Skip to main content

41.0.0

Long Term Support (LTS)​

This release marks the start of the 41 Long Term Support (LTS) release line. This release line will be supported with security and critical patches until at least July 2028.

Important changes​

  • We removed the OIDC auto login feature from the Rucio clients, to comply with the OIDC standard. https://github.com/rucio/rucio/issues/8318
  • rucio upload did not check the add_did/s permission when doing an upload, as this was hidden within an add_replicas call. This has now been fixed. If certain upload workflows are now failing for you, this might be the reason.
  • For ssh authentication with Rucio, the server now requires rsa-sha2-256 signatures. This is not done out of security considerations (SHA-1 signatures would be fine and are not unsafe for this workflow), however, Paramiko the library we use for ssh signatures dropped support for SHA-1. Thus, if you are using ssh authentication with Rucio, you need to use an 41+ client, which supports rsa-sha2-256.
  • The nonssl_port configuration option has been removed from the [messaging-fts3] section. All deployments must now use the 'port' option regardless of whether 'use_ssl' is True or False.

Upgrade Instructions​

This major release does not include any schema changes.

Deprecation watchlist​

As Rucio evolves, we periodically audit the codebase to identify and deprecate features for future removal. This typically occurs when functionality is no longer used by the community, dependencies become obsolete, security risks arise, or the maintenance effort outweighs the feature's actual utility. Upcoming removals are announced in the Rucio documentation, which we encourage all communities to review regularly.

General​

Features​

  • Core & Internals: Open Data EOS Integration #8425
  • Core & Internals: Add --bidirectional flags to RSE distance operations in CLI #8504
  • Testing: Test stability on LTS branches #7964

Enhancements​

  • Authentication & Authorisation: remove auto feature for oidc auth #8318
  • Authentication & Authorisation: Remove SAML authentication #8628
  • Core & Internals: Recursive list_dids overwrites expanded did_type filters and drops FILE DIDs #8402
  • Core & Internals: Fix missing InternalAccount import in OIDC type annotation #8658
  • Documentation: Rucio Python Client docstrings enhancement (RSEClient) #8607
  • Documentation: Rucio Python Client docstrings enhancement (AccountClient) #8608
  • Documentation: Rucio Python Client docstrings enhancement (ConfigClient) #8612
  • Policies: Schema values overridden in policy package are not picked up unless at top level #7731
  • Policies: Replace Belle II policy package #8678
  • Protocols: Remove the RFIO RSE protocol implementation #8492
  • Protocols: Remove SRM and GridFTP protocols #8497
  • Release management: Bump Rucio Python dependencies for the Rucio 41 LTS (Donkémon) release #8640

Bugs​

  • Authentication & Authorisation: Rucio SSH authentication fails with Paramiko 5.0.0: KeyError 'ssh-rsa' #8566
  • Authentication & Authorisation: Lint failure on master: unused extract_vo import in credentials.py #8666
  • Core & Internals: rucio upload does not check that the user has permission to add DIDs #6058
  • Core & Internals: Account limits: get_global_account_usage and get_local_account_usage are read-only operations, but are passed a transactional_session #8195
  • Metadata: get_metadata_bulk ignores plugin when inherit=False #7323
  • Transfers: Conveyor receiver requires ssl port even if use_ssl is False #7833
  • Transfers: davs not enabled by default for transfers in conveyor configuration #8287
  • Transfers: Receiver fails to connect with username/password pair #8669

Clients​

Enhancements​

  • Clients: Copy old CLI implimentation of replica to new CLI #8299
  • Clients: Remove ablity to declare dark replicas from CLI #8505
  • Clients: Replace some "add" and "update" CLI commands with "set" #8547
  • Clients: Rucio Python Client docstrings enhancement (RuleClient) #8619

Bugs​

  • Clients: rucio replica list dataset --rse crashes with the rich CLI renderer #8641
  • Clients: rse distance set --bidirectional silently skips the reverse link when only the forward distance exists #8665