=============== Content: ==================

1) UMD 4.12.6 and 4.13.0 released
2) Site-BDII monitoring
3) Prerequisites for using AMS in relation to the accounting data publication
4) Recommendation about your accounting data

============================================

1) UMD 4.12.6 and 4.13.0 released

The UMD team is pleased to announce the release of UMD 4.12.6 and 4.13.0

The UMD 4.12.6 release contains the following products:

- ARGO 0.5.4 - ams-library py2 RPM also packages py3 specific modules https://github.com/ARGOeu/argo-ams-library/releases/tag/V0.5.4-1
- APEL-SSM 3.2.0 - bug fixes and improvements https://github.com/apel/ssm/releases/tag/3.2.0-1

The UMD 4.13.0 release includes the following products:

- APEL 1.9.0 - Added AMS support. Requires at least SSM version 3.2.0. Bug fixes and improvements. https://github.com/apel/apel/releases/tag/1.9.0-1
- VOMS admin server 3.8.1, VOMS Admin client 2.0.21, VOMS server 2.0.16, VOMS C/C++ APIs 2.0.16 - bug fixes and enhancements http://italiangrid.github.io/voms/release-notes/voms-admin-server/3.8.1/
- CVMFS 2.8.1 - Bug Fixes and Improvements https://cvmfs.readthedocs.io/en/2.8/cpt-releasenotes.html

The UMD team is currently working on restoring the repository frontend that hosts the web pages, which hopefully will be soon available

2) Site-BDII monitoring

Site-BDII metrics org.bdii.Entries and org.bdii.Freshness were removed (https://ggus.eu/index.php?mode=ticket_info&ticket_id=150657) from ARGO_MON_CRITICAL profile, so the Site-BDII status will not affect the A/R figures any more.
Anyway, it is still an important service to support infrastructure oversight activities so the metrics are still kept in the ARGO_MON_OPERATORS profiles in order to notify the Regional Operators on Duty (and site administrators) about failures occurring to this service and open a related incident ticket against the affected site.

3) Prerequisites for using AMS in relation to the accounting data publication

Over the past few months, we are progressively asking the sites to change some settings in the APEL configuration in order to use the new ARGO Message Service to deliver the accounting records to the central repository.
The current Message Broker Network, based on ActiveMQ, will be decommissioned at the end of May so the APEL settings needs to be changed before that.

For the sites that haven't been contacted yet, please have a look at the following prerequisites that the machine sending the accounting data has to satisfy to properly use AMS:

- A valid host certificate from an IGTF Accredited CA.
- A GOCDB 'Site' entry flagged as 'Production'.
- A GOCDB 'Service' entry of the correct service type flagged as 'Production'. The following service types are used:
- For Grid accounting use 'gLite-APEL'.
- For Cloud accounting use 'eu.egi.cloud.accounting'.
- For Storage accounting use 'eu.egi.storage.accounting'.
- The 'Host DN' listed in the GOCDB 'Service' entry must exactly match the certificate DN of the host used for accounting. Make sure there are no leading or trailing spaces in the 'Host DN' field.

4) Recommendation about your accounting data

Please check regularly your accounting data (once per month could be enough) and if you spot any inconsistencies do not hesitate to contact either your NGI Operators or the EGI Operations team or the APEL supporters.
This will help us to fix per time the several issues that may occur, avoiding that the accounting figures are biased by anomalies for too long.

Dear VO Managers,

UKI-SOUTHGRID-OX-HEP T2 site will start the process of decommissioning DPM storage starting from 15th May 2021 as part of the Oxford site becoming a storage-less.
Please make arrangements to copy your data to other sites by 30th June 2021.

The storage at Oxford will be switched off on 1st July 2021.

The process will be tracked by the GGUS Ticket: 151544
https://ggus.eu/index.php?mode=ticket_info&ticket_id=151544

Regards
Vip Davda and Mike Leech

The storage element of HG-06-EKT (se01.athena.hellasgrid.gr) will be decommissioned.

Later today we will disable write access for all VOs except for dteam/ops.

The service downtime will start on May 24 2021.

Our aim is to remove the service on July 2 2021, 10 weeks from now.

Kyriakos Gkinis
HG-06-EKT

Dear all,

EUGridPMA has announced a new set of CA rpms. Based on this IGTF release a new set of CA RPMs has been packaged for EGI.

Please upgrade until 2021.03.29 at your earliest convenience. When this timeout is over, SAM will throw critical errors on CA tests if old CAs are still detected.

For more details please check https://wiki.egi.eu/wiki/EGI_IGTF_Release
EGI UMD software provisioning Team

The following release notes accompany this version:
European Grid Infrastructure EGI Trust Anchor release 1.110 2021.03.22

------------------------------------------------------------------------------
For release DOCUMENTATION available on this EGI Trust Anchor release see
https://wiki.egi.eu/wiki/EGI_IGTF_Release
------------------------------------------------------------------------------

This is the EGI Trust Anchor release, based on the updated IGTF Accredited CA
distribution version 1.110-1 with the specific DOGWOOD CA in
meta-package "ca-policy-egi-combined-adequacy-model-1.110-1"
that supports the model of joint assurance provision as detailed in the
EGI Policy on Acceptable Authentication Assurance.

The following notices are republished from the IGTF, inasfar as pertinent to
this release. Details are found in the newsletter https://www.eugridpma.org/

Changes from 1.109 to 1.110
---------------------------
(22 March 2020)

* Removed INFN-CA-2015 that has disappeared operationally (IT)
* Preinstalled IGTF bundles for classic, mics, slcs, and iota are
now available to ease EGI FedCloud installations. The new tar-balls
are placed alongside the per-trust anchor tar.gz files at
https://repository.egi.eu/sw/production/cas/1/current/tgz/

The CA modifications encoded in both "requires" and "obsoletes" clauses (RPM)
and Conflicts/Replaced clauses (Debian) have been incorporated in the above-
mentioned meta-packages. This release is best enjoyed with fetch-crl v3 or
better, available from GNU/Linux OS add-on repositories Fedora, EPEL, Debian,
and from the IGTF at https://www.igtf.net/fetch-crl

IMPORTANT NOTICE:
This release contains a new "cam" (combined assurance/adequacy) package
based on the approved policy on differentiated assurance. See details on
the EGI Wiki at https://wiki.egi.eu/wiki/EGI_IGTF_Release#cam-impl
TECHNICALLY THIS MEANS THAT
you must ONLY install the new ca-policy-egi-cam packages if you ALSO
at the same time implement VO-specific authorization controls in your
software stack. This may require reconfiguration or a software update. See
https://wiki.egi.eu/wiki/EGI_IGTF_Release#cam-impl
OTHERWISE
just only install or update the regular ca-policy-egi-core package. There
are no changes in this case. The ca-policy-egi-core package is approved for
all VOs membership and assurance models. No configuration change is needed.

As circulated via the EGI broadcast tool on the 4th March 2021, we have been made aware of a compromise on the WordPress instance supporting the frontend of the UMD infrastructure.

From what is known at the moment, someone gained access to a test user account with limited capabilities, in particular, this account could be used to create WordPress posts.

Following the compromise, the repositories were brought down and were unavailable for two days. The repositories have been rebuilt from scratch, using signed packages stored on a backend host which wasn’t compromised. The repositories are now hosted on resources at the new provider that was selected in 2020 as part of the bidding activities for the preparation of EGI-ACE.

Currently, the WordPress frontend is still down and will be replaced later.

The following page on the CSIRT website will be updated according to the evolution of the situation:
https://csirt.egi.eu/2021/03/10/degraded-umd-cmd-infrastructure-availability/

We apologise for any inconvenience that this may cause.

Dear NGI managers and Resource Centre administrators,

Following on from the previous broadcast of the unscheduled downtime to the UMD, CMD and AppDB repositories (https://operations-portal.egi.eu/broadcast/archive/2834), we would like to confirm that they are now back online and the downtime has now changed to 'at-risk'.
As mentioned in the previous broadcast, the Wordpress frontend is still down and we are working to return it to production. We apologise for any inconvenience that this may cause.