v7.17.0

Bugs Fixed

• [Client]: Fix token scope for specific object operation https://github.com/PelicanPlatform/pelican/pull/2407
• [Cache]: Trim trailing '/' from federation-derived lot paths https://github.com/PelicanPlatform/pelican/pull/2435

Pelican v7.17.0-rc.2

New Features and Enhancements

• [Client]: Add pelican key create command https://github.com/PelicanPlatform/pelican/pull/2380

Bugs Fixed

• [Cache]: Correct LotHome directory permissions

Notes for Admins

• Replace pelican generate keygen with pelican key create command. They co-exist and do the same thing for now so that we have time to update docs. Note that they both generate new private key file as private-key.pem (no more newly generated *.jwk files from now on). If the private key file at the given location (but no public key file exists), this command will just use the existing private key file to derive the public key file.
• Accept *.jwk key files in IssuerKeysDirectory; though still recommend using *.pem because the key file is a PEM-formatted file

Pelican v7.17.0-rc.1

New Features and Enhancements

• [Client]: New pelican token create command for on-demand JWT generation #2314
• [Client]: Client uses token issuer as selection criteria during token selection process, also displays which token it chooses #2219, #2348
• [Client]: SciTokens-profile JWTs are now accepted in addition to wlcg profile #2223
• [Client]: Friendlier message when pelican get is run without a destination #2351
• [Origin/Cache]: Graceful shutdown a server, waiting some time for in-flight transfers before exit #2318
• [Origin/Cache]: Persist an Origin/Cache’s registered name #2300
• [Origin/Cache]: Server ads now carry a status field containing degraded state when concurrency limits are exceeded #2338
• [Origin/Cache]: Collect XRootD CPU-utilisation metric in monitoring #2225
• [Origin/Cache]: Added XRootD logging on the open, close, and transfer events #2277
• [Origin]: Concurrency limits can now be enforced in OSS throttle mode #2276
• [Servers]: Login cookies (and generated tokens) now last 16 hours #2255, #2396
• [Registry]: Automatically adds the current user as security contact when creating a new namespace #2132
• [Registry]: Namespace list refreshes automatically after edits #2269
• [Director]: Service-version graphs added to the Director dashboard #2402
• [Documentation]: Origin documentation overhaul #2298
• [Documentation]: Update FAQ section in Pelican Docs #2089, #2261
• [All]: Startup warning if the deprecated IssuerKey file is still in use #2228
• [Packaging]: New pelican-client-debug RPM for easier troubleshooting #2317
• [Packaging]: Container images rebased on XRootD 5.8.3-1.2, xrdcl-pelican 1.2.3 and xrootd-s3-http 0.4.1 #2283, #2340, #2342, #2368, #2399
• [Plugin]: Improved error propagation when servers return HTTP error codes #2344

Bugs Fixed

• [Client]: Fixed Windows client’s ability to request and save tokens #2267
• [Client]: Fixed checksum validation and corrected downloaded-size comparisons #2259, #2275
• [Client]: Repaired rate/progress calculations #2322
• [Client]: Aligned runPut proxy logic with downloadHttp behaviour #2372
• [Director]: Downtime toggles now work reliably and downtime history tests are no longer flaky #2280
• [Director]: Stopped unintentionally extending TTL on every serverAds.Get() call #2290
• [Director]: Geo-location widget hidden from non-admin users #2272
• [Registry]: Properly handle trailing slashes in namespace registration and advertisement #2270
• [Origin/Cache]: Fixed self-test failures and permission-denied errors in drop-privileges mode #2120, #2291
• [Origin/Cache]: Restored debug logging from XRootD framework itself #2387
• [Origin/Cache]: Uses the proper name when requesting federation tokens #2343

Notes for Admins

• Deprecated key path – A clear warning is now emitted if IssuerKey is still set; please migrate to the new directory-based key layout #2228
• Name – When a new origin/cache registers, its admin needs to specify its name by setting Xrootd_Sitename in the config. For all servers in the federation, if their name in the local config is different from the registered one, Pelican will still use the registered one and throw a warning in the logs. #2300
• Container images – Official images are now based on XRootD 5.8.3-1.2 #2399

New Contributors

• @whwjiang made their first contribution in https://github.com/PelicanPlatform/pelican/pull/2345

Full Changelog: https://github.com/PelicanPlatform/pelican/compare/v7.16.6...v7.17.0-rc.0