-verification-test.sh
       - name: Docker Compose Build
         run: docker compose build
       - name: Check Tomcat config placeholders were substituted

diff --git a/.mvn/maven.config b/.mvn/maven.config
@@ -0,0 +1,2 @@
+-Daether.remoteRepositoryFilter.groupId=true
+-Daether.remoteRepositoryFilter.groupId.basedir=${maven.multiModuleProjectDirectory}/.mvn/rrf
diff --git a/.mvn/pgp-keys.map b/.mvn/pgp-keys.map
@@ -0,0 +1,74 @@
+# PGP keys map for pgpverify-maven-plugin (see pom.xml). Every dependency must match a rule here.
+#
+# OpenSAML / Shibboleth come from Shibboleth's own repository (not Maven Central), so they are
+# pinned to the Shibboleth release key: Philip David Smart (Jisc), fingerprint
+# B5B5 DD33 2142 AD65 7E8D 87AC 7D27 E610 B8A3 DC52, as published at
+# https://shibboleth.net/downloads/PGP_KEYS. Never add a wildcard that could also match these
+# groups: any matching rule is enough for an artifact to pass, which would undo the pin.
+org.opensaml = 0xB5B5DD332142AD657E8D87AC7D27E610B8A3DC52
+net.shibboleth = 0xB5B5DD332142AD657E8D87AC7D27E610B8A3DC52
+
+# Everything else comes from Maven Central only (.mvn/rrf), and must carry a valid signature by
+# any key. A new dependency from an unlisted groupId fails the build ("Not allowed artifact"):
+# review it, then add its groupId here.
+com.fasterxml.jackson.core = any
+com.fasterxml.jackson.datatype = any
+com.github.ben-manes.caffeine = any
+com.github.waffle = any
+com.google.code.findbugs = any
+com.google.errorprone = any
+com.google.guava = any
+com.google.j2objc = any
+com.google.protobuf = any
+com.googlecode.json-simple = any
+com.mysql = any
+com.zaxxer = any
+commons-codec = any
+commons-io = any
+commons-logging = any
+de.mkammerer = any
+io.dropwizard.metrics = any
+io.github.cdimascio = any
+io.micrometer = any
+jakarta.activation = any
+jakarta.el = any
+jakarta.mail = any
+jakarta.servlet.jsp.jstl = any
+junit = any
+net.bytebuddy = any
+net.java.dev.jna = any
+net.sf.jtidy = any
+org.apache.commons = any
+org.apache.httpcomponents.client5 = any
+org.apache.httpcomponents.core5 = any
+org.apache.logging.log4j = any
+org.apache.santuario = any
+org.apache.velocity = any
+org.apiguardian = any
+org.bouncycastle = any
+org.checkerframework = any
+org.cryptacular = any
+org.eclipse.angus = any
+org.glassfish = any
+org.glassfish.web = any
+org.hamcrest = any
+org.jetbrains = any
+org.jetbrains.kotlin = any
+org.json = any
+org.jsoup = any
+org.jspecify = any
+org.junit.jupiter = any
+org.junit.platform = any
+org.mariadb.jdbc = any
+org.mockito = any
+org.mongodb = any
+org.objenesis = any
+org.opentest4j = any
+org.owasp.encoder = any
+org.pac4j = any
+org.slf4j = any
+org.springframework = any
+
+# Unsigned legacy artifact pulled in via json-simple -> junit 4.10 (to be removed, see #944).
+# Exact version only.
+org.hamcrest:hamcrest-core:1.1 = noSig
diff --git a/.mvn/rrf/groupId-shibboleth-releases.txt b/.mvn/rrf/groupId-shibboleth-releases.txt
@@ -0,0 +1,2 @@
+net.shibboleth
+org.opensaml
diff --git a/pom.xml b/pom.xml
@@ -13,15 +13,66 @@
 		<skipTests>false</skipTests>
 		<skipITs>${skipTests}</skipITs>
 		<skipUTs>${skipTests}</skipUTs>
-		<!-- Spring is only used for the servlet mocks in spring-test. Spring 7
-		     tracks Jakarta EE 11 (Servlet 6.1), matching the Tomcat 11 runtime. -->
+		<!-- Spring 7 (Jakarta EE 11 / Servlet 6.1, matching Tomcat 11). Used at runtime by
+		     pac4j-saml and SamlSso (spring-core Resource), and in tests for spring-test's
+		     servlet mocks. -->
 		<spring.version>7.0.10</spring.version>
+		<pac4j.version>6.6.0</pac4j.version>
+		<!-- Overridable only so src/test/scripts/pgp-verification-test.sh can try a wrong key -->
+		<pgp.keysMap>${project.basedir}/.mvn/pgp-keys.map</pgp.keysMap>
 	</properties>
 
+	<repositories>
+		<!-- OpenSAML 5 (pulled in by pac4j-saml) is published only to Shibboleth's
+		     repository, not Maven Central. pac4j-saml's POM declares it too; it is
+		     declared here so the dependency is visible and checksums are enforced. -->
+		<repository>
+			<id>shibboleth-releases</id>
+			<name>Shibboleth Releases Repository</name>
+			<url>https://build.shibboleth.net/maven/releases/</url>
+			<releases>
+				<enabled>true</enabled>
+				<checksumPolicy>fail</checksumPolicy>
+			</releases>
+			<snapshots>
+				<enabled>false</enabled>
+			</snapshots>
+		</repository>
+	</repositories>
+
+	<dependencyManagement>
+		<dependencies>
+			<!-- pac4j-saml pulls in Spring at compile scope; keep every Spring
+			     module (direct or transitive) on one version. -->
+			<dependency>
+				<groupId>org.springframework</groupId>
+				<artifactId>spring-framework-bom</artifactId>
+				<version>${spring.version}</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
+
 	<dependencies>
-		<!-- com.onelogin:java-saml removed: it has no Jakarta release. SAML SSO is
-		     unavailable at this step of the Jakarta migration (#861) and is
-		     reimplemented on pac4j-saml later in the stack. -->
+		<!-- SAML SSO (was com.onelogin:java-saml, which has no Jakarta release).
+		     pac4j-saml 6.x is Jakarta-native and built on OpenSAML 5. -->
+		<dependency>
+			<groupId>org.pac4j</groupId>
+			<artifactId>pac4j-saml</artifactId>
+			<version>${pac4j.version}</version>
+		</dependency>
+		<dependency>
+			<groupId>org.pac4j</groupId>
+			<artifactId>pac4j-jakartaee</artifactId>
+			<version>${pac4j.version}</version>
+		</dependency>
+		<!-- Routes pac4j / OpenSAML SLF4J logging into log4j2 -->
+		<dependency>
+			<groupId>org.apache.logging.log4j</groupId>
+			<artifactId>log4j-slf4j2-impl</artifactId>
+			<version>2.25.4</version>
+		</dependency>
 		<dependency>
 			<groupId>de.mkammerer</groupId>
 			<artifactId>argon2-jvm</artifactId>
@@ -48,7 +99,7 @@
 		<dependency>
 			<groupId>commons-io</groupId>
 			<artifactId>commons-io</artifactId>
-		<version>2.18.0</version>
+		<version>2.22.0</version>
 	</dependency>
 
 	<!-- https://mvnrepository.com/artifact/commons-codec/commons-codec -->
@@ -155,13 +206,6 @@
 			<scope>test</scope>
 		</dependency>
 
-		<!-- https://mvnrepository.com/artifact/org.springframework/spring-core -->
-		<dependency>
-			<groupId>org.springframework</groupId>
-			<artifactId>spring-core</artifactId>
-			<version>${spring.version}</version>
-			<scope>test</scope>
-		</dependency>
 
 		<!-- spring-mock:2.0.8 removed: javax-era standalone mock (2008).
 		     Spring 7 spring-test provides the Jakarta MockHttpServletRequest /
@@ -401,6 +445,51 @@
 		</resources>
 
 		<plugins>
+			<!-- Must stay first: runs before anything resolves dependencies -->
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-enforcer-plugin</artifactId>
+				<version>3.6.3</version>
+				<executions>
+					<execution>
+						<id>require-maven-for-repository-filter</id>
+						<goals>
+							<goal>enforce</goal>
+						</goals>
+						<configuration>
+							<rules>
+								<!-- Maven before 3.9.2 does not expand the path in .mvn/maven.config,
+								     so the Shibboleth repository filter silently does nothing -->
+								<requireMavenVersion>
+									<version>[3.9.2,)</version>
+									<message>Maven 3.9.2 or newer is required: older versions ignore the Shibboleth repository restriction in .mvn/maven.config.</message>
+								</requireMavenVersion>
+							</rules>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
+			<plugin>
+				<groupId>org.simplify4u.plugins</groupId>
+				<artifactId>pgpverify-maven-plugin</artifactId>
+				<version>1.19.1</version>
+				<executions>
+					<execution>
+						<goals>
+							<goal>check</goal>
+						</goals>
+					</execution>
+				</executions>
+				<configuration>
+					<keysMapLocation>${pgp.keysMap}</keysMapLocation>
+					<verifyPomFiles>true</verifyPomFiles>
+					<!-- Re-verify every build: the default skips verification when the
+					     artifact list is unchanged, which would miss a jar tampered with
+					     in the local repository after a successful run -->
+					<disableChecksum>true</disableChecksum>
+					<pgpKeyServer>hkps://keys.openpgp.org,hkps://keyserver.ubuntu.com</pgpKeyServer>
+				</configuration>
+			</plugin>
 			<plugin>
 				<groupId>org.codehaus.mojo</groupId>
 				<artifactId>properties-maven-plugin</artifactId>
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		-Daether.remoteRepositoryFilter.groupId=true
		-Daether.remoteRepositoryFilter.groupId.basedir=${maven.multiModuleProjectDirectory}/.mvn/rrf
Comment thread ismisepaul marked this conversation as resolved.