Azure-activedirectory-identitymodel-extensions-for-dotnet: Accidental 6.5.0 release?

[Blackbaud-ChristiSchneider]

Was the 6.5.0 version released on purpose? https://www.nuget.org/packages/Microsoft.IdentityModel.Tokens/6.5.0

There are no documentation updates, changelog, or release listed on github.

[brockallen]

Huh, going from 5.6 to 6.5?

[Blackbaud-ChristiSchneider]

Was that a question for me?

[brockallen]

No... more of a comment about what's happening with this package. Apparently behind the scenes stuff that doesn't get released publicly.

[Blackbaud-ChristiSchneider]

That's why I filed this - I do not think that this version was supposed to be released like this, and was likely an accident. There's no version 6.5.0 checked in in the master branch.

[brentschmaltz]

@Blackbaud-ChristiSchneider @brockallen @AndersAbel

This is not accidental nor a conspiracy :-).
There have been two branches for a long time dev5x and dev, both are public.
Signed 6.x nightlies have been pushed publicly.
We started a public conversation with @leastprivilege (representing IdentityServer) indicating our direction.
Other users have used the 6.x nightlies to verify fixes.

We have been managing two release branches and keeping them in sync requires resourcing.

A big issue is the requirement to remove ANY assembly that Microsoft doesn't build since we work in the Authn / Authz as we can't guarantee back-compat or a strict build environment.

The biggest feature in the 6.5.0 release is SignedHttpRequest, this was too large to port in 5.5.0.
We determined that it was time to release 6.x with this feature rather than back port.

We determined that asp.net builds and tests pass with the new libraries.
Upgrade scenarios work as expected.
We expect that an application should be able to upgrade with few or a small number of issues.

We will be releasing proper release notes soon.

[AndersAbel]

Why did you go to 6.5.0 instead of making the new release 6.0.0?

[brentschmaltz]

@AndersAbel internally we had to meet security requirements of no external packages at the Authn / Authz layer. Plain and simple. This is one of the reasons for JsonWebToken (mapping aside :-) )

Most commits were put into both 5.x and 6.x.
We couldn't resource releasing 6.x public until now.
Since internal users are using 6.4.1 we had to release 6.5.0 for nuget to work.

Now internal products and external use the same assemblies and we can release from one branch.

The pending WCF support on the client that requires support for wstrust and some other WS-* support will only be in 6.x.

If you examine the dev5x and dev branch commits you will see pattern.

[Blackbaud-ChristiSchneider]

Why is 6.5.0 not available in the releases area on github and why isn't the documentation indicating that this version exists in the master branch? This sort of activity is very suspicious - like the malicious npm package release from a couple years ago that affected basically everyone.

[brentschmaltz]

@Blackbaud-ChristiSchneider that is fair criticism. We will address this.
As for our master branch, that is way out of sync. We haven't been following best practices with master.

Our packages and the internal assemblies are signed.
Nuget requires packages from Microsoft to be signed.

[brentschmaltz]

@Blackbaud-ChristiSchneider release has been tagged. Release notes published.

[brentschmaltz]

We hope everyone is satisfied, closing out this issue.