Rucio Meeting

Thursday 7 May 2026, 15:00 → 16:00 Europe/Zurich

Dimitrios Christidis (CERN)

15:00 → 15:05 News

• Rucio Security releases due to two SQL injections
  • SQL Injection in FilterEngine Oracle JSON Path via DID Search API (GHSA-vjr5-c9qv-hgm3, CVE-2026-29080)
    • Only ATLAS & CMS affected, hotfixed in the last weeks
  • SQL Injection in External PostgreSQL Metadata Plugin via DID Search API (GHSA-6j7p-qjhg-9947, CVE-2026-29090)
    • Affects the EXTERNAL postgres metadata plugin
  • Fixed in
    • 35 LTS -> 35.8.5
    • 38 LTS -> 38.5.5
    • 39 -> 39.4.2
    • 40 -> 40.1.1
  • Please update!
• No meeting next week (Ascension day)

15:05 → 15:25 Community News & DevOps roundtable

• ATLAS
• CMS
• Fermilab
  • DUNE
    • PgBouncer deployed on production
    • Will set up another development instance for the purpose of testing the Rucio/Globus integration
    • Deletion from tape RSE (Q on Mattermost)
      • Removal of the replica with SQL is not recommended; maybe update the replica paths instead?
• ePIC
• INFN Datalake
• RI-SCALE
  • TPC transfers with OIDC and WebDAV successfully demonstrated
• CTAO
• MADDEN
• IHEP

15:25 → 15:55 Developers roundtable

• Reflection about ongoing Sprint 2 (Sprint Board) [Ben]
  • ‘Reporting on the current Rucio sprint, in case my internet breaks off again: There is little planned this sprint, some replies that they do not have time, others I don't really know. What was planned for the sprint seems to be on-track and worked on.’
• PR review sprint
  • 33 -> 34
• Rucio 41 priority followup
  • Todo
    • XL: Convert RSE availabilities from a boolean to an enum #6660 [Ben, Reviewer: Dimitrios]
    • M: Datasets erased through the Reaper do not produce any messages #8022 [Ben]
    • M: Old WebUI OIDC must not use Host header for authentication flow #8473 [Ben]
    • S: Rucio WebUI authentication cookie without HttpOnly flag #8475 [Ben]
    • L: Create a new API endpoint for the clients to request tokens #6638 [Dimitrios, Reviewer: Martin]
    • M: Implement new token authentication for download #7029 [Dimitrios]
    • XL: Rucio support for full-structure metadata #8011 [Dimitris, Reviewer: Martin]
    • XS: Rucio Python Client docstrings enhancement (`Configclient`) #513 child of #363 [Dimitris, Maggie]
    • XS: Rucio Python Client docstrings enhancement (`Ruleclient`) #529 child of #363 [Dimitris, Maggie]
    • XS: npm_and_yarn dependabot jobs failing #123 [Francesc]
    • XS: Cannot authenticate to account with given credentials [x509 proxy] #98 [Francesc]
    • L: Token refresh after expiration #73 [Giovanni]
    • L: Prevent multiple Reaper threads from working on the same replicas #6512 [Hugo, Reviewer: Dimitrios]
    • M: Do not use regex to split did, use scope extraction method #7519 [James]
    • M: Schema values overridden in policy package are not picked up unless at top level #7731 [James]
    • M: rucio upload does not check that the user has permission to add DIDs #6058 [James]
    • S: Remove SRM and GridFTP protocols #8497 [Maggie]
    • L: Make scope optional in all API endpoints using scope + name information #8196 [Maggie, Reviewer: Max]
    • L: allow wildcard * on a scope level for list_dids #6070 [Max, Reviewer: Mario]
    • M: Let metadata plugins implement `get_metadata_bulk` #7324 [Max]
    • XL: Permission Management based on the server side Policy #739 [Mayank]
    • XL: Replace Env Generator Tool and EnvConfigGateway with Zod Schema-Based Env Validation #753 [Mayank]
    • XL: Feature Flags Subsystem for Page/View Enablement #752 [Mayank]
    • XL: Simplify what we run on CI (test suites, OS, Python versions, DB, …) #7965 child of #7667 [Mayank, Reviewer: Ben]
  • In Progress
    • M: remove auto feature for oidc auth #8318 child of #7310 [Anil]
    • XL: Fixing dependency management #8500 [Ben, Reviewer: Martin]
    • XL: Fix flaky tests #8270 [Ben, Reviewer: Dimitris]
    • XL: Finalise CLI command structure #8349 [Maggie, Reviewer: Dimitrios]
    • XL: [EPIC] UX improvements (Target 22) #621 [Mayank]
  • In Review
    • XS: Wrong documentation for `dids/scope/name/files` call #8053 [Dimitris]
    • S: Rucio Python Client docstrings enhancement (`Rseclient`) #528 child of #363 [Dimitris, Maggie]
    • S: Rucio Python Client docstrings enhancement (`Accountclient`) #509 child of #363 [Dimitris, Maggie]
    • M: Generate "Configuration parameters" documentation page automatically, to avoid mismatches between documentation and code #325 [Maggie]
    • M: Change mixed prometheus_client and probe_metric approachs to use PrometheusPusher #129 [Maggie]
    • S: Make loaded CLI options configurable #8494 child of #8349 [Maggie]
  • Done
    • S: Improve Juptyerlab extension operator guide #768 [Giovanni]
    • XL: Test stability on LTS branches #7964 child of #7667 [Karan, Reviewer: Martin]
  • Delayed
• Other discussion
  •  

15:55 → 16:00 AOB