Rucio Meeting

Thursday 6 Aug 2026, 15:00 → 16:00 Europe/Zurich

Dimitrios Christidis (CERN)

15:00 → 15:05 News

• Security announcement
  • Authentication exploit using challenge tokens was identified and fixed in the Rucio 41.1.1, 40.4.2, 38.6.1, and 35.9.1 releases
  • Please update!
  • Security advisory / CVE coming soon
• Meeting schedule
  • Summer schedule!
  • Aug-06
  • Aug-13
  • Aug-20
  • Aug-27
• Release schedule
  • Aug-18 41.2.0
  • Aug-19 35.9.2 LTS Last release in 35, then EOL
  • Aug-19 38.6.2 LTS
  • Aug-31 41.3.0
• New team member @ CERN
  • Welcome Tomasz!

15:05 → 15:25 Community News & DevOps roundtable

• ATLAS
  • Pods being OOM-killed due to Harica CA (very large CRLs)
    • fts-cron and automatix affected; raising the memory limit solved the issue
    • Some sites also reported some instability
• CMS
  • Also affected by Harica CA
  • Q: When does a STUCK rule transition to SUSPENDED?
    • Only if it actually remains STUCK of two weeks; if a new request is created, then the rule may transition between STUCK and REPLICATING indefinitely.
    • Typically, will transition to SUSPENDED if no source is available, the RSE is excluded for writing, or there is not transfer path between the two.
    • Should this behaviour change? To submit a GitHub issue.
• Fermilab / DUNE / RUBIN
  • Upgraded to apply the security patch
  • Undergoing data preview
  • Token timeline
    • DUNE needs to transition away from X.509 by March 2027
    • Client workflows are critical
• HEPCCE
  • Rucio with Globus integration on-going
    • Successful submission of transfers, but transition (polling) still under work
• CTAO
  • Also affected by Harica CA
  • Upgraded to apply the security patch
• DaFab
• IHEP
• EPIC
  • Token timeline
    • Need to transition away from X.509 likely by October 2026
    • Testing upload with tokens; aiming for file-specific tokens
  • CILogon
    • FTS not following the RFC; FTS3 cannot correctly exchange the provided token right after transfer submission
    • Will try to fix it in FTS4; switched to unmanaged tokens in the meantime
• RI-SCALE
  • Planning to deploy Rucio and FTS on Kubernetes
• MADDEN
  • Q: Expected timeline for review/merge of PRs during August?
    • Difficult to say.
  • Q: Can a PR closed by the bot be reopened?
    • Yes, if the source branch has not been modified. The bot’s message should explain why it was closed.
• SKAO
  • Replaced an old Rucio instance entirely; switched from the hash to the identity LFN-to-PFN algorithm in the process

15:25 → 15:55 Developers roundtable

• Reflection about ongoing Sprint 1 (Sprint Board)
  • •  
• PR review sprint/marathon
  • ?
• Rucio 42 priority followup
  • Todo
    • M: Enable upload from the UI #100 [None]
    • XL: Implement CI checks for containers repo #526 [Ben, Reviewer: Mayank]
    • L: Create a new API endpoint for the clients to request tokens #6638 [Dimitrios, Reviewer: Martin]
    • M: Implement new token authentication for download #7029 [Dimitrios]
    • S: Update test images to MySQL 8.4 using the new `mysql-native-password` flag #6759 [Dimitris]
    • S: Move Postgres14 tests to Postgres16 #6997 [Dimitris]
    • M: Alembic migration pruning for unsupported Rucio versions #8594 [Dimitris]
    • L: `session` parameter in `*_session` decorated functions is required, but effectively treated as optional #6989 child of #6986 [Dimitris, Reviewer: Martin]
    • L: Change 3 remaining function-based indices #6248 [Dimitris, Reviewer: Martin]
    • XL: Add the possibility to archive metadata for deleted DIDs #5484 child of #8011 [Dimitris, Reviewer: Martin]
    • XS: npm_and_yarn dependabot jobs failing #123 [Francesc]
    • M: Do not use regex to split did, use scope extraction method #7519 [James]
    • S: `extract_scope`: should the `scopes` argument be removed? #8188 [James]
    • L: Plugins and policy packages: using plugin entry points for discovery? #7572 [James, Reviewer: Ben]
    • M: Deprecate old CLI interface #8700 [Maggie]
    • M: Access "RSEFileAssociation.AccessedAt" from the client #8540 [Maggie]
    • M: Remove QoS Policy functionality #8520 [Maggie]
    • None: Investigate replacements for MKDocs #840 [Maggie]
    • L: Account usage counters getting out of sync #6464 [Martin, Reviewer: Dimitrios]
    • M: add_rule with rule_grouping = NONE doesn't correctly respect the space left on the RSE #5845 [Martin]
    • XL: Replace Env Generator Tool and EnvConfigGateway with Zod Schema-Based Env Validation #753 [Mayank]
    • XL: [EPIC] UX improvements (Target 40) #621 [Mayank]
    • XL: Reduce CI/testing runtimes #8684 [Rohit, Reviewer: Dimitris]
    • L: Create a design doc for the Subscriptions refactoring #8714 [cserf]
  • In Progress
    • XL: Fixing dependency management #8500 [Ben, Reviewer: Martin]
    • S: Fix performance issue for `test_overlapping_containers_and_wildcards` #8723 [Dimitris, Rohit]
    • XL: Add a scanner for DAVS with the same interface as xrootd scanner #24 [Eric]
    • L: Upgrade Globus Protocol and Transfer Tool to use Globus SDK >=3 #8655 [Maggie, Reviewer: Martin]
  • In Review
    • S: Replace "Client().add_distance(...)" parameters dictionary argument with kwarg "distance" #8521 [Maggie]
  • Done
  • Delayed
• Other discussion
  •  

15:55 → 16:00 AOB

• Dependency-related issue with the Rucio 35.9.1 container images
  • Please use 35.9.1.post1