Rucio Meeting

Thursday 5 Feb 2026, 15:00 → 16:00 Europe/Zurich

Dimitrios Christidis (CERN)

15:00 → 15:05 News

• WebUI 38.3.0 security fix [Mayank]
  • CVE-2025-55182 (React2Shell) — CVSS 10.0
• February release schedule

  Release	Date	Note
  35.8.3 LTS	Feb-10	Delayed to Mar-09 if empty
  38.5.2 LTS	Feb-10
  39.X	Feb-16

• Next week meeting cancelled!

15:05 → 15:25 Community News & DevOps roundtable

• ATLAS
  • New WebUI deployed
• CMS
  • Also deployed new WebUI
  • WLCG OTF with a focus on tapes
    • Submitters not submitting fast enough
    • Is it possible to assign source RSEs to a particular Submitter instance?
      • No, it is not.
• Fermilab DUNE / RUBIN
  • Issue with OIDC authentication when same identity assigned to multiple accounts (Mattermost)
    • Also noticed by other communities
• DaFab
• CERN IT
• RI-SCALE
  • Endpoints for RI-SCALE at CERN now accessible
  • Configuration of the web UI in progress
• CTAO
  • Rucio 39 deployed on a pre-production instance
• ESCAPE
  • Is it possible to assign permissions based on IAM roles?
    • Typically, with an external sync creation accounts and/or account attributes
    • This is then used in the permissions (policy package)
  • Is it possible to hide some scopes to specific users?
    • For the namespace: no.
    • For the content of the files: it will be possible in the future with tokens.
• MADDEN
  • Issue in multi-RI client implementation → will open issue
  • PR with changes on the server-side breaks a test (#8305)
• INFN Datalake
  • Completed test: TPC with OIDC and S3 storage
  • Opened issue about token support with non davs-scheme (documentation#742) → to be moved to the main Rucio repository
• ePIC

15:25 → 15:40 Contributing Guide: The Case for Atomic Flow

Speaker: Dimitrios Christidis (CERN)

2026.02.05 Contributing Guide: The Case for Atomic Flow.pdf

15:40 → 15:55 Developers roundtable

• Reflection about ongoing Sprint 3 (Sprint Board) [Ben]
  • Handful of developers reported their availability
  • Not much progress on the issues yet
• PR review sprint
  • Slightly increased 50 → 56
• cio 40 priority followup
  • Todo
    • Create a new API endpoint for the clients to request tokens #6638 [Dimitrios]
    • Implement new token authentication for download #7029[Dimitrios]
    • More useful client docstrings and CLI help messages (Target: 15/25) #363 [Dimitris]
    • DIDs not being shown correctly in the extension after a successful download #95 [Giovanni]
    • Make available + Add to Notebook features failing #83[Giovanni]
    • Prevent multiple Reaper threads from working on the same replicas #6512 [Hugo]
    • Generate "Configuration parameters" documentation page automatically, to avoid mismatches between documentation and code #325 [Maggie]
    • Change mixed prometheus_client and probe_metric approachs to use PrometheusPusher #129 [Maggie]
    • Possible Belle II specific code in DIRAC functionality #7824[Max]
    • Remove hard-coded one-day lifetime in DIRAC API #8172[Max]
    • [ EPIC ] : Mutation Operations and Role Based Access to pages/features (Target 5) #622 [Mayank]
  • In Progress
    • Token refresh after expiration #73 [Giovanni]
    • Do not use regex to split did, use scope extraction method #7519 [James]
    • Test stability on LTS branches #7964 child of #7667 [Karan]
    • Copy implimentation of CLI to new CLI structure #8295[Maggie]
    • Simplify what we run on CI (test suites, OS, Python versions, DB, …) #7965 child of #7667 [Mayank, Karan]
    • [EPIC] UX improvements (Target 22) #621 [Mayank]
  • In Review
    • Consider using Python venvs in containers to avoid conflicts with system-installed packages #458 [Ben]
    • Add startup self-check mechanism to block Rucio services when critical diagnostics fail #8197 child of #8011 [Dimitris]
    • Ensure PostgreSQL ENUM types created during Alembic migrations honor the configured schema #8145 child of #7737[Dimitris]
    • Wrong documentation for dids/scope/name/files call #8053[Dimitris]
    • Testing: Make tools/run_tests.sh idempotent #7737 child of #7667 [Dimitris]
    • No way to check or change ownership of a scope using Rucio client #7830 [Maggie]
    • Migrate from Jobber to simple Cron #152 [Eric]
  • Done
    • Listing containers with more than 10k entries breaks the kernel #102 [Giovanni]
    • Rucio silently skips importing configured policy package in case of errors #7962 [Max, James]
  • Delayed
    • Stop auto-forwarding of old-style CLI commands #8294[Maggie]
• Other discussion
  •  

15:55 → 16:00 AOB