URT:Agenda-22-06-2015

Adobe connect direct link	Conference system is on adobe connect, no password required.
Indico page for the meeting

UMD releases status

• Proposal for UMD4 release presented at last OMB: https://indico.egi.eu/indico/conferenceDisplay.py?confId=2375
  • Will support EPEL7, Ubuntu
  • First release of UMD4: SEPTEMBER 2015

Status of the products verification/staged rollout

Released

• UMD 3.12.0 released on *05.05.2015*:

• • ARGUS-PAP, v. 1.6.4
  • dCache server, v.2.10.24

Under Staged Rollout

....

In Verification

• storm 1.11.8
• srm-ifce 1.22.1
• gfal2 2.8.4
• gfal2-python 1.7.1
• gLExec-wn 1.2.3
• cvmfs 2.1.20
• Xroot 4.1.1 (new)
• Dpm-Xroot 3.5.2 (new)
• Globus components (GridFTP,MyProxy,Gram5,globus-default-security)
• Dcache 2.10.31

Ready to be released:

• cream 1.16.5
• apel 1.4.1

Rejected

• cream 1.16.5 (sl5): Under Investigation
• -----

Timeline for the next UMD updates

• End May

Updates from the product teams

This section is directly contributed by the product teams. Please, add under your section the scheduled releases with a short comment about the updates introduced and where they are going to be released (EMI repositories, EPEL, private repositories ecc), linking external pages with these information is ok, but please add at least the expected date of the next release. It is important to discuss, within the URT, changes that may affect directly or indirectly other products. The text will be copied into the agenda of the next URT meeting, PT will just need to check that all the information are up to date. Please, feel free to alter the template if it doesn't feet with your needs.

APEL

• Release version 1.4.0 Released: 2013-02-16
  • Main changes: (including other products affected)
    • detailed release note are available at APEL 1.4.0 Changelog
  • Other information:

ARC

• Release version 5.0.1 planned for June
  • Main changes: (including other products affected)
    • Fixes a problem where A-REX fills up /var/log with heartbeat messages
    • Some JURA fixes (enables rereport feature)
  • Other information:

Argus

• ARGUS PAP v. 1.6.2
  • Released on: 2015-02-09
  • Main changes: fix for "SSL authentication errors for the pap-admin client after the upgrade to the latest JRE"

dCache

• Release version 2.10.20 Expected: next UMD release
  • Main changes: see appdb
  • Other information: Please make extra clear that this is a major upgrade within the repository and that all dCache services have to upgraded as there are backward incompatibilities with 2.6.

BDII

• Release version x.y.z Expected: 2013-xx-yy
  • Main changes: (including other products affected)
  • Other information:

DPM/LFC

• DPM
  • DPM-Xrootd 3.5.2 is in EPEL stable
  • this is the first version of the component compatible with xrootd4

Data management clients

• The CERN Data Management Clients publish their releases here: http://dmc.web.cern.ch/releases
• A new page with all releases and they status is available at https://dmc-docs.web.cern.ch/dmc-docs/
• A set of component in EPEL-testing now, which would like then to be part of UMD:

• • gfal2 2.9.1
  • gfal2-python 1.8.1
  • gfal2-utils 1.2.1
  • gfal2-plugin-xrootd 0.4.0
  • srm-ifce 1.23.1

will ask our colleagues at T0 to prepare the verification reports

FTS

• FTS3 - v. 3.2.32 in EPEL
  • https://svnweb.cern.ch/trac/fts3/milestone/FTS3%203.2.32

Frontier-Squid

• Release version: 2.7STABLE9-24.1; Released: 2015-06-03 -
  • Main changes: (details in http://frontier.cern.ch/dist/rpms/frontier-squidRELEASE_NOTES)
    • Fix support for multiple squids on a reverse proxy
    • Enable multiple squids to be independent (although still with same config)
    • Add support to run logging in a separate process
    • Lower i/o priority of log compression
    • Fix disabling of log compression
  • Other information (repository): http://frontier.cern.ch/dist/rpms

EMIR

• Release version: ; Expected:
  • Main changes:
  • Other information:

UNICORE

(expected in the course of 2015 that we will publish packages for UMD via AppDB at https://appdb.egi.eu/store/software/unicore

For now, packages for UNICORE 7.2.0 can be downloaded from

Debian: http://unicore-dev.zam.kfa-juelich.de/release-candidates/core/7.2.0-packages/deb

RPM: http://unicore-dev.zam.kfa-juelich.de/release-candidates/core/7.2.0-packages/rpm

RPM packages were tested on Centos 6, so SL6 will be fine. SL5 is NOT supported any more.

Changes are listed with respect to the last UNICORE version available in UMD which is 6.6.0

• UNICORE/X 7.2.0 (expected on: 2015-01-21)
  • Main changes: (including other products affected)
    • Product name is "unicore-unicorex"
    • New web services stack based on Apache CXF and Apache HTTPClient 4
    • RESTful API in addition to the SOAP/WS API
    • Many performance improvements
    • Many fixes for bugs and some security vulnerabilities (e.g. SSL POODLE)
    • For a full, detailed list of changes please refer to http://unicore.eu/changes/server.html
  • Other information:
    • This is a major update. We recommend uninstalling any older (6.6) version that you may have, and re-install from scratch.
    • UNICORE 7 is backwards compatible with UNICORE 6
    • HTML doc http://unicore.eu/documentation/manuals/unicore6/files/unicorex/unicorex-manual.html
    • PDF doc http://unicore.eu/documentation/manuals/unicore6/files/unicorex/unicorex-manual.pdf

• TSI 7.2.0 (expected on: 2015-01-21)
  • Main changes: (including other products affected)
    • There are now individual packages for the different supported batch systems
    • Product names are "unicore-tsi-nobatch", "unicore-tsi-torque", "unicore-tsi-lsf", "unicore-tsi-sge" and "unicore-tsi-slurm"
    • Several bug fixes
    • Improved support for SSL (e.g. when using IPv6, better error messages)
    • For a full, detailed list of changes please refer to http://unicore.eu/changes/server.html
  • Other information:
    • This is a major update. We recommend uninstalling any older (6.6) version that you may have, and re-install from scratch.
    • UNICORE 7 is backwards compatible with UNICORE 6
    • HTML doc http://unicore.eu/documentation/manuals/unicore6/files/tsi/tsi-manual.html
    • PDF doc http://unicore.eu/documentation/manuals/unicore6/files/tsi/tsi-manual.pdf

• Gateway 7.2.0 (expected on: 2015-01-21)
  • Main changes: (including other products affected)
    • Now based on Apache HTTPClient 4
    • Many fixes for bugs and some security vulnerabilities (e.g. SSL POODLE)
    • For a full, detailed list of changes please refer to http://unicore.eu/changes/server.html
  • Other information:
    • This is a major update. We recommend uninstalling any older (6.6) version that you may have, and re-install from scratch.
    • UNICORE 7 is backwards compatible with UNICORE 6
    • HTML doc http://unicore.eu/documentation/manuals/unicore6/files/gateway/manual.html
    • PDF doc http://unicore.eu/documentation/manuals/unicore6/files/gateway/manual.pdf

• Registry 7.2.0 (expected on: 2015-01-21)
  • Main changes: (including other products affected)
    • New web services stack based on Apache CXF and Apache HTTPClient 4
    • Fix for the SSL POODLE security vulnerability
    • For a full, detailed list of changes please refer to http://unicore.eu/changes/server.html
  • Other information:
    • This is a major update. We recommend uninstalling any older (6.6) version that you may have, and re-install from scratch.
    • UNICORE 7 is backwards compatible with UNICORE 6
    • HTML doc http://unicore.eu/documentation/manuals/unicore6/files/registry/registry-manual.html
    • PDF doc http://unicore.eu/documentation/manuals/unicore6/files/registry/registry-manual.pdf

• XUUDB 7.2.0 (expected on: 2015-01-21)
  • Main changes: (including other products affected)
    • New web services stack based on Apache CXF and Apache HTTPClient 4
    • Fix for the SSL POODLE security vulnerability
    • For a full, detailed list of changes please refer to http://unicore.eu/changes/server.html
  • Other information:
    • This is a major update. We recommend uninstalling any older (6.6) version that you may have, and re-install from scratch.
    • UNICORE 7 is backwards compatible with UNICORE 6
    • HTML doc http://unicore.eu/documentation/manuals/unicore6/files/xuudb/manual.html
    • PDF doc http://unicore.eu/documentation/manuals/unicore6/files/xuudb/manual.pdf

• UCC 7.x Expected on: TBD
  • Main changes: (including other products affected)
  • Other information:

LB

• Release version x.y.z Expected: 2013-xx-yy
  • Main changes: (including other products affected)
  • Other information:

Gridsite

• Release version x.y.z Expected: 2013-xx-yy
  • Main changes: (including other products affected)
  • Other information:

Proxyrenewal

• Release version x.y.z Expected: 2013-xx-yy
  • Main changes: (including other products affected)
  • Other information:

CANL

• Release version x.y.z Expected: 2013-xx-yy
  • Main changes: (including other products affected)
  • Other information:

gLite-security

• Release version w.k.j Expected on: 2013-xx-yy
  • Main changes: (including other products affected)
  • Other information:

gLExec-wn

• LCMAPS-plugins-C-PEP & EES(+xacml library)
• Release version x.y.z Expected: 2013-xx-yy
  • Main changes: (including other products affected)
  • Other information:

CREAM

• BLAH
• Release version x.y.z Expected: 2013-xx-yy
  • Main changes: (including other products affected)
  • Other information:

• CREAM
• Release version 1.16.5 Released: 2015-02-16
  • Main changes: (including other products affected)
    • CREAM 1.16.5 fixes & new features
  • Other information:

CREAM GE utils

• Release version X.Y.Z Expected: 2015-XX-YY
  • Main changes:
  • Other information:

STORM

• Release version 1.11.8 - 13.03.2015
  • Release notes can be found at: - http://italiangrid.github.io/storm/release-notes/StoRM-v1.11.8.html

VOMS

• Release versions:
  • VOMS Admin server v. 3.3.
  • VOMS Clients v. , VOMS API Java v.
  • VOMS C APIs, native clients and server v.
• Released version - VOMS Admin server v. 3.3.2 - released: 28.01.2015
  • Main changes: (including other products affected)
    • VOMS Admin server 3.3.2 with the "skip_ca" fix - http://italiangrid.github.io/voms/release-notes/voms-admin-server/3.3.2/
  • Other information:

WMS

• Release version x.y.z Expected: 2013-xx-yy
  • Main changes: (including other products affected)
  • Other information:

Globus

The updated globus-gssapi-gsi version 11.16 in EPEL testing changed the default name compatibility mode from "HYBRID" to "STRICT_RFC2818". This caused some issues when tested on some deployed systems. See the GGUS ticket for details:

https://ggus.eu/index.php?mode=ticket_info&ticket_id=114076

To remedy this upstream issued an updated version 11.18 that changed the default back to HYBRID. However, upstream considers this to be a temporary measure, and would like to change the default to "STRICT_RFC2818" eventually.

The EPEL update request has been modified to now use the 11.18 version.

The issues in the GGUS ticket were mainly due to configuration mistakes such as a reverse DNS lookup pointing to the wrong name or host certificates that didn't have the hostname listed in alt subject names and are basically understood.

Please provide feedback if you have objections to changing the default to "STRICT_RFC2818" in the future.

You can test the impact of different name compatibility mode settings on your software by changing the name resolution mode in the configuration file /etc/grid-security/gsi.conf (introduced in version 11.15) or by using the GLOBUS_GSSAPI_NAME_COMPATIBILITY environment variable. The environment variable has precedence over the config file setting.

The "HYBRID" setting in addition to the RFC 2818 way of doing name comparison also accepts the old GT2 way of doing this, which includes accepting matching to the name from the reverse DNS lookup. This by some is considered a security problem, and changing the default to "STRICT_RFC2818" will avoid this.

More details about the different name compatibility modes from /etc/grid-security/gsi.conf is copied below:

# GSSAPI Name compatiblity mode when trying to determine
# if a host certificate is legitimate. GSI predates RFC2818,
# so there are some old, less-secure, practices by default.
# The different modes are:
# STRICT_GT2:
#     Strictly backward-compatible with GT 2.0 name matching. 
#     X.509 subjectAltName values are ignored. Names with
#     hyphens are treated as wildcarded such that 
#     host-ANYTHING.example.com will match a certificate named
#     host.example.com. The name matching will rely on canonical
#     host (as resolved via getnameinfo) name associated with
#     a connection's IP addresses.
# STRICT_RFC2818:
#     Support RFC 2818 server identity processing. Hyphen 
#     characters are treated as normal part of a host name. 
#     dnsName and ipAddress subjectAltName extensions are matched
#     against the host and port passed to GSSAPI. If subjectAltName 
#     is present, X.509 SubjectName is ignored. 
# HYBRID:
#     Support a hybrid of the two previous name matching algorithms,
#     liberally matching both hyphen wildcards, canonical names
#     associated with IP addresses, and subjectAltName extensions.
#     This has been the default since GT 4.2

History of Globus updates in EPEL (since GT 6.0)

• EPEL 5 EPEL 6 EPEL 7 testing: 2014-09-20, updated: 2014-09-21, 2014-09-30 (GGUS 106665), 2014-10-01 (memory leak reported by FTS), stable: 2014-10-21
• EPEL 5 EPEL 6 EPEL 7 testing: 2014-10-30, stable: 2014-11-14
• EPEL 5 EPEL 6 EPEL 7 testing: 2014-11-15, stable: 2014-11-30
• EPEL 5 EPEL 6 EPEL 7 testing: 2014-11-19, stable: 2014-12-04 (myproxy only)
• EPEL 5 EPEL 6 EPEL 7 testing: 2014-12-12, stable: 2014-12-27
• EPEL 5 EPEL 6 EPEL 7 testing: 2014-12-18, stable: 2015-01-02 (myproxy only)
• EPEL 5 EPEL 6 EPEL 7 testing: 2015-01-08, stable: 2015-01-23
• EPEL 5 EPEL 6 EPEL 7 testing: 2015-01-28, stable: 2015-02-14 (updates all packages due to new packaging guidelines making all previous updates listed above obsolete)
• EPEL 5 EPEL 6 EPEL 7 testing: 2015-02-17, stable: 2015-03-08 (GGUS 105158, 109089 and 109576)
• EPEL 5 EPEL 6 EPEL 7 testing: 2015-02-19, stable: 2015-03-08 (RHBZ 1193992)
• EPEL 5 EPEL 6 EPEL 7 testing: 2015-03-08, stable: 2015-03-25 (GGUS 109089 and 109576 improved fix)
• EPEL 5 EPEL 6 EPEL 7 testing: 2015-04-01, stable: 2015-04-17
• EPEL 5 EPEL 6 EPEL 7 testing: 2015-04-08, stable: 2015-04-23
• EPEL 5 EPEL 6 EPEL 7 testing: 2015-04-10, stable: 2015-04-25
• EPEL 5 EPEL 6 EPEL 7 testing: 2015-04-17, stable: 2015-05-03
• EPEL 5 EPEL 6 EPEL 7 testing: 2015-05-10, stable: 2015-05-26
• EPEL 5 EPEL 6 EPEL 7 testing: 2015-05-29, updated: 2015-06-06 (GGUS 114076), stable: TBD

QCG

Next Release is planned for UMD update in May.

• GPU support in QCG-Broker/Client
• VO support in QCG-Broker/Client

• Due to missing elements in GLUE2 schema (reported many times long time ago) some warnings are still reported by glue-validator:
  • W037 Description: Wrong type
  • W037 Affected attribute: GLUE2ServiceType
  • W037 Published value: ['org.qcg.notification']
  • W037 Description: Wrong type
  • W037 Affected attribute: GLUE2EndpointInterfaceName
  • W037 Published value: ['org.oasis.notification']
  • W037 Description: Wrong type
  • W037 Affected attribute: GLUE2ServiceType
  • W037 Published value: ['org.qcg.computing']

• In preparation for the subsequent udpate:
  • several updates of the packages, including new versions of QCG-Broker (support for voms) and QCG-Computing services.

xrootd

xrootd 4.2.1 available in EPEL testing.

Versions with the same major version (in this case 4) are meant to be backwards compatible, so this should not cause problems when updating from the current 4.1.1. But as always - please test and provide feedback!

• EL5: https://admin.fedoraproject.org/updates/FEDORA-EPEL-2015-6524
• EL6: https://admin.fedoraproject.org/updates/FEDORA-EPEL-2015-6533
• EL7: https://admin.fedoraproject.org/updates/FEDORA-EPEL-2015-6531

Report from WLCG MW Officer

• open verifications are available at https://its.cern.ch/jira/secure/Dashboard.jspa?selectPageId=15100

• products ( part of UMD) verified since the last meeting
  • ARC-CE 5.0 is under verification at BRUNEL site, they found a problem with jobs submitted via WMS discussed at:
  • https://ggus.eu/index.php?mode=ticket_info&ticket_id=113745
  • dCache 2.10.31 under verification at TRIUMF site

Actions (done and in progress)

Java 7

• Java 7 - as dependency of released products/components - Please have a look and send comments, especially TP missing -> action on Vincenzo to contact missing TP

EPEL 7

• Next UMD will support CentOS7
• It is important to know the status of the support of CentOS7 for the components in UMD, and if there is no support yet which the plans are. Please keep your information up to date: Status of support of EPEL 7 (SL7/CentOS7)

• The UMD4 will support EPEL7 and Ubuntu.
• The first release of UMD4 will be on Sept2015.

AOB

• Next meeting 25 May 2015, 15:00 CET

Minutes

• Minute previous meeting (13.04.2015)
• [ Minutes 27-04-2015]

Audio conference details

Room link: http://connect.ct.infn.it/egi-inspire-sa1-ter/

Please provide you Name and product team/affiliation as Guest Name.

In left top corner you will find "Meeting->Audio Setup Wizard" Button which will help you to configure your audio.

You can test Your Computer with this link http://connect.ct.infn.it/common/help/en/support/meeting_test.htm

Adobe Connect tutorials: http://tv.adobe.com/show/learn-adobe-connect-8/

Adobe connect is flash-based, please if you have issues with your configuration try Chrome as browser.

Back to the URT agendas list page: URT_meetings_agendas