Overview

The Grid Community Forum (GridCF) is a global community that provides support for core grid software.

Specifically, the GridCF is attempting to support a software stack christened the Grid Community Toolkit (GCT). The GCT is an open-source fork of the venerable Globus Toolkit created by the Globus Alliance. The GCT is derived from the Globus Toolkit, but is not the Globus Toolkit. Further, the GridCF is not a part of the Globus Alliance.

The GridCF is a nascent organization: we are looking for energetic contributors across a broad range of technical skills. Check out our governance doc and join us on GitHub!

Objectives

The creation of the GridCF and the GCT fork of the Globus Toolkit was motivated by the announcement of the upcoming end-of-support of the Globus Toolkit in January 2018.

With this effort, we aim to:

Maintain the quality and security of critical functionality such as the Grid Security Infrastructure (GSI) and an open-source GridFTP implementation.
Partner across several grid organizations to share the burden of supporting this core functionality.
Provide an open and welcoming forum for external contributors to improve the software.

Contact

To get in touch with us - or even better - to get involved, participate in the discussions or start a new discussion on our general mailing list [email protected] hosted by EGI.

For patches or to report non-confidential problems, please make a pull request or use the respective issue trackers in our projects gct and gct-docs on GitHub.

If you would like to make the GridCF aware of a security problem in a discreet manner, send an email to [email protected].

News

For release and general announcements please subscribe to our announcement list [email protected] hosted by EGI.

2026-11-11

GCT 6.2.20261111 (bugfix and maintenance release)

The GridCF is pleased to announce a new release of the GCT: GCT version 6.2.20261111 is a bugfix and maintenance release and includes (1) a fix for CVE-2026-123975 and (2) all changes since the last maintenance release from February 2026.

CVE-2026-123975

A flaw was detected in globus-gss-assist prior to version 12.9 during automated testing by Deus Rex.

The flaw is located in globus_gss_assist_token_get_fd() which is used by:

globus-gatekeeper
myproxy

If you are using one of these services and have globus-gss-assist packages prior to version 12.9 (except for EPEL/Fedora: prior to globus-gss-assist-12.7-13.[…] and Debian: prior to globus-gss-assist (12.7-5); see below) installed, consider these service(s) vulnerable to this flaw.

Description by Deus Rex, who also provided a fix for this issue:

globus_gss_assist_token_get_fd() computes the body size of an SSLv2 record as the 15-bit record length minus 3. A peer that sends a record length below 3 makes the size negative. The token buffer is then allocated too small, and the following 5-byte memcpy and the fread of the body write past it before any authentication. This crashes globus-gatekeeper.

Please check the corresponding GitHub releases page for detailed descriptions of the flaw.

This flaw was fixed in advance for globus-gss-assist packages in Debian (testing and unstable) and Fedora/EPEL. Please note: the following package versions are fixed, although their version is smaller than 12.9. If not already updated, please update to these package versions ASAP.

Debian users:

Updated packages (globus-gss-assist (12.7-5)) are currently only available for testing and unstable. For stable you can (1) either wait for updated packages, (2) install and use the globus-gss-assist packages from testing for the time being or (3) rebuild globus-gss-assist packages yourself with the fix included. Please note: the updated packages from testing might not work on oldstable, because they require at least glibc version 2.38.

The respective packages can be found via:

globus-gss-assist (12.7-5)

Fedora/EPEL users:

Note that these updated packages (globus-gss-assist-12.7-13.[…]) might still be in testing ATM.

The respective packages can be found via:

Other users:

Please rebuild and install the GCT or just globus-gss-assist with the fix included.

The respective fixed source tarballs will be available from our usual repo after the release builds on GitHub have finished:

https://repo.gridcf.org/gct6/sources/gct-6.2.[…].tar.gz
https://repo.gridcf.org/gct6/sources/globus_gss_assist-12.9.tar.gz

Packages are available from:

Debian (for Debian testing and unstable (Sid), excluding gsi-openssh)
EPEL (for Red Hat Enterprise Linux/CentOS Stream/RockyLinux 8, 9 and 10)
Fedora (for Fedora 43, 44, 45 and future 46)

All details about this release can also be found on the corresponding GitHub releases page

2026-02-08

GCT 6.2.20260123 (maintenance release)

The GridCF is pleased to announce a new release of the GCT: GCT version 6.2.20260123 is a maintenance release and includes all changes since the last maintenance release from February 2024.

Packages are available from:

Debian (for Debian unstable (Sid), excluding gsi-openssh)
EPEL (or Red Hat Enterprise Linux/CentOS Stream/RockyLinux 8, 9 and 10)
Fedora (for Fedora 42, 43 and future 44)

All details about this release can also be found on the corresponding GitHub releases page

2024-02-16

GCT 6.2.20240202 (maintenance release)

The GridCF is pleased to announce a new release of the GCT: GCT version 6.2.20240202 is a maintenance release and includes all changes since the last maintenance release from June 2022.

Packages are available from:

Debian (for Debian unstable (Sid), excluding gsi-openssh)
EPEL (for Red Hat Enterprise Linux 7, 8 and 9 and CentOS 7, CentOS Stream 8 and 9, RockyLinux 8 and 9 and Scientific Linux 7 (currently in updates-testing!))
Fedora (for Fedora 38, 39 (currently in updates-testing!) and 40 )
openSUSE Build Service (for SLES 12 (SP5), 15 (SP2), 15 (SP3) and OpenSUSE Leap 15.4 and 15.5)

All details about this release can also be found on the corresponding GitHub releases page

2022-10-10

UberFTP version 2.9.1

the GridCF is pleased to announce a new release of UberFTP: UberFTP version 2.9.1 includes all changes since the last release (2.9) from Fabruary 2022.

Packages are or will be available from:

EPEL (for Red Hat Enterprise Linux 7, 8, 9 and CentOS 7, CentOS Stream 8 and 9 and RockyLinux 8 and 9 and Scientific Linux 7)
Fedora (for Fedora 36 and upcoming 37)
openSUSE Build Service (for SLES 12 (SP3), 12 (SP4), 12 (SP5), 15, 15 (SP1), 15 (SP2), 15 (SP3), openSUSE Leap 15.3, 15.4 and Tumbleweed)

All details about this release can also be found on the corresponding GitHub releases page

2022-06-08

GCT 6.2.20220524 (maintenance release)

The GridCF is pleased to announce a new release of the GCT: GCT version 6.2.20220524 is a maintenance release and includes all changes since the last maintenance release from September 2021.

Packages are available from:

Debian (for Debian unstable (Sid), excluding gsi-openssh)
EPEL (for Red Hat Enterprise Linux 7, 8 and 9 and CentOS 7, CentOS Stream 8 and 9, RockyLinux 8 and Scientific Linux 7 (currently in updates-testing!))
Fedora (for Fedora 34, 35 and 36 (currently in updates-testing!))
openSUSE Build Service (for SLES 12 (SP3), 12 (SP4), 12 (SP5), 15, 15 (SP1), 15 (SP2), 15 (SP3) and OpenSUSE Leap 15.3 and 15.4)

All details about this release can also be found on the corresponding GitHub releases page

2022-02-09

UberFTP version 2.9

The GridCF is pleased to announce a new release of UberFTP: Version 2.9. This release includes various changes compared to version 2.8 from 2014-02-11, mainly support for IPv6 and fixes for existing issues and updates to the shipped documentation and the build infrastructure.

NOTICE: UberFTP 2.9 uses EPSV and EPRT (see RFC 2428 for details) to support both IPv4 and IPv6 addresses. To maintain compatibility from a Globus GridFTP service, use the configuration options epsv_ip 1 and epsv_match 1 for the PI (frontend process) of that service if its PI(s) and DTP(s) (backend process(es)) are located on different hosts.

Errata advisory

Unfortunately an “issue” with the cat functionality of UberFTP 2.9 (though already in version 2.8) went unnoticed until after the UberFTP 2.9 sources reached EPEL/Fedora and was only detected during functional testing of the resulting RPM packages.

UberFTP adds an UNIX newline to the output for both text and binary files in ASCII and binary transfer modes. This makes using the output in a pipeline - for example to hash its contents - at least irritating if you aren’t aware of that. This is only relevant for non-interactive use.

Packages are available from:

EPEL (for Red Hat Enterprise Linux 7, 8 and 9 and CentOS 7, CentOS Stream 8 and 9, RockyLinux 8 and Scientific Linux 7)
Fedora (for Fedora 34, 35 and 36)
openSUSE Build Service (for SLES 12 (SP3), 12 (SP4), 12 (SP5), 15, 15 (SP1), 15 (SP2), 15 (SP3) and OpenSUSE Leap 15.3 and 15.4)

All details about this release can also be found on the corresponding GitHub releases page

2021-09-03

GCT version 6.2.20210826 (maintenance release)

The GridCF is pleased to announce a new release of the GCT: GCT version 6.2.20210826 is a maintenance release and includes all changes since the last maintenance release in December 2020.

Packages are available from:

Debian (for Debian unstable (sid), excluding gsi-openssh)
EPEL (for Red Hat Enterprise Linux and CentOS 7 and 8 and Scientific Linux 7 (currently in updates-testing!))
Fedora (for Fedora 33 and 34 (currently in updates-testing!))
openSUSE Build Service (for SLES 12 (SP3), 12 (SP4), 12 (SP5), 15, 15 (SP1), 15 (SP2), 15 (SP3) and OpenSUSE Leap 15.2, 15.3)

All details about this release can also be found on the corresponding GitHub releases page

2020-12-24

GCT version 6.2.20201212 (maintenance release)

The GridCF is pleased to announce a new release of the GCT: GCT version 6.2.20201212 is a maintenance release and includes all changes since the last maintenance release in September 2019.

Packages are available from:

Debian (for Debian unstable (sid), excluding gsi-openssh)
EPEL (for Red Hat Enterprise Linux and CentOS 7 and 8 and Scientific Linux 7 (currently in updates-testing!))
Fedora (for Fedora 32 and 33 (currently in updates-testing!))
openSUSE Build Service (for SLES 12 (SP2), 12 (SP3), 12 (SP4), 15, 15 (SP1), 15 (SP2) and OpenSUSE Leap 15.1, 15.2 and OpenSUSE Tumbleweed)

All details about this release can also be found on the corresponding GitHub releases page

2020-01-16

The GridCF adopts the UberFTP client created by Jason Alt and takes over maintenance. The next release will be version 2.9.

2019-09-19

GCT version 6.2.20190906 (maintenance release)

The GridCF is pleased to announce a new release of the GCT: GCT version 6.2.20190906 is a maintenance release and includes all changes since the last maintenance release in February 2019.

Packages are available from:

Debian (for Debian unstable (sid), excluding gsi-openssh)
EPEL (for Red Hat Enterprise Linux, CentOS and Scientific Linux 6 and 7 (currently in EPEL updates-testing!))
Fedora (for Fedora 29 and 30)

NOTICE: As a preview, packages (excluding gsi-openssh) are also available from the OpenSUSE Build Service (for SLES 12 (SP2), 12 (SP3), 12 (SP4), 15, 15 (SP1) and OpenSUSE Leap 15.0, 15.1 and OpenSUSE Tumbleweed). To install follow these exemplary instructions for the globus-common package (which are also valid for the other packages).

All details about this release can also be found on the corresponding GitHub releases page

2019-02-26

GCT version 6.2.20190226 (maintenance release)

The GridCF is pleased to announce a new release of the GCT: GCT version 6.2.20190226 is a maintenance release and includes all changes since the first GCT 6.2 release in November 2018.

Packages are available from:

Debian (for Debian testing (buster) and unstable (sid), excluding gsi-openssh)
EPEL (for Red Hat Enterprise Linux, CentOS and Scientific Linux 6 and 7)
Fedora (for Fedora 28, 29 and 30)

NOTICE: As a preview, packages (excluding gsi-openssh) are also available from the OpenSUSE Build Service (for SLES 12 (SP3), 12 (SP4), 15 and OpenSUSE Leap 15.0, 15.1 and OpenSUSE Tumbleweed). To install follow these exemplary instructions for the globus-common package (which are also valid for the other packages).

All details about this release can also be found on the corresponding GitHub releases page

2018-11-15

GCT version 6.2.20181115 (first 6.2 release)

The GridCF is pleased to announce the release of the GCT version 6.2.20181115, the first GCT 6.2 release.

Packages are available from:

Debian (for Debian unstable (Sid), excluding gsi-openssh)
EPEL (for Red Hat Enterprise Linux, CentOS and Scientific Linux 6 and 7)
Fedora (for Fedora 28 and 29)

NOTICE: As a preview, packages (excluding gsi-openssh) are now also available from the OpenSUSE Build Service (for SLES 12 (SP3), 12 (SP4), 15 and OpenSUSE Leap 15.0, 15.1 and OpenSUSE Tumbleweed). To install follow these exemplary instructions for the globus-common package (which are also valid for the other packages).

All details about this release can also be found on the corresponding GitHub releases page