• an upstream metadata feed from an identity federation contains a CR as a literal character reference ("
"  or "&#xD")
• the feed is aggregated as is in the eduGAIN metadata
• another identity federation pick up the eduGAIN metadata and republish it to their own parties leaving untouched the CR

(2016) Relying parties not able to validate the metadata

(2019-08-21) .NET based signature validation fails  (ADFSToolkit and other Powershell aggregate handlers impacted) - signaled by InCommon member to ADFSToolkit team via ADFSToolkit issue tracker , escalated and resolved by InCommon support. 

(2020) .NET based signature validation fails (ADFSToolkit and  other Powershell aggregate handlers not able to validate the metadata)

• Warn and remedy by the Identity Federation responsible for the feed

• Reject the upstream feed containing the CR