Deprecate this repo in favour of an active fork

[LoneRifle]

The organisation I work for has moved from SAML to OIDC for authentication, and hence I have less motivation to be active on this repo. Since @yaronn is still the admin and owner of this repo, all requests to be given write rights for the repo must go through him, even though he has been inactive on xml-crypto for a while.

This package is still in demand though, as evidenced by recent proposals to add a new KeyInfo implementation, and by its use in node-saml, of which @cjbarth is an active maintainer. We could ask for a transfer of this repo to a new organisation, but @yaronn is inactive and we don't know when he would be able to accede to the request.

Given this, I would like to propose that:

• a new repo based on this one is created and actively managed by current users of this package;
• the xml-crypto npm package is published from that new repo, and;
• a prominent notice is added to the README of this repo indicating in no uncertain terms that this repo is inactive and to use the new repo.

@cjbarth, what do you think?

[yaronn]

@LoneRifle if you want to create a new organization and add all maintainers there I can make an ownership transfer to that organization.

[LoneRifle]

@LoneRifle if you want to create a new organization and add all maintainers there I can make an ownership transfer to that organization.

With @cjbarth's or @marksto's consent, I would like this transferred to the @node-saml organisation

[bjrmatos]

even though i am no longer involved in the project, if it helps i am all in favor of transferring the repo to new org and it to be managed by the active maintainers/contributors

[cjbarth]

I'm not currently in favor of moving this to a new organization because of the types. node-saml and passport-saml are TypeScript projects, so we depend on the types. Currently the community maintains types in the DefinitelyTyped repository and moving this package would break that, requiring that we either move those types into this project, or we republish the types for this package's new home.

What would be the advantage of moving this package to a new home?

Side note, I note that I was invited to be an owner of the NPM package, but the invitation expired while I was out of town.

[cjbarth]

As a point of reference, it doesn't seem like there are any forks that are particularly active. However, with over 750,000 weekly downloads, it does seems some direction is needed for this very popular package.

[cjbarth]

I see that Auth0 has forked this project (though it is quite behind). Perhaps @shane-tomlinson would have something to say about Auth0 being involved in maintaining this package.

[LoneRifle]

@cjbarth - I'll resend the invite tmr!

[LoneRifle]

I'm not currently in favor of moving this to a new organization because of the types. node-saml and passport-saml are TypeScript projects, so we depend on the types. Currently the community maintains types in the DefinitelyTyped repository and moving this package would break that, requiring that we either move those types into this project, or we republish the types for this package's new home.

The npm package name would remain the same though. The discussion is only for the GitHub repo to be created or transferred to a new organisation (the latter now favoured given that yaronn can facilitate the transfer), so as long as the package name remains the same, I can't see how the DT types will break. Is it node-saml policy that all packages from the org must be prefixed with org name?

What would be the advantage of moving this package to a new home?

More active ownership, so that individuals can join the core dev team for this repo more easily.

[cjbarth]

Ah, that might be where I misunderstood, moving just GitHub and not NPM. We moved passport-saml to an organization for just that reason. We actually moved the package to an organization for that same reason as well (which is probably why I made the assumption that you wanted to move both). I think I'm OK with it, but right now, I'm doing most of the work on passport-saml and node-saml and I don't have the bandwidth to take on more. In fact, the way things are going, we too may be moving away from SAML at some point, which would change my priorities.

Ultimately we need more maintainers, not to throw the package at an organization in hopes that will fix it. Has anyone else expressed interested in helping maintain this package?

[LoneRifle]

@cjbarth unfortunately we might be the only two semi-active maintainers at this point. I largely agree with your view; it's unfortunate that SAML on node is a specific niche that will only get narrower over time.

A transfer to @auth0 (along with node-saml?) would be ideal given that this is what they do, and they already maintain xml-encryption. I don't know if they have any desire too though.