Dear all,
EUGridPMA has announced a new set of CA rpms. Based on this IGTF release a new set of CA RPMs has been packaged for EGI.
Please upgrade until 2022.09.05 at your earliest convenience. When this time is over, SAM will throw critical errors on CA tests if old CAs are still detected.
Please check https://wiki.egi.eu/wiki/EGI_IGTF_Release for more details
EGI UMD software provisioning Team
The following change log accompanies this version:
European Grid Infrastructure EGI Trust Anchor release 1.117 2022.08.29
------------------------------------------------------------------------------
For release DOCUMENTATION available on this EGI Trust Anchor release see
the EGI operations manual HOWTO-01 at https://edu.nl/envyq
------------------------------------------------------------------------------
This is the EGI Trust Anchor release, based on the updated IGTF Accredited CA
distribution version 1.117-1 with the specific DOGWOOD CA in
meta-package "ca-policy-egi-combined-adequacy-model-1.117-1"
that supports the model of joint assurance provision as detailed in the
EGI Policy on Acceptable Authentication Assurance.
The following notices are republished from the IGTF, inasfar as pertinent to
this release. Details are found in the newsletter https://www.eugridpma.org/
Changes from 1.116 to 1.117
---------------------------
(29 August 2022)
* Add new intermediate ICA DigiCert Grid-TLS (US)
* Add new intermediate ICA DigiCert Grid-Client-RSA2048-SHA256-2022-CA1 (US)
* Removed discontinued NCSA-slcs-2013 following end of XSEDE (US)
* Removed discontinued PSC-Myproxy-CA following end of XSEDE (US)
* RPM packaging: rpm packages are now signed using a SHA-256 digest, file
digests using algo 8 (SHA-256), and the yum/dnf listings are signed with
SHA-256 as well. This removes support for yum-based distributions up to EL5
(for which ELS ended in November 2020), but allows installation of
packages on EL9 (Rocky9, AlmaLinux9, etc.) that require SHA-256.
The CA modifications encoded in both "requires" and "obsoletes" clauses (RPM)
and Conflicts/Replaced clauses (Debian) have been incorporated in the above-
mentioned meta-packages. This release is best enjoyed with fetch-crl v3 or
better, available from GNU/Linux OS add-on repositories Fedora, EPEL, Debian,
and from the IGTF at https://www.igtf.net/fetch-crl
Policy on Acceptable Authentication Assurance
---------------------------------------------
If a Community or e-Infrastructure registration service is accredited by EGI
to meet the approved authentication assurance level, also an IGTF "DOGWOOD"
accredited Authority, used in combination with such a service, is sufficient.
HOWTO01, https://edu.nl/envyq#combined-assuranceadequacy-model has the details.
TECHNICALLY THIS MEANS ...
that you must ONLY install the new ca-policy-egi-cam packages if you ALSO
at the same time implement VO-specific authorization controls in your
software stack. This may require reconfiguration or a software update.
OTHERWISE
just ONLY install or update the regular ca-policy-egi-core package. There
are no changes in this case. The ca-policy-egi-core package is approved for
all VOs membership and assurance models. No configuration change is needed.
Version information: ca-policy-egi-combined-adequacy-model = 1.117-1
