v7.25.0-rc.0

Pelican v7.25.0-rc.0

This release introduces a new SSH-based origin backend, an embedded OAuth2 issuer, rclone support, and a broad set of improvements to the client, UI, director reliability, and federation operations.

Breaking Changes & Upgrade Notes for Admins

• [Origin]: POSIX origins now validate filesystem permissions against namespace capabilities at startup in #2881
• [Origin]: Added POSC bypass filter for monitoring paths in #3297
• [Servers]: Added periodic SQLite database backups with compression and encryption in #3154

New Features and Enhancements

• [Origin]: Added an embedded OAuth2 issuer in #3151
• [Origin]: Added a new SSH-based origin backend in #3077
• [Origin]: Added support for configuring rclone as an origin storage backend in #3085
• [Origin]: Third-party copies are now enabled in origins out-of-the-box in #3148
• [Origin]: Added XRootD-style monitoring packets for the POSIXv2-style origin in #3235
• [Origin]: Integrated the N2N plugin to automatically map FederationPrefix to StoragePrefix for XRootD storage backends in #3111
• [Servers]: Added a web read-only mode Server.WebReadOnly to restrict mutating operations via the web UI in #3205
• [Client]: Improved object ls output with sorted entries, terminal-aware column formatting, and clear directory distinction in #3250
• [Client]: Added client-side modifications to support the local cache in #3175
• [Director]: Director redirect information is now probabilistically added to plugin output class ads in #3177
• [Registry]: Displayed registration type explicitly in Registry’s WebUI in #3218
• [Origin/Cache]: Presented the registered server name provided in Origin and Cache’ WebUI #3220
• [All]: Added a CLI documentation generator in #2562

Bugs Fixed

• [Client]: The client now accurately reports when a token is not sent in #3223
• [Client]: Preserved PreferredCaches ordering against responsiveness-based reordering in sortAttempts in #3253
• [Client]: Fixed token discovery logic in #2846
• [Client]: Fixed checksum verification for mismatched algorithm types in #3174
• [Client]: Fixed isProxyEnabled() in #3224
• [Director]: Fixed HA Director request forwarding for federations with 3 or more Directors in #3189
• [Director]: Made TTLCache key selection consistent in Director stat utilities in #3171
• [Director]: The Director no longer stats more caches than it intends to provide for sorting in #3179
• [Cache]: Caches now always use the federation host for the metadata discovery endpoint in #3268
• [Cache]: Disabled client x509 by default, as most CAs will no longer issue certificates with both client/server auth in the EKU #3202
• [Cache/Origin]: Fixed an integer conversion bug in XRootD metrics in #3213
• [Origin]: Fixed Globus origin to correctly handle non-existent directories in #3186, #145
• [Origin]: Throw an error when a Globus origin is configured with multiple exports in #3170
• [Origin]: Globus origins now require Server.EnableUI = true to perform OAuth flow in #3144
• [Origin]: Hardened the POSC plugin to prevent startup across filesystem boundaries in #3269
• [Origin]: Fixed missing Origin disk usage calculation defaults in #3232
• [Origin]: StoragePrefix and FederationPrefix are no longer validated the same way in #3267
• [Servers]: Configuration values marked as hidden are now hidden in the config editor in #3222
• [Servers]: Fixed a race condition in the IsSet and Unmarshal parameter functions in #3260
• [Servers]: Added missing defaults for storage health consumption parameters in #3241
• [Servers]: Downtime scheduling now prevents an end time before the start time in #3243
• [Servers]: Updated credential password messages to be less alarming in #3161
• [Servers]: Pelican no longer ships pelican-server Debian packages, as the required xrootd version isn't available there #3236

New Contributors

• @Macman1234 made their first contribution in #3098

Full Changelog: v7.24.0-rc.5...v7.25.0-rc.0