[ismisepaul]

Summary

Removes src/test/scripts/pgp-verification-test.sh, its step in test.yml, and the pgp.keysMap property in pom.xml that existed only so the script could try a wrong key. AGENTS.md is updated to match.

Why

The script failed intermittently on build.shibboleth.net. Three CI runs in the last week failed on it and passed when re-run, each with build.shibboleth.net:443 failed to respond and each after mvn clean install had already passed from the Maven cache. The script bypassed that cache by downloading every dependency into two empty local repositories. It also edited a tracked file and corrupted a jar to run its checks.

What stays

These all still run in the normal build:

• PGP signature verification (pgpverify-maven-plugin, .mvn/pgp-keys.map)
• The pinned Shibboleth release key
• The repository allowlist (.mvn/maven.config, .mvn/rrf/)
• The Maven 3.9.2+ enforcer rule

Trade-off

Nothing now checks that these controls still reject bad artifacts. The repository filter and the key pin can stop working without an error, so a regression there would go unnoticed.

A pom.xml change still misses the Maven cache and downloads from Shibboleth in every job, so the same failure can happen there. A re-run should clear it.

Testing

• mvn validate passes with the pom.xml change, verifying 202 signatures.
• The full local CI pipeline in AGENTS.md was not run before pushing, so CI on this PR is the first full run.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

The removed negative dependency-trust tests leave CI unable to detect a broadened Shibboleth key pin or disabled repository filtering, so isolated rejection checks are needed to restore coverage.

No open issues 🎉

What changed in this PR

Removes the dependency-trust regression script to reduce intermittent CI failures caused by fresh downloads from Shibboleth. Normal Maven signature verification, key pinning, and repository filtering remain enabled, but their rejection paths lose automated coverage.

Changes:

• Deletes the regression script and its CI step.
• Replaces the test-only pgp.keysMap property with the direct key-map path.
• Updates contributor instructions to reflect the removal.

File	Description
src/​test/​scripts/​pgp-verification-test.sh	Deletes dependency-trust rejection checks.
pom.xml	Points signature verification directly to the key map.
AGENTS.md	Removes the script command and coverage description.
.github/​workflows/​test.yml	Removes the script’s CI step.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Removing the only negative tests for dependency-trust controls creates a supply-chain regression-detection gap requiring maintainer acceptance, compounded by the reported omission of the required full local CI run.

No open issues 🎉

_{Review effort: Balanced}

[ismisepaul]

We shouldn't build and maintain a test framework, a gap in the dependency manger should be fixed upstream or by moving to a different tool, not with project-specific scripts, that prove flakey.