From 02c0de47098bc860c776bf4cf23780d228974edf Mon Sep 17 00:00:00 2001
From: James Rosewell <james@51degrees.com>
Date: Sat, 5 Sep 2026 16:56:02 +0100
Subject: [PATCH] BUILD: Move owid-java to the key selection fix, exclude
 PublicKeyFetch

The 51Degrees/owid-java fork took SWAN-community/owid-java#6 on
5 September 2026, which adds PublicKeySchedule and DatedPublicKey and
selects the creator's signing key by the start of its period rather
than the moment it was generated. The submodule moves from 694f6333 to
764996e0, whose tree is identical to SWAN main at b92f1cd2.

pipeline.did compiles the submodule source with -Xlint:all -Werror at
source and target 1.8, and on JDK 21 the new HTTP-only PublicKeyFetch
class trips the deprecation of URL(String). The module does not use
that class, because DidClient fetches the cloud's published key list
from id/key through its own HttpTransport, so it is excluded alongside
Endpoints and the pom comment says why.

mvn -pl pipeline.did test on JDK 21: 127 tests, 0 failures, 2 skipped.
Fixture check: the real 4 September identifier verifies under the key
starting 31 August 2026 and answers Invalid on the schedule shifted a
week.
---
 owid-java            | 2 +-
 pipeline.did/pom.xml | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/owid-java b/owid-java
index 694f63332..764996e03 160000
--- a/owid-java
+++ b/owid-java
@@ -1 +1 @@
-Subproject commit 694f63332734132f9e432b9bf1e9ecb734af1b1c
+Subproject commit 764996e03ae231d871168cdec2787e99bac9160c
diff --git a/pipeline.did/pom.xml b/pipeline.did/pom.xml
index 4598505c4..2684f3a99 100644
--- a/pipeline.did/pom.xml
+++ b/pipeline.did/pom.xml
@@ -69,8 +69,10 @@
     <build>
         <plugins>
             <!-- Compile the OWID submodule source directly into this module,
-                 excluding the HTTP-only Endpoints class which is not needed
-                 for offline parse and verify. -->
+                 excluding the HTTP-only classes (Endpoints and
+                 PublicKeyFetch), which are not needed for offline parse
+                 and verify. The 51Did client fetches the cloud's published
+                 key list itself, through its own transport. -->
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>build-helper-maven-plugin</artifactId>
@@ -96,6 +98,7 @@
                 <configuration>
                     <excludes>
                         <exclude>**/com/swancommunity/owid/Endpoints.java</exclude>
+                        <exclude>**/com/swancommunity/owid/PublicKeyFetch.java</exclude>
                     </excludes>
                 </configuration>
             </plugin>