Pelican Logo
Pelican Platform

Release

v26.0.0-rc.5

Download

Pelican v26.0.0

Note the release version change. We will now be doing an annual major release, starting with 26. Minor releases will include enhancements and bug fixes.

This release offers many feature enhancements to the V2 (internal, native golang) origin. Also included are quality of life bug fixes.

Breaking Changes From 7.27.0 & Upgrade Notes for Admins

  • [Origin]: Embedded issuer supersedes the OA4MP issuer. Origins should be configured to use the embedded issuer. #3737
  • [Origin]: New Origin registration now requires the Origin admin to fill out a contact form in order to be accepted for approval, registration will be marked incomplete, otherwise. #3703
  • [Servers]: Added built-in log rotation for file logging #3512
  • [Origin/Cache] XRootD dependency updated to 5.9.5 #3488
  • [Origin/Cache] xrdcl-pelican dependency updated to 1.8.2 #3713
  • [Origin/Cache] xrootd-s3-http dependency updated to 0.6.9
  • [Origin/Cache] Update xrdhttp-pelican to 0.0.13 #3750

New Features and Enhancements

  • [Origin]: New registration view for Origins #3703
  • [Origin]: HTTPS/WebDav, Globus, S3/Blob added as V2 Pelican backends #3234
  • [Client]: Client agent now has remote transfer server functionality #3509
  • [Client]: Error messages are more human readable #3695
  • [Origin]: Web client added #3532
  • [Cache]: Per-origin fair scheduler added to prevent single slow Origin from blocking a Cache’s other transfers #3577
  • [Client] Now infers destination filename when uploading to a directory #2970
  • [Origin] Added a standalone mode for the Origin, which allows the Origin to be its own federation #3597
  • [Origin] Per namespace IssuerJwks for embedded OAuth2 Issuer #3575
  • [Origin] Added pstore, an Origin storage backend that uses Cache V2 block store as an Origin’s primary data store rather than as a Cache #3598
  • [Origin] Added POSC, object metadata tracking/publishing to the V2 Origin #3542

Bugs Fixed

  • [Origin] Added CORS support for the embedded OIDC issuer endpoints #3553
  • [Origin/Cache] All issuer keys registered at startup, not just lexicographically-first on #3504
  • [Client] No longer download a collection as if it were an object #3114
  • [Client] List a plain object instead of claiming listings are unsupported against POSIX V2 Origins #3627
  • [Origin] Added OPTIONS / handler, no longer returns 405 #3626
  • [Client] PelicanFS now forwards transfer options to the transfer jobs it creates #3654
  • [Client] Improve Director-response Cache keys and reuse #3655
  • [Client] Upload now uses scopes with storage.modify if Client.EnableOverwrites is set #3668
  • [Servers] Added token clock skew tolerance to account for differences across servers #3254

New Contributors

Full Changelog: https://github.com/PelicanPlatform/pelican/compare/v7.27.0...v26.0.0-rc.5

Changelog

  • a0e0a45962d6e0e8891bb73cbbd4f1e163aa8997 Extend Dependabot to Go modules and pre-commit hooks
  • 4372bb075497e141e4f52db65a4fc484084e844f Pin GoReleaser and let Dependabot update it
  • ab6112d16599236b4075812cd55e704decf00c21 Pin the container base images and let Dependabot update them
  • 1546537cf41d05af862d630c05776f53a6236799 Update version to 26.0.0-rc.6

What's Changed

New Contributors

Full Changelog: https://github.com/PelicanPlatform/pelican/compare/v7.27.0...v26.0.0-rc.6

Pelican v26.0.0

Note the release version change. We will now be doing an annual major release, starting with 26. Minor releases will include enhancements and bug fixes.

This release offers many feature enhancements to the V2 (internal, native golang) origin. Also included are quality of life bug fixes.

Breaking Changes From 7.27.0 & Upgrade Notes for Admins

  • [Origin]: Embedded issuer supersedes the OA4MP issuer. Origins should be configured to use the embedded issuer. #3737
  • [Origin]: New Origin registration now requires the Origin admin to fill out a contact form in order to be accepted for approval, registration will be marked incomplete, otherwise. #3703
  • [Servers]: Added built-in log rotation for file logging #3512
  • [Origin/Cache] XRootD dependency updated to 5.9.5 #3488
  • [Origin/Cache] xrdcl-pelican dependency updated to 1.8.2 #3713
  • [Origin/Cache] xrootd-s3-http dependency updated to 0.6.9
  • [Origin/Cache] Update xrdhttp-pelican to 0.0.13 #3750

New Features and Enhancements

  • [Origin]: New registration view for Origins #3703
  • [Origin]: HTTPS/WebDav, Globus, S3/Blob added as V2 Pelican backends #3234
  • [Client]: Client agent now has remote transfer server functionality #3509
  • [Client]: Error messages are more human readable #3695
  • [Origin]: Web client added #3532
  • [Cache]: Per-origin fair scheduler added to prevent single slow Origin from blocking a Cache’s other transfers #3577
  • [Client] Now infers destination filename when uploading to a directory #2970
  • [Origin] Added a standalone mode for the Origin, which allows the Origin to be its own federation #3597
  • [Origin] Per namespace IssuerJwks for embedded OAuth2 Issuer #3575
  • [Origin] Added pstore, an Origin storage backend that uses Cache V2 block store as an Origin’s primary data store rather than as a Cache #3598
  • [Origin] Added POSC, object metadata tracking/publishing to the V2 Origin #3542

Bugs Fixed

  • [Origin] Added CORS support for the embedded OIDC issuer endpoints #3553
  • [Origin/Cache] All issuer keys registered at startup, not just lexicographically-first on #3504
  • [Client] No longer download a collection as if it were an object #3114
  • [Client] List a plain object instead of claiming listings are unsupported against POSIX V2 Origins #3627
  • [Origin] Added OPTIONS / handler, no longer returns 405 #3626
  • [Client] PelicanFS now forwards transfer options to the transfer jobs it creates #3654
  • [Client] Improve Director-response Cache keys and reuse #3655
  • [Client] Upload now uses scopes with storage.modify if Client.EnableOverwrites is set #3668
  • [Servers] Added token clock skew tolerance to account for differences across servers #3254

New Contributors

Full Changelog: https://github.com/PelicanPlatform/pelican/compare/v7.27.0...v26.0.0-rc.5

Changelog

  • 3548bd80a1b686468daf14a7d7bb09da8518f05f Update to 26.0.0-rc.3 after previous tag failed the push

Changelog

  • c11fc57918fedd8017947ac74f4c1ec7da403c1e Add Groups/Users/Collections/Shares Documentation
  • 23f875a162020d792595ac1968332249e33f35bb Add Groups/Users/Collections/Shares Documentation
  • af07b535d0497351949571cb142c8fdba432986f Add deprecated and replacedby fields for Origin.DbLocation
  • 2f2572f521c19ebf6c63d7f0e8a5dd2996066ab6 Add in missing sections
  • 819353e1aba8657ea092ce36b11f7b2007ab10b1 Add per-namespace JWKS endpoint to embedded issuer
  • 56edb6b559688331e4cdd13acb4aee9c46e2a2a3 Add review changes for Collection/Share page.
  • 0355a52890dde0cee57f6a8b33b2b21792e91185 Add review changes for Users/Groups
  • aa7866c5ad9db4447b064f8447ea7331728ed1dc Address re-review comments
  • f55b88265d59141296307efd9f16a99e50316d5a Address review feedback on external Prometheus scraping doc
  • a22ac9e702944b8e09210be030470e81d650bc43 Bound and cache JWKS file reads; let per-namespace keys override base
  • cb1a692b7c2a794770dff6b213cca6c9a7bbb32d Changes based on the most recent Collections patch
  • 1e3f555f0a3d7577cc30723d7c462c2a81290fec Compile out the JWKS permission check on Windows
  • f21b56038e63325e602a282b71d3cc4977d950b6 Document how to scrape a Pelican service from an external Prometheus instance - Including generating an API key with the monitoring.scrape scope and the corresponding Prometheus scrape_configs entry
  • 5db46df5ae9fa025d2f0da8cb4e19f75480db432 Document the Director Test mechanism on Origin and Cache
  • 7239105abe6d8d0693cc126949ed0aedaf5c4627 Drop the "stash_plugin" symlink from pelican-osdf-compat: as of HTCondor 26, it is provided by HTCondor itself
  • 5b45e159745783a49a68184717f78822cdf4bc9d Fix linter issues
  • c854ac85e890d9911fe150dfb3d1b02b64cdda68 Human review of auto-generated text
  • ac9c65026ed1f9fcbf874e3b7417d1482158bf98 Install zstd into the test and dev container images
  • 9c65e2d6eb8120b5ed76a96f70422860377bcfed Let browsers read the per-namespace JWKS cross-origin
  • 238e622d87adbac6f8e23dc7ea5a6feb661ec3e5 Make fixups to the collections and shares docs
  • 554e7435a6ae6d18b8d1624c4f2f271061b40003 Make fixups to the collections and shares docs
  • 804522707fc354b66c971edd5b6c5477f5f1fc43 Merge per-namespace extra keys and consolidate JWKS serving
  • b8e77e8850824e1c24dd198d31619eefe002fabb Merge separate narrations across index and collections page.
  • 407b62383331164ce023f2da5f4a0a667b71d028 Merge separate narrations across index and collections page.
  • 563a403b47dc41214d96faf375a45d5d177e3d3e Migrate registrations owned by a CILogon subject to the Pelican user id carrying that subject
  • 9ca6904976ef21ba8b36a7a810cc9662c3152015 Report JWKS serving faults on change, not per request
  • c5be6f7d0fff05536b80d790cacc2c52f2ffd8e7 Run the test workflows' GoReleaser builds as separate jobs
  • 294c56ebb9c5a7f7fd3257183c0323f0ff001880 Start e2e_fed_tests and local_cache first; pin GOCACHE
  • ab15b0004804a70ca00f367cd3411a198a4bdf23 Stop relying on unenforced invariants when serving JWKS
  • 52724c73ac25cb33686fde670597b9afda69ef3a Suppress unnecessary error messages thrown by website check in Makefile
  • 28cb14317d371ae3436ba838a5a3a6eb6963af99 Test update version to v26.0.0-rc.0 for workflow testing
  • 619dbcd9b27c7db0132b82fe889fa2e0952b40de Update
  • a12b0d554a15e5ec173de9d7ca7bc1d37c0643a0 Update the parameters page
  • 76e16c71719fe767f0aac6fa2c7044ee50780d83 Update xrdhttp-pelican to 0.0.13 in Dockerfile and OSX
  • fc2c4c5cd70f099343e735c9d4e1d349e1e4a348 build(deps): bump docker/build-push-action from 7.3.0 to 7.4.0
  • 8c58b534516d54745e9a4155a46b8c8eba2c46be build(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1
  • 7c24fa52dd2d5e4e10baac9faacfd8aaa7fa5633 build(deps): bump github/codeql-action/analyze from 4.37.9 to 4.38.0
  • f1a341743698951811c94aff9c5dd255f9204a5a build(deps): bump github/codeql-action/autobuild from 4.37.9 to 4.38.0
  • 2f9a54f85260c17304ea9c7bc0f240198b92b84f build(deps): bump github/codeql-action/init from 4.37.9 to 4.38.0
  • 70e995717aeea3f88b8c6cac140e103938dba1cb client, plugin: refuse a remote path whose base name is not a usable file name
  • ea22c2d1311eb01074dd9568db9619fb5b623ff4 client: add federation test for a tarball that writes through a symlink
  • f9fdf9ae035f713c0fd3b39235dbbdc275b847ef client: close the archive unpacker after a download and report its errors
  • 7636675d7bf3b01855659249482a9e4f2b5c96d8 client: confine archive unpacking to the destination directory with os.Root
  • 282d8223771e055dd1c038cfed8aa4671b45973b client: keep the sanitizer's reason in the hard-link error
  • 9b7969451f781eb16579d726494a0074b8418e6f client: refuse absolute traversal names in the unpacker instead of collapsing them
  • 5a2a0f6492c8ac33b5d47ababcf4713c99cd513a client: reject collection listing entries that are not a plain path component
  • 04ae47fbd88efd930918bbb87752af5c05eba3ba config: refuse to start on an unrecognized Issuer.GroupSource
  • bb70ca836cabe2e856472352b0d2c4123bd3d8bd database: build test schemas from the migrations, not from struct tags
  • c9cf674bf556ac77f2cdfe052c9b55a16eef83d5 database: carry the identifier space in the type; latch admin observations
  • f94de69009a49c53f81b866e77033d9ab0584243 database: don't let the api_keys migration bind a key to a reused username
  • a24a356ea4fb3af04c3b0a2ffd913f59aa6397b6 database: give the collection write paths one load-and-authorize
  • e5e7250e70b7ac97be40712fc7139322f8149684 database: keep the name space and the ID space disjoint
  • 571e483d62f24cfb6a756d6c219a4fc2e347f6fe database: key collection ownership and ACLs on IDs, not names
  • 67b0efdfa09343e29d6470b72c6f0621c045364e database: make the group source single-valued and reserve admin group names
  • 8cf26af98f2466c86f766a797f6ba962afc71efd database: mirror provider-asserted group memberships
  • 31357544cc9e8044538694e1d8c92aaf932924ce database: pin the durability and restart behavior of mirrored memberships
  • 90f5c4ec9c41cda3f413d7d2ae9f2de48ccbda15 database: reserve admin group names as unknown, and hold them
  • b6c105a6bf5d1f763f533b1bf7c9915119941df7 database: retract mirrored memberships from a source no longer configured
  • 23ae779e22920691da9801bdf97234d7f6bd4134 database: soft-delete groups and key API tokens on the creator's ID
  • 86dc384902990696c716dbad1c128e288670b4f7 database: split the api_keys migration out of the groups rebuild
  • 662fd8e4effdfc08d557dd20ed3e1ead3778340d database: stop an assertion claiming a group this server owns
  • e03dd31eb1f0d3d600673ca28adc7f71bff567f2 database: stop banning identifiers that look like IDs
  • d5f21cc5923152dca7f350236f68a945c7113136 database: stop the slug-shape rule from rejecting an IdP's username
  • da84f8515dfd2db0b52f13487edd427b48f18677 database: stop tombstoned groups and stale assertions from conferring authority
  • a91aed54d4f3d538945759b1329a3949990183a1 docs, web_ui: correct the registration flow docs and the claim landing page
  • ccaa171daf7414a0b49af6839604cc04c509face images: don't fail the test image build when condor pulls in no Pelican
  • 6dfd4d11a514ee6f05839b19c46ffcf89bb1177a launchers: log the registration completion link and write it to a file while incomplete
  • 4b5fa1bb39aa4fa7c47197700dbdd45d08ef3907 registry: add Incomplete registration status
  • 4aaccc690b46153a130a0127de8d9f8725abccc3 registry: add claim flow binding registrations to Pelican users
  • 67969797b53b81581fa36a8daca79e18ef08c1e0 registry: add ownership-transfer invites for registrations
  • 8ce16d621d05089c25a18e69a6b749e481d2ac11 registry: add tests for the claim endpoint and ID-only ownership
  • 6cf7bb89e3978ebab821fa2138409765c5bf1505 registry: address review feedback on the registration ownership flow
  • 6360dbca9693e1ca4970cb41706f9f60b1c041a4 registry: bind CLI --with-identity registrations to the Pelican user
  • a6e3af87bae89ae72b48519fb0ecf28b441e3f71 registry: let owners resubmit a denied registration for review
  • e9628ad6bd3942e3624983f64c6b608c35c7eee6 server_utils: condense the comments on concurrent director discovery
  • 512ceeedbb939abfebc25863129d61c0880ba1d1 server_utils: confine AferoFileSystem paths to the configured prefix
  • 202ebd81fdfc3c2c5f7b5a705f79c01317554870 server_utils: don't let one unreachable director stall server startup
  • 229d7f1f301814dbd919113a155c177494eb5452 web_ui: constrain the new tests to !windows; make the group-file refresh ctx-aware
  • d78c74f94a525da581c784441532aa9b31f8aac9 web_ui: default security contact to the Pelican user ID
  • 9077da6f02963f19a202ea9f2c8451a4c27511a3 web_ui: fix the Windows build, and back out the Pelican-group ACL filter
  • 0c0e27904e5dfbff39ce8d1490a5529945f24b14 web_ui: let a user-admin act on accounts nothing will ever observe
  • 213a1654e56d1dd57af4dc575f276daafc37ed3c xrootd: clean the cache self-test path before checking its prefix