Have we lost the commit history from picketlink-idm? The new version: https://github.com/picketlink/picketlink/commits/master The old version: https://github.com/abstractj/picketlink-idm/commits/master Sad panda :( -- "The measure of a man is what he does with power" - Plato - @abstractj - Volenti Nihil Difficile On Monday, October 1, 2012 at 7:30 PM, Shane Bryzak wrote: > In the interests of presenting a clear message to our developers, one > of the steps we'll be taking is to consolidate the various PicketLink > projects into a single project and presenting this as the "go to" > solution for application security. For now I've merged the CDI and > IDM subprojects (these are now submodules of the PicketLink project, > with "CDI" renamed to "Core") and the plan is to eventually merge the > social and federation modules also. > > You can find the new GitHub repository here: > https://github.com/picketlink (renamed from picketlink-cdi) and the > picketlink-idm repository has now been deleted. For anyone working > on these modules, please use the new repository from now on. > > Thanks! > Shane > _______________________________________________ > security-dev mailing list > security-dev(a)lists.jboss.org <mailto:security-dev@lists.jboss.org> > https://lists.jboss.org/mailman/listinfo/security-dev

Hi Shane, Maybe we can have the following structure: picketlink core api impl idm api impl federation ... I think this is more clear than have all projects at the same directory level, making easier further configuration for each project. Makes sense ? Regards. Pedro Igor ----- Original Message ----- From: "Shane Bryzak" <sbryzak(a)redhat.com&gt; To: security-dev(a)lists.jboss.org Sent: Monday, October 1, 2012 7:30:05 PM Subject: [security-dev] PicketLink restructure In the interests of presenting a clear message to our developers, one of the steps we'll be taking is to consolidate the various PicketLink projects into a single project and presenting this as the "go to" solution for application security. For now I've merged the CDI and IDM subprojects (these are now submodules of the PicketLink project, with "CDI" renamed to "Core") and the plan is to eventually merge the social and federation modules also. You can find the new GitHub repository here: https://github.com/picketlink (renamed from picketlink-cdi) and the picketlink-idm repository has now been deleted. For anyone working on these modules, please use the new repository from now on. Thanks! Shane _______________________________________________ security-dev mailing list security-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/security-dev

It seems odd to me that CDI is called core? I thought the idea was that picketlink core would be pure Java SE, and CDI support gets added on top.

But +1 to the merge. The more we can put under one project, with one brand the better. I talked to Anil about merging PicketBox into PicketLink as well, as "just another module" and I think this will make things a lot simple for users to understand. On 1 Oct 2012, at 15:30, Shane Bryzak wrote: > In the interests of presenting a clear message to our developers, one of the steps we'll be taking is to consolidate the various PicketLink projects into a single project and presenting this as the "go to" solution for application security. For now I've merged the CDI and IDM subprojects (these are now submodules of the PicketLink project, with "CDI" renamed to "Core") and the plan is to eventually merge the social and federation modules also. > > You can find the new GitHub repository here: https://github.com/picketlink (renamed from picketlink-cdi) and the picketlink-idm repository has now been deleted. For anyone working on these modules, please use the new repository from now on. > > Thanks! > Shane > _______________________________________________ > security-dev mailing list > security-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/security-dev

If I understood correctly, Pete asked for something like we have with PicketBox. A core project for Java SE and a cdi-based one with the cdi glue code. That way we can work with core functionality and expose those for some specific environment: CDI, JAX-RS, EJB, WS, AS, etc. This can also help others using picketlink in their projects. Regards. Pedro Igor ----- Original Message ----- From: "Shane Bryzak" <sbryzak(a)redhat.com&gt; To: "Pete Muir" <pmuir(a)redhat.com&gt; Cc: security-dev(a)lists.jboss.org Sent: Monday, October 1, 2012 11:03:22 PM Subject: Re: [security-dev] PicketLink restructure On 02/10/12 10:00, Pete Muir wrote: > It seems odd to me that CDI is called core? I thought the idea was that picketlink core would be pure Java SE, and CDI support gets added on top. Some of the modules are Java SE (IDM, Social) and core is the CDI-based "glue" that integrates it all into an easily consumable package for EE devs. > > But +1 to the merge. The more we can put under one project, with one brand the better. > > I talked to Anil about merging PicketBox into PicketLink as well, as "just another module" and I think this will make things a lot simple for users to understand. > > On 1 Oct 2012, at 15:30, Shane Bryzak wrote: > >> In the interests of presenting a clear message to our developers, one of the steps we'll be taking is to consolidate the various PicketLink projects into a single project and presenting this as the "go to" solution for application security. For now I've merged the CDI and IDM subprojects (these are now submodules of the PicketLink project, with "CDI" renamed to "Core") and the plan is to eventually merge the social and federation modules also. >> >> You can find the new GitHub repository here: https://github.com/picketlink (renamed from picketlink-cdi) and the picketlink-idm repository has now been deleted. For anyone working on these modules, please use the new repository from now on. >> >> Thanks! >> Shane >> _______________________________________________ >> security-dev mailing list >> security-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/security-dev _______________________________________________ security-dev mailing list security-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/security-dev

Ok, let me lay it all out in a way that hopefully makes some more sense ;) In reviewing all of our various security offerings, it became quickly apparent to me that a new developer looking at our stuff would most likely become quickly confused - in fact there was even quite a bit of confusion during our recent Elluminate call as to which security modules did what. After Anil and I had a discussion about this we agreed that the first steps in reducing this confusion would be to re-purpose PicketLink as the "go to" project for security for Java EE developers. This greatly simplifies our message and gives us a single place to which we direct people who are looking for a security solution for their projects. PicketLink will be where we can point previous users of Seam Security to, and will compete head to head with other well-known "complete" security frameworks. In terms of Java SE, the only requirements I am aware of are those of the AS team wishing to use the IDM libraries - to this end we've maintained IDM as a submodule of PicketLink, without any CDI dependency. For a typical EE developer who just wants to get started, we simply tell them to add picketlink-core to their Maven dependencies which gives them everything. Just to be clear about what's in picketlink-core, it's simply the user session state management (i.e. the Identity bean), authentication API (which is based on CDI), CDI-enabled configuration for IDM, and the ACL Permissions API (built on DeltaSpike's security binding types). All of this is quite CDI-specific (except for the permissions stuff which could theoretically be rewritten as JavaSE however I have no interest in doing so). I can understand how at first glance it might seem weird that some modules are targetted at SE while core is EE, however it's my opinion that we shouldn't be pushing PicketLink as a set of "modules" anyway. The separation of the IDM module is only for the AS team's benefit, otherwise this feature would be part of core itself. In fact, I think we should downplay that it even consists of multiple modules. Remember, this is just the first step towards unifying our security message. We've still got a lot of work to do, including further discussions about what we do with PicketBox, which I hope we address in the coming weeks. Hopefully this has been helpful in shedding some light on the motivations for this restructure. Shane On 03/10/12 00:08, Pete Muir wrote: > Or maybe I'm just confused about the naming, it seems odd to me for "core" to target Java EE, whilst modules target Java SE... > > On 2 Oct 2012, at 05:35, Pedro Igor Silva wrote: > >> If I understood correctly, Pete asked for something like we have with PicketBox. A core project for Java SE and a cdi-based one with the cdi glue code. >> >> That way we can work with core functionality and expose those for some specific environment: CDI, JAX-RS, EJB, WS, AS, etc. This can also help others using picketlink in their projects. >> >> Regards. >> Pedro Igor >> >> ----- Original Message ----- >> From: "Shane Bryzak" <sbryzak(a)redhat.com&gt; >> To: "Pete Muir" <pmuir(a)redhat.com&gt; >> Cc: security-dev(a)lists.jboss.org >> Sent: Monday, October 1, 2012 11:03:22 PM >> Subject: Re: [security-dev] PicketLink restructure >> >> On 02/10/12 10:00, Pete Muir wrote: >>> It seems odd to me that CDI is called core? I thought the idea was that picketlink core would be pure Java SE, and CDI support gets added on top. >> Some of the modules are Java SE (IDM, Social) and core is the CDI-based >> "glue" that integrates it all into an easily consumable package for EE devs. >>> But +1 to the merge. The more we can put under one project, with one brand the better. >>> >>> I talked to Anil about merging PicketBox into PicketLink as well, as "just another module" and I think this will make things a lot simple for users to understand. >>> >>> On 1 Oct 2012, at 15:30, Shane Bryzak wrote: >>> >>>> In the interests of presenting a clear message to our developers, one of the steps we'll be taking is to consolidate the various PicketLink projects into a single project and presenting this as the "go to" solution for application security. For now I've merged the CDI and IDM subprojects (these are now submodules of the PicketLink project, with "CDI" renamed to "Core") and the plan is to eventually merge the social and federation modules also. >>>> >>>> You can find the new GitHub repository here: https://github.com/picketlink (renamed from picketlink-cdi) and the picketlink-idm repository has now been deleted. For anyone working on these modules, please use the new repository from now on. >>>> >>>> Thanks! >>>> Shane >>>> _______________________________________________ >>>> security-dev mailing list >>>> security-dev(a)lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/security-dev >> >> _______________________________________________ >> security-dev mailing list >> security-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/security-dev

It seems odd to me that CDI is called core? I thought the idea was that picketlink core would be pure Java SE, and CDI support gets added on top. But +1 to the merge. The more we can put under one project, with one brand the better. I talked to Anil about merging PicketBox into PicketLink as well, as "just another module" and I think this will make things a lot simple for users to understand.

On 1 Oct 2012, at 15:30, Shane Bryzak wrote: > In the interests of presenting a clear message to our developers, one of the steps we'll be taking is to consolidate the various PicketLink projects into a single project and presenting this as the "go to" solution for application security. For now I've merged the CDI and IDM subprojects (these are now submodules of the PicketLink project, with "CDI" renamed to "Core") and the plan is to eventually merge the social and federation modules also. > > You can find the new GitHub repository here: https://github.com/picketlink (renamed from picketlink-cdi) and the picketlink-idm repository has now been deleted. For anyone working on these modules, please use the new repository from now on. > > Thanks! > Shane

On 3 Oct 2012, at 08:10, Anil Saldhana wrote: > On 10/01/2012 07:00 PM, Pete Muir wrote: >> It seems odd to me that CDI is called core? I thought the idea was that picketlink core would be pure Java SE, and CDI support gets added on top. >> >> But +1 to the merge. The more we can put under one project, with one brand the better. >> >> I talked to Anil about merging PicketBox into PicketLink as well, as "just another module" and I think this will make things a lot simple for users to understand. > Pete, lets wait for PL codebase to stabilize before figuring out > PicketBox. :-) Yes, we don't need to do this now, just throwing around ideas. > As I said, from JDF perspective and pitching to application > developers, it makes sense to go with PL. But for framework writers and > folks dealing with AS security and stuff, they have to do PBox. Still not sure why that means we can't do it like the IDM - as a pure Java SE submodule of PicketLink. This to me is more about brand simplicity than anything.

>> On 1 Oct 2012, at 15:30, Shane Bryzak wrote: >> >>> In the interests of presenting a clear message to our developers, one of the steps we'll be taking is to consolidate the various PicketLink projects into a single project and presenting this as the "go to" solution for application security. For now I've merged the CDI and IDM subprojects (these are now submodules of the PicketLink project, with "CDI" renamed to "Core") and the plan is to eventually merge the social and federation modules also. >>> >>> You can find the new GitHub repository here: https://github.com/picketlink (renamed from picketlink-cdi) and the picketlink-idm repository has now been deleted. For anyone working on these modules, please use the new repository from now on. >>> >>> Thanks! >>> Shane >>>

On 10/03/2012 10:17 AM, Pete Muir wrote: > On 3 Oct 2012, at 08:10, Anil Saldhana wrote: > >> On 10/01/2012 07:00 PM, Pete Muir wrote: >>> It seems odd to me that CDI is called core? I thought the idea was that picketlink core would be pure Java SE, and CDI support gets added on top. >>> >>> But +1 to the merge. The more we can put under one project, with one brand the better. >>> >>> I talked to Anil about merging PicketBox into PicketLink as well, as "just another module" and I think this will make things a lot simple for users to understand. >> Pete, lets wait for PL codebase to stabilize before figuring out >> PicketBox. > :-) Yes, we don't need to do this now, just throwing around ideas. > >> As I said, from JDF perspective and pitching to application >> developers, it makes sense to go with PL. But for framework writers and >> folks dealing with AS security and stuff, they have to do PBox. > Still not sure why that means we can't do it like the IDM - as a pure Java SE submodule of PicketLink. This to me is more about brand simplicity than anything. PicketBox has lots of stuff. Container Security plus xacml and other things which need to be properly migrated/massaged/discarded/eased into our final offering. We don't want to make PL a bloated security offering.

>>> On 1 Oct 2012, at 15:30, Shane Bryzak wrote: >>> >>>> In the interests of presenting a clear message to our developers, one of the steps we'll be taking is to consolidate the various PicketLink projects into a single project and presenting this as the "go to" solution for application security. For now I've merged the CDI and IDM subprojects (these are now submodules of the PicketLink project, with "CDI" renamed to "Core") and the plan is to eventually merge the social and federation modules also. >>>> >>>> You can find the new GitHub repository here: https://github.com/picketlink (renamed from picketlink-cdi) and the picketlink-idm repository has now been deleted. For anyone working on these modules, please use the new repository from now on. >>>> >>>> Thanks! >>>> Shane >>>> _______________________________________________ security-dev mailing list security-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/security-dev

On 10/03/2012 05:50 PM, Shane Bryzak wrote: > On 04/10/12 01:20, Anil Saldhana wrote: >> On 10/03/2012 10:17 AM, Pete Muir wrote: >>> On 3 Oct 2012, at 08:10, Anil Saldhana wrote: >>> >>>> On 10/01/2012 07:00 PM, Pete Muir wrote: >>>>> It seems odd to me that CDI is called core? I thought the idea was that picketlink core would be pure Java SE, and CDI support gets added on top. >>>>> >>>>> But +1 to the merge. The more we can put under one project, with one brand the better. >>>>> >>>>> I talked to Anil about merging PicketBox into PicketLink as well, as "just another module" and I think this will make things a lot simple for users to understand. >>>> Pete, lets wait for PL codebase to stabilize before figuring out >>>> PicketBox. >>> :-) Yes, we don't need to do this now, just throwing around ideas. >>> >>>> As I said, from JDF perspective and pitching to application >>>> developers, it makes sense to go with PL. But for framework writers and >>>> folks dealing with AS security and stuff, they have to do PBox. >>> Still not sure why that means we can't do it like the IDM - as a pure Java SE submodule of PicketLink. This to me is more about brand simplicity than anything. >> PicketBox has lots of stuff. Container Security plus xacml and other >> things which need to be properly migrated/massaged/discarded/eased into >> our final offering. We don't want to make PL a bloated security offering. > +1, I'm dubious of the value of adding PicketBox as a module, especially > as it's based on the old JavaEE Principal/Subject security model which > we've totally moved away from now. Perhaps some of the features such as > XACML could be implemented as a standalone module (if it isn't already) > in PicketBox and then we provide some integration code for that. I > wouldn't think though that XACML is an overly popular feature anyway, > especially since we'll be providing Drools-based permissions in PL already. Actually the JavaEE principal/subject model in PicketBox is what is termed PicketBox Legacy in the following diagram: https://docs.jboss.org/author/display/SECURITY/SecurityProjectsArchitecture Before moving your security work from Apache Deltaspike to PicketLink, we were already in the works to provide security for applications in JavaSE environment. https://docs.jboss.org/author/display/SECURITY/Java+Application+Security These projects are all housed at: https://github.com/picketbox Some of them such as picketbox-cdi, picketbox-deltaspike and picketbox-solder need to nuked but the other projects are all valuable code in JavaSE environments.

> > >>>>> On 1 Oct 2012, at 15:30, Shane Bryzak wrote: >>>>> >>>>>> In the interests of presenting a clear message to our developers, one of the steps we'll be taking is to consolidate the various PicketLink projects into a single project and presenting this as the "go to" solution for application security. For now I've merged the CDI and IDM subprojects (these are now submodules of the PicketLink project, with "CDI" renamed to "Core") and the plan is to eventually merge the social and federation modules also. >>>>>> >>>>>> You can find the new GitHub repository here: https://github.com/picketlink (renamed from picketlink-cdi) and the picketlink-idm repository has now been deleted. For anyone working on these modules, please use the new repository from now on. >>>>>> >>>>>> Thanks! >>>>>> Shane >>>>>> >>>>>> _______________________________________________ security-dev mailing list security-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/security-dev

Have you just removed picketlink-idm on github? We are actively working on 1.4 branch and this is critical for EPP. Other branches are still maintenance for older versions of GateIn/EPP. I think I was fairly clear that we need those. This repo needs to be restored ASAP. On Oct 2, 2012, at 12:30 AM, Shane Bryzak <sbryzak(a)redhat.com&gt; wrote: > In the interests of presenting a clear message to our developers, one of the steps we'll be taking is to consolidate the various PicketLink projects into a single project and presenting this as the "go to" solution for application security. For now I've merged the CDI and IDM subprojects (these are now submodules of the PicketLink project, with "CDI" renamed to "Core") and the plan is to eventually merge the social and federation modules also. > > You can find the new GitHub repository here: https://github.com/picketlink (renamed from picketlink-cdi) and the picketlink-idm repository has now been deleted. For anyone working on these modules, please use the new repository from now on. > > Thanks! > Shane > _______________________________________________ > security-dev mailing list > security-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/security-dev _______________________________________________ security-dev mailing list security-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/security-dev

I restored our branches and synced with Shane on IM. picketlink-idm/master will be nuked and only contain some README pointing to new locations Current picketlink-idm repo will be kept for few more months at least and after we are in more calm situation with GateIn/EPP it will be renamed into picketlink-idm-legacy. Things under control :) Bolek On Oct 2, 2012, at 11:08 AM, Boleslaw Dawidowicz <bdawidow(a)redhat.com <mailto:bdawidow@redhat.com>> wrote: > I must say I'm quite pissed off... even yesterday I shared a link to > one of configuration files in 1.4 branch with a consultants. We > released twice last month... how could have it happened without any > question? > > > On Oct 2, 2012, at 11:06 AM, Boleslaw Dawidowicz <bdawidow(a)redhat.com > <mailto:bdawidow@redhat.com>> wrote: > >> Have you just removed picketlink-idm on github? >> >> We are actively working on 1.4 branch and this is critical for EPP. >> Other branches are still maintenance for older versions of >> GateIn/EPP. I think I was fairly clear that we need those. >> >> This repo needs to be restored ASAP. >> >> On Oct 2, 2012, at 12:30 AM, Shane Bryzak <sbryzak(a)redhat.com >> <mailto:sbryzak@redhat.com>> wrote: >> >>> In the interests of presenting a clear message to our developers, >>> one of the steps we'll be taking is to consolidate the various >>> PicketLink projects into a single project and presenting this as >>> the "go to" solution for application security. For now I've merged >>> the CDI and IDM subprojects (these are now submodules of the >>> PicketLink project, with "CDI" renamed to "Core") and the plan is >>> to eventually merge the social and federation modules also. >>> >>> You can find the new GitHub repository here: >>> https://github.com/picketlink (renamed from picketlink-cdi) and the >>> picketlink-idm repository has now been deleted. For anyone working >>> on these modules, please use the new repository from now on. >>> >>> Thanks! >>> Shane

Shane, ahh. You could not wait a day or two. :) I am wondering if we could have retained history via some form of "git mv". We should probably have PicketLink version as 3.0 for all the code and rather than do individual releases, we can do a collective PL3.x release. Cheers. On 10/02/2012 04:56 AM, Boleslaw Dawidowicz wrote: > I restored our branches and synced with Shane on IM. > > picketlink-idm/master will be nuked and only contain some README > pointing to new locations > > Current picketlink-idm repo will be kept for few more months at least > and after we are in more calm situation with GateIn/EPP it will be > renamed into picketlink-idm-legacy. > > Things under control :) > > Bolek > > On Oct 2, 2012, at 11:08 AM, Boleslaw Dawidowicz <bdawidow(a)redhat.com > <mailto:bdawidow@redhat.com>> wrote: > >> I must say I'm quite pissed off... even yesterday I shared a link to >> one of configuration files in 1.4 branch with a consultants. We >> released twice last month... how could have it happened without any >> question? >> >> >> On Oct 2, 2012, at 11:06 AM, Boleslaw Dawidowicz >> <bdawidow(a)redhat.com <mailto:bdawidow@redhat.com>> wrote: >> >>> Have you just removed picketlink-idm on github? >>> >>> We are actively working on 1.4 branch and this is critical for EPP. >>> Other branches are still maintenance for older versions of >>> GateIn/EPP. I think I was fairly clear that we need those. >>> >>> This repo needs to be restored ASAP. >>> >>> On Oct 2, 2012, at 12:30 AM, Shane Bryzak <sbryzak(a)redhat.com >>> <mailto:sbryzak@redhat.com>> wrote: >>> >>>> In the interests of presenting a clear message to our developers, >>>> one of the steps we'll be taking is to consolidate the various >>>> PicketLink projects into a single project and presenting this as >>>> the "go to" solution for application security. For now I've >>>> merged the CDI and IDM subprojects (these are now submodules of >>>> the PicketLink project, with "CDI" renamed to "Core") and the plan >>>> is to eventually merge the social and federation modules also. >>>> >>>> You can find the new GitHub repository here: >>>> https://github.com/picketlink (renamed from picketlink-cdi) and >>>> the picketlink-idm repository has now been deleted. For anyone >>>> working on these modules, please use the new repository from now on. >>>> >>>> Thanks! >>>> Shane _______________________________________________ security-dev mailing list security-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/security-dev

Shane, did you throw away the JPA code that Pedro had done for almost a month? Where is that code? Code contributions have legal ramifications. We cannot just throw away code and loss of history is deeply disturbing. Regards, Anil On 10/03/2012 05:39 PM, Shane Bryzak wrote: There was a little bit of confusion over the legacy IDM code (I had forgotten that it had been migrated to the picketlink-idm repo on GitHub albeit under different branches) but this has been sorted out now, and I believe all the history for it is intact. As for the temporary IDM implementation we have the final snapshot of it, however since then I've blown it away anyhow and started working on the proper implementation. I don't think we need the history for the temporary stuff. Agreed with the collective PL release. As for the version number, did we ever do a 2.x release? If so, then I agree we should update it to 3.x for the new project. Shane On 04/10/12 01:06, Anil Saldhana wrote: Shane, ahh. You could not wait a day or two. :) I am wondering if we could have retained history via some form of "git mv". We should probably have PicketLink version as 3.0 for all the code and rather than do individual releases, we can do a collective PL3.x release. Cheers. On 10/02/2012 04:56 AM, Boleslaw Dawidowicz wrote: I restored our branches and synced with Shane on IM. picketlink-idm/master will be nuked and only contain some README pointing to new locations Current picketlink-idm repo will be kept for few more months at least and after we are in more calm situation with GateIn/EPP it will be renamed into picketlink-idm-legacy. Things under control :) Bolek On Oct 2, 2012, at 11:08 AM, Boleslaw Dawidowicz <bdawidow(a)redhat.com&gt; wrote: I must say I'm quite pissed off… even yesterday I shared a link to one of configuration files in 1.4 branch with a consultants. We released twice last month… how could have it happened without any question? On Oct 2, 2012, at 11:06 AM, Boleslaw Dawidowicz <bdawidow(a)redhat.com&gt; wrote: Have you just removed picketlink-idm on github? We are actively working on 1.4 branch and this is critical for EPP. Other branches are still maintenance for older versions of GateIn/EPP. I think I was fairly clear that we need those. This repo needs to be restored ASAP. On Oct 2, 2012, at 12:30 AM, Shane Bryzak <sbryzak(a)redhat.com&gt; wrote: In the interests of presenting a clear message to our developers, one of the steps we'll be taking is to consolidate the various PicketLink projects into a single project and presenting this as the "go to" solution for application security. For now I've merged the CDI and IDM subprojects (these are now submodules of the PicketLink project, with "CDI" renamed to "Core") and the plan is to eventually merge the social and federation modules also. You can find the new GitHub repository here: https://github.com/picketlink(renamed from picketlink-cdi) and the picketlink-idm repository has now been deleted. For anyone working on these modules, please use the new repository from now on. Thanks! Shane _______________________________________________ security-dev mailing listsecurity-dev@lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/security-dev _______________________________________________ security-dev mailing listsecurity-dev@lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/security-dev _______________________________________________ security-dev mailing list security-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/security-dev

Shane, did you throw away the JPA code that Pedro had done for almost a month? Where is that code? Code contributions have legal ramifications. We cannot just throw away code and loss of history is deeply disturbing. Regards, Anil On 10/03/2012 05:39 PM, Shane Bryzak wrote: > There was a little bit of confusion over the legacy IDM code (I had > forgotten that it had been migrated to the picketlink-idm repo on > GitHub albeit under different branches) but this has been sorted out > now, and I believe all the history for it is intact. As for the > temporary IDM implementation we have the final snapshot of it, > however since then I've blown it away anyhow and started working on > the proper implementation. I don't think we need the history for the > temporary stuff. > > Agreed with the collective PL release. As for the version number, > did we ever do a 2.x release? If so, then I agree we should update > it to 3.x for the new project. > > Shane > > On 04/10/12 01:06, Anil Saldhana wrote: >> Shane, >> ahh. You could not wait a day or two. :) I am wondering if we >> could have retained history via some form of "git mv". >> >> We should probably have PicketLink version as 3.0 for all the code >> and rather than do individual releases, we can do a collective PL3.x >> release. >> >> Cheers. >> >> On 10/02/2012 04:56 AM, Boleslaw Dawidowicz wrote: >>> I restored our branches and synced with Shane on IM. >>> >>> picketlink-idm/master will be nuked and only contain some README >>> pointing to new locations >>> >>> Current picketlink-idm repo will be kept for few more months at >>> least and after we are in more calm situation with GateIn/EPP it >>> will be renamed into picketlink-idm-legacy. >>> >>> Things under control :) >>> >>> Bolek >>> >>> On Oct 2, 2012, at 11:08 AM, Boleslaw Dawidowicz >>> <bdawidow(a)redhat.com <mailto:bdawidow@redhat.com>> wrote: >>> >>>> I must say I'm quite pissed off... even yesterday I shared a link >>>> to one of configuration files in 1.4 branch with a consultants. We >>>> released twice last month... how could have it happened without >>>> any question? >>>> >>>> >>>> On Oct 2, 2012, at 11:06 AM, Boleslaw Dawidowicz >>>> <bdawidow(a)redhat.com <mailto:bdawidow@redhat.com>> wrote: >>>> >>>>> Have you just removed picketlink-idm on github? >>>>> >>>>> We are actively working on 1.4 branch and this is critical for >>>>> EPP. Other branches are still maintenance for older versions of >>>>> GateIn/EPP. I think I was fairly clear that we need those. >>>>> >>>>> This repo needs to be restored ASAP. >>>>> >>>>> On Oct 2, 2012, at 12:30 AM, Shane Bryzak <sbryzak(a)redhat.com >>>>> <mailto:sbryzak@redhat.com>> wrote: >>>>> >>>>>> In the interests of presenting a clear message to our >>>>>> developers, one of the steps we'll be taking is to consolidate >>>>>> the various PicketLink projects into a single project and >>>>>> presenting this as the "go to" solution for application >>>>>> security. For now I've merged the CDI and IDM subprojects (these >>>>>> are now submodules of the PicketLink project, with "CDI" renamed >>>>>> to "Core") and the plan is to eventually merge the social and >>>>>> federation modules also. >>>>>> >>>>>> You can find the new GitHub repository here: >>>>>> https://github.com/picketlink (renamed from picketlink-cdi) and >>>>>> the picketlink-idm repository has now been deleted. For anyone >>>>>> working on these modules, please use the new repository from now on. >>>>>> >>>>>> Thanks! >>>>>> Shane >> >> >> >> _______________________________________________ >> security-dev mailing list >> security-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/security-dev > > > > > _______________________________________________ > security-dev mailing list > security-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/security-dev _______________________________________________ security-dev mailing list security-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/security-dev

As I said we have a snapshot of the latest version of the code (see [1]), however this doesn't include the commit history. If the history is important for whatever reason, I suggest we reinstate it under its own branch of the picketlink-idm repository. I thought we were both of the understanding though from our discussions that this code was just a stop-gap measure so that we had something to show in time for JavaOne. [1] https://github.com/picketlink/picketlink/tree/953c39f6ccb9c4617357deb4721... On 04/10/12 11:05, Anil Saldhana wrote: > Shane, > did you throw away the JPA code that Pedro had done for almost a > month? Where is that code? > > Code contributions have legal ramifications. We cannot just throw > away code and loss of history is deeply disturbing. > > Regards, > Anil > > On 10/03/2012 05:39 PM, Shane Bryzak wrote: >> There was a little bit of confusion over the legacy IDM code (I had >> forgotten that it had been migrated to the picketlink-idm repo on >> GitHub albeit under different branches) but this has been sorted out >> now, and I believe all the history for it is intact. As for the >> temporary IDM implementation we have the final snapshot of it, >> however since then I've blown it away anyhow and started working on >> the proper implementation. I don't think we need the history for >> the temporary stuff. >> >> Agreed with the collective PL release. As for the version number, >> did we ever do a 2.x release? If so, then I agree we should update >> it to 3.x for the new project. >> >> Shane >> >> On 04/10/12 01:06, Anil Saldhana wrote: >>> Shane, >>> ahh. You could not wait a day or two. :) I am wondering if we >>> could have retained history via some form of "git mv". >>> >>> We should probably have PicketLink version as 3.0 for all the code >>> and rather than do individual releases, we can do a collective >>> PL3.x release. >>> >>> Cheers. >>> >>> On 10/02/2012 04:56 AM, Boleslaw Dawidowicz wrote: >>>> I restored our branches and synced with Shane on IM. >>>> >>>> picketlink-idm/master will be nuked and only contain some README >>>> pointing to new locations >>>> >>>> Current picketlink-idm repo will be kept for few more months at >>>> least and after we are in more calm situation with GateIn/EPP it >>>> will be renamed into picketlink-idm-legacy. >>>> >>>> Things under control :) >>>> >>>> Bolek >>>> >>>> On Oct 2, 2012, at 11:08 AM, Boleslaw Dawidowicz >>>> <bdawidow(a)redhat.com <mailto:bdawidow@redhat.com>> wrote: >>>> >>>>> I must say I'm quite pissed off... even yesterday I shared a link >>>>> to one of configuration files in 1.4 branch with a consultants. >>>>> We released twice last month... how could have it happened >>>>> without any question? >>>>> >>>>> >>>>> On Oct 2, 2012, at 11:06 AM, Boleslaw Dawidowicz >>>>> <bdawidow(a)redhat.com <mailto:bdawidow@redhat.com>> wrote: >>>>> >>>>>> Have you just removed picketlink-idm on github? >>>>>> >>>>>> We are actively working on 1.4 branch and this is critical for >>>>>> EPP. Other branches are still maintenance for older versions of >>>>>> GateIn/EPP. I think I was fairly clear that we need those. >>>>>> >>>>>> This repo needs to be restored ASAP. >>>>>> >>>>>> On Oct 2, 2012, at 12:30 AM, Shane Bryzak <sbryzak(a)redhat.com >>>>>> <mailto:sbryzak@redhat.com>> wrote: >>>>>> >>>>>>> In the interests of presenting a clear message to our >>>>>>> developers, one of the steps we'll be taking is to consolidate >>>>>>> the various PicketLink projects into a single project and >>>>>>> presenting this as the "go to" solution for application >>>>>>> security. For now I've merged the CDI and IDM subprojects >>>>>>> (these are now submodules of the PicketLink project, with "CDI" >>>>>>> renamed to "Core") and the plan is to eventually merge the >>>>>>> social and federation modules also. >>>>>>> >>>>>>> You can find the new GitHub repository here: >>>>>>> https://github.com/picketlink (renamed from picketlink-cdi) and >>>>>>> the picketlink-idm repository has now been deleted. For anyone >>>>>>> working on these modules, please use the new repository from >>>>>>> now on. >>>>>>> >>>>>>> Thanks! >>>>>>> Shane >>> >>> >>> >>> _______________________________________________ >>> security-dev mailing list >>> security-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/security-dev >> >> >> >> >> _______________________________________________ >> security-dev mailing list >> security-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/security-dev > > > > _______________________________________________ > security-dev mailing list > security-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/security-dev _______________________________________________ security-dev mailing list security-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/security-dev

Shane - I said I need the JPA implementation for J1 and Pedro will work on it and we will evaluate after J1. The only thing that completely took me by surprise was you deleted the PL IDM repository, rather than waiting for everyone to agree on the new PL workspace. Typically in these situations, I retain old code and nuke it once we have agreement. You should have waited another day for me to get on to chat with you. Internet at J1 sucked. :( Ideally I would like us to go over what Pedro has done and evaluate whether we retain/modify/delete the JPA implementation. It cannot be the decision of one person in the project. :)

Right now, I want to get the PL IDM project back to where it was on Friday. Then we can talk. On Oct 3, 2012, at 9:38 PM, Shane Bryzak <sbryzak(a)redhat.com <mailto:sbryzak@redhat.com>> wrote: > Actually, the history is already there for the tagged release - see > [1] for example. > > [1] > https://github.com/picketlink/picketlink-idm/commits/2.0-20120910/impl/sr... > > On 04/10/12 12:24, Shane Bryzak wrote: >> As I said we have a snapshot of the latest version of the code (see >> [1]), however this doesn't include the commit history. If the >> history is important for whatever reason, I suggest we reinstate it >> under its own branch of the picketlink-idm repository. I thought we >> were both of the understanding though from our discussions that this >> code was just a stop-gap measure so that we had something to show in >> time for JavaOne. >> >> [1] >> https://github.com/picketlink/picketlink/tree/953c39f6ccb9c4617357deb4721... >> >> >> >> On 04/10/12 11:05, Anil Saldhana wrote: >>> Shane, >>> did you throw away the JPA code that Pedro had done for almost a >>> month? Where is that code? >>> >>> Code contributions have legal ramifications. We cannot just throw >>> away code and loss of history is deeply disturbing. >>> >>> Regards, >>> Anil >>> >>> On 10/03/2012 05:39 PM, Shane Bryzak wrote: >>>> There was a little bit of confusion over the legacy IDM code (I >>>> had forgotten that it had been migrated to the picketlink-idm repo >>>> on GitHub albeit under different branches) but this has been >>>> sorted out now, and I believe all the history for it is intact. >>>> As for the temporary IDM implementation we have the final snapshot >>>> of it, however since then I've blown it away anyhow and started >>>> working on the proper implementation. I don't think we need the >>>> history for the temporary stuff. >>>> >>>> Agreed with the collective PL release. As for the version number, >>>> did we ever do a 2.x release? If so, then I agree we should >>>> update it to 3.x for the new project. >>>> >>>> Shane >>>> >>>> On 04/10/12 01:06, Anil Saldhana wrote: >>>>> Shane, >>>>> ahh. You could not wait a day or two. :) I am wondering if we >>>>> could have retained history via some form of "git mv". >>>>> >>>>> We should probably have PicketLink version as 3.0 for all the >>>>> code and rather than do individual releases, we can do a >>>>> collective PL3.x release. >>>>> >>>>> Cheers. >>>>> >>>>> On 10/02/2012 04:56 AM, Boleslaw Dawidowicz wrote: >>>>>> I restored our branches and synced with Shane on IM. >>>>>> >>>>>> picketlink-idm/master will be nuked and only contain some README >>>>>> pointing to new locations >>>>>> >>>>>> Current picketlink-idm repo will be kept for few more months at >>>>>> least and after we are in more calm situation with GateIn/EPP it >>>>>> will be renamed into picketlink-idm-legacy. >>>>>> >>>>>> Things under control :) >>>>>> >>>>>> Bolek >>>>>> >>>>>> On Oct 2, 2012, at 11:08 AM, Boleslaw Dawidowicz >>>>>> <bdawidow(a)redhat.com <mailto:bdawidow@redhat.com>> wrote: >>>>>> >>>>>>> I must say I'm quite pissed off… even yesterday I shared a link >>>>>>> to one of configuration files in 1.4 branch with a consultants. >>>>>>> We released twice last month… how could have it happened >>>>>>> without any question? >>>>>>> >>>>>>> >>>>>>> On Oct 2, 2012, at 11:06 AM, Boleslaw Dawidowicz >>>>>>> <bdawidow(a)redhat.com <mailto:bdawidow@redhat.com>> wrote: >>>>>>> >>>>>>>> Have you just removed picketlink-idm on github? >>>>>>>> >>>>>>>> We are actively working on 1.4 branch and this is critical for >>>>>>>> EPP. Other branches are still maintenance for older versions >>>>>>>> of GateIn/EPP. I think I was fairly clear that we need those. >>>>>>>> >>>>>>>> This repo needs to be restored ASAP. >>>>>>>> >>>>>>>> On Oct 2, 2012, at 12:30 AM, Shane Bryzak <sbryzak(a)redhat.com >>>>>>>> <mailto:sbryzak@redhat.com>> wrote: >>>>>>>> >>>>>>>>> In the interests of presenting a clear message to our >>>>>>>>> developers, one of the steps we'll be taking is to >>>>>>>>> consolidate the various PicketLink projects into a single >>>>>>>>> project and presenting this as the "go to" solution for >>>>>>>>> application security. For now I've merged the CDI and IDM >>>>>>>>> subprojects (these are now submodules of the PicketLink >>>>>>>>> project, with "CDI" renamed to "Core") and the plan is to >>>>>>>>> eventually merge the social and federation modules also. >>>>>>>>> >>>>>>>>> You can find the new GitHub repository here: >>>>>>>>> https://github.com/picketlink (renamed from picketlink-cdi) >>>>>>>>> and the picketlink-idm repository has now been deleted. For >>>>>>>>> anyone working on these modules, please use the new >>>>>>>>> repository from now on. >>>>>>>>> >>>>>>>>> Thanks! >>>>>>>>> Shane >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> security-dev mailing list >>>>> security-dev(a)lists.jboss.org >>>>> https://lists.jboss.org/mailman/listinfo/security-dev >>>> >>>> >>>> >>>> >>>> _______________________________________________ >>>> security-dev mailing list >>>> security-dev(a)lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/security-dev >>> >>> >>> >>> _______________________________________________ >>> security-dev mailing list >>> security-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/security-dev >> >> >> >> >> _______________________________________________ >> security-dev mailing list >> security-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/security-dev > > > _______________________________________________ > security-dev mailing list > security-dev(a)lists.jboss.org <mailto:security-dev@lists.jboss.org> > https://lists.jboss.org/mailman/listinfo/security-dev

Shane - I said I need the JPA implementation for J1 and Pedro will work on it and we will evaluate after J1. The only thing that completely took me by surprise was you deleted the PL IDM repository, rather than waiting for everyone to agree on the new PL workspace. Typically in these situations, I retain old code and nuke it once we have agreement. You should have waited another day for me to get on to chat with you. Internet at J1 sucked. :( Ideally I would like us to go over what Pedro has done and evaluate whether we retain/modify/delete the JPA implementation. It cannot be the decision of one person in the project. :) Right now, I want to get the PL IDM project back to where it was on Friday. Then we can talk. On Oct 3, 2012, at 9:38 PM, Shane Bryzak <sbryzak(a)redhat.com&gt; wrote: > Actually, the history is already there for the tagged release - see [1] for example. > > [1] https://github.com/picketlink/picketlink-idm/commits/2.0-20120910/impl/sr... > > On 04/10/12 12:24, Shane Bryzak wrote: >> As I said we have a snapshot of the latest version of the code (see [1]), however this doesn't include the commit history. If the history is important for whatever reason, I suggest we reinstate it under its own branch of the picketlink-idm repository. I thought we were both of the understanding though from our discussions that this code was just a stop-gap measure so that we had something to show in time for JavaOne. >> >> [1] https://github.com/picketlink/picketlink/tree/953c39f6ccb9c4617357deb4721... >> >> >> >> On 04/10/12 11:05, Anil Saldhana wrote: >>> Shane, >>> did you throw away the JPA code that Pedro had done for almost a month? Where is that code? >>> >>> Code contributions have legal ramifications. We cannot just throw away code and loss of history is deeply disturbing. >>> >>> Regards, >>> Anil >>> >>> On 10/03/2012 05:39 PM, Shane Bryzak wrote: >>>> There was a little bit of confusion over the legacy IDM code (I had forgotten that it had been migrated to the picketlink-idm repo on GitHub albeit under different branches) but this has been sorted out now, and I believe all the history for it is intact. As for the temporary IDM implementation we have the final snapshot of it, however since then I've blown it away anyhow and started working on the proper implementation. I don't think we need the history for the temporary stuff. >>>> >>>> Agreed with the collective PL release. As for the version number, did we ever do a 2.x release? If so, then I agree we should update it to 3.x for the new project. >>>> >>>> Shane >>>> >>>> On 04/10/12 01:06, Anil Saldhana wrote: >>>>> Shane, >>>>> ahh. You could not wait a day or two. :) I am wondering if we could have retained history via some form of "git mv". >>>>> >>>>> We should probably have PicketLink version as 3.0 for all the code and rather than do individual releases, we can do a collective PL3.x release. >>>>> >>>>> Cheers. >>>>> >>>>> On 10/02/2012 04:56 AM, Boleslaw Dawidowicz wrote: >>>>>> I restored our branches and synced with Shane on IM. >>>>>> >>>>>> picketlink-idm/master will be nuked and only contain some README pointing to new locations >>>>>> >>>>>> Current picketlink-idm repo will be kept for few more months at least and after we are in more calm situation with GateIn/EPP it will be renamed into picketlink-idm-legacy. >>>>>> >>>>>> Things under control :) >>>>>> >>>>>> Bolek >>>>>> >>>>>> On Oct 2, 2012, at 11:08 AM, Boleslaw Dawidowicz <bdawidow(a)redhat.com&gt; wrote: >>>>>> >>>>>>> I must say I'm quite pissed off… even yesterday I shared a link to one of configuration files in 1.4 branch with a consultants. We released twice last month… how could have it happened without any question? >>>>>>> >>>>>>> >>>>>>> On Oct 2, 2012, at 11:06 AM, Boleslaw Dawidowicz <bdawidow(a)redhat.com&gt; wrote: >>>>>>> >>>>>>>> Have you just removed picketlink-idm on github? >>>>>>>> >>>>>>>> We are actively working on 1.4 branch and this is critical for EPP. Other branches are still maintenance for older versions of GateIn/EPP. I think I was fairly clear that we need those. >>>>>>>> >>>>>>>> This repo needs to be restored ASAP. >>>>>>>> >>>>>>>> On Oct 2, 2012, at 12:30 AM, Shane Bryzak <sbryzak(a)redhat.com&gt; wrote: >>>>>>>> >>>>>>>>> In the interests of presenting a clear message to our developers, one of the steps we'll be taking is to consolidate the various PicketLink projects into a single project and presenting this as the "go to" solution for application security. For now I've merged the CDI and IDM subprojects (these are now submodules of the PicketLink project, with "CDI" renamed to "Core") and the plan is to eventually merge the social and federation modules also. >>>>>>>>> >>>>>>>>> You can find the new GitHub repository here: https://github.com/picketlink (renamed from picketlink-cdi) and the picketlink-idm repository has now been deleted. For anyone working on these modules, please use the new repository from now on. >>>>>>>>> >>>>>>>>> Thanks! >>>>>>>>> Shane >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> security-dev mailing list >>>>> >>>>> security-dev(a)lists.jboss.org >>>>> https://lists.jboss.org/mailman/listinfo/security-dev >>>> >>>> >>>> >>>> >>>> _______________________________________________ >>>> security-dev mailing list >>>> >>>> security-dev(a)lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/security-dev >>> >>> >>> >>> _______________________________________________ >>> security-dev mailing list >>> >>> security-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/security-dev >> >> >> >> >> _______________________________________________ >> security-dev mailing list >> >> security-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/security-dev > > > _______________________________________________ > security-dev mailing list > security-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/security-dev _______________________________________________ security-dev mailing list security-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/security-dev