Rucio Meeting

Thursday 17 Jul 2025, 15:00 → 16:00 Europe/Zurich

Martin Barisits (CERN)

15:00 → 15:05 News

• Security advisory for helm-charts
  • Insertion of credentials in the logfile
    • Rucio deployment via our common helm-charts, the helm-charts define the logformat of the apache access log (unless manually changed).
    • This logformat adds the x-rucio-auth-token to the access log. In many cases, this will be a truncated credential (Especially for a JWT, since they are long) but in some cases it might be a full credential which does not belong into a logfile.
    • We created releases where this logformat is changed to mention the account name instead. Please have a look on the advisory for the affected and patched versions.
  • https://github.com/rucio/helm-charts/security/advisories/GHSA-cmfq-f2v2-vj33
    • In process to assign a CVE
  • Thanks to S. Timm (FNAL) for reporting
• Rucio 38 "Donkirk" Feature Freeze!
  • RC1 next week
• 38 Release retrospective
  • July 31! (Next meeting)

15:05 → 15:25 Community News & DevOps roundtable

• ATLAS
• CMS
• Fermilab RUBIN DUNE
  • Update metadata for checksum
• DaFab
  • Summer school in September -> Link
• ESCAPE
• SKAO
• CERN IT
• MADDEN
  • Implemented account auto-mapping for a specific IdP
  • Implemented multiple servers on client side
• IHEP
  • Large amounts of data transfers next week!

15:25 → 15:55 Developers roundtable

• Reflection about ongoing Sprint 7 (Sprint Board) [Riccardo]
  • • Last sprint in the cycle
    • Lots to review, but doing OK
• Priority Followup for Rucio 38 "Donkirk" major release
  • Todo
  • In Progress
    • Prevent multiple Reaper threads from working on the same replicas #6512 [Hugo]
      • Update
  • In Review
    • factorize duplicate messaging code into a common module or class #6423 [Alex] 
    • More useful client docstrings and CLI help messages #363 [Dimitris]
    • Add docs for daemon arguments #499 [Maggie]
    • Update test/test_bin_rucio to use fixtures where applicable #7641 [Maggie]
    • race in token creation when running multiple clients on same host #7185 [Maggie]
    • New CLI: Release 38 Bugs/Improvements #7658 [Maggie]
      • Many PRs in review
    • EPIC: Migration to NX Monorepo #549 [Mayank]
    • EPIC: UX Improvements #547 [Mayank]
    • Record rule error for STUCK rule if rse_expression excludes lock_rse in the meanwhile #7538 [Riccardo]
    • Fix static code analysis behaviour for functions decorated with @transactional_session, @read_session and @stream_session #6986 [Riccardo]
      
      • Gateway completed, daemons and core as well
    • Rework OIDC user authentication #7310 [Anil]
    • Dependencies: deprecate setup.py and move to pyproject.toml #6971 [Riccardo]
    • Improve TEMP_UNAVAILABLE replica handling #7666 [Riccardo]
  • Done
    • cx_oracle -> python-oracledb dependency upgrade #6467 [Dimitris]
    • Re-Factor test infrastructure #7667 [Dimitris, Karan, Mayank, Riccardo]
      • for this release, then ongoing
    • Improve handling of errors in Rucio REST API calls #39 [Enrique, Giovanni]
    • Policy Package FAQ & emphasis on important details #494 [Riccardo]
    • Plugins and policy packages: using plugin entry points for discovery? #7572 [Riccardo]
    • Add the possibility to archive metadata for deleted DIDs #5484 [Rob, Cedric]
    • Traces : No gateway for traces #7256 [Maggie]
    • EPIC: Handle DID schemas with / #548 [Mayank]
    • Add link to FTS transfers for rules #517 [Mayank]
  • Delayed
    • Create a new API endpoint for the clients to request tokens #6638 [Dimitrios]
    • Implement new token authentication for download #7029 [Dimitrios]
    • Make 0 the top protocol priority #6312 [Dimitrios]
    • Developer Guidelines for Reviews, Testing Requirements #538 [Martin]
    • Metrics API endpoint: include UNKNOWN sources #6565 [Maggie]
    • Integrate OIDC endpoints for Authorization Code Grant Type #507 [Mayank]
    • Run rucio/rucio integ tests for PRs in rucio/containers #310 [Riccardo]
    • Rucio dependencies in test environments should be installed the same way they are installed when Rucio is installed as a package #344 [Riccardo]
    • Merge rucio/rucio/etc/docker/ and rucio/containers/dev #7532 [Riccardo]
• Miscellaneous
  • •  

15:55 → 16:00 AOB