Bump container to v67 (xrootd OpenSSL 3 fix)#705
Merged
Conversation
v67 rebuilds the pip xrootd against the container's system OpenSSL 3 instead of vendoring OpenSSL 1.1.1, resolving the symbol clash with pyarrow's OpenSSL 3 that segfaulted EOS/xrootd access during the krb5 authentication handshake. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014nku8YpMNAt7HLbneVmUpg
matplotlib.cm.get_cmap was deprecated in 3.7 and removed in 3.9. The v67
container ships matplotlib 3.11, so styles.get_labels_colors_procs_sorted
(used by all rabbit plotting steps) crashed with AttributeError, failing 7
CI plotting jobs. Replace the three cm.get_cmap("tab10") call sites with the
recommended matplotlib.colormaps["tab10"] registry access, which returns the
same callable Colormap.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014nku8YpMNAt7HLbneVmUpg
Collaborator
Author
|
CI looks unchanged except for some tiny changes to spacing on some plots (related to updates of python plotting libraries). So this should be good to merge in principle. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the apptainer/singularity container pin in
run_with_singularity.shtowmassdevrolling:v67.v67 rebuilds the pip-installed
xrootdagainst the container's system OpenSSL 3 instead of vendoring its own OpenSSL 1.1.1. Previously, importingXRootD.client(used for EOS directory listing indataset_tools.py) loaded pyxrootd's bundled OpenSSL 1.1.1, which — sharing thelibXrdClsoname and via ROOT/cppyy'sRTLD_GLOBAL— collided with pyarrow's OpenSSL 3 symbols and segfaulted during the krb5 authentication handshake when loading samples from EOS over xrootd.In v67,
xrootd.libs/no longer bundles any crypto and pyxrootd'slibXrdSeckrb5links the systemlibcrypto.so.3/libkrb5.so.3/libk5crypto.so.3, so the whole process runs on a single consistent OpenSSL 3 and the clash is gone at the source.Verification
On v67, with the existing python
XRootD.clientusage:w_z_gen_dists.pybooks files from EOS with no segfault (the exact path that crashed on v66).import hist(-> pyarrow/OpenSSL 3) +import XRootD.client+ list + open + read 113,400 events all succeed.libcryptomapped in the process is the systemlibcrypto.so.3.🤖 Generated with Claude Code