Conda installation

[HealthyPear]

Hi all,

I am a CTA user and in our setup, we use a wrapper around DIRAC (CTADIRAC) that allows developing interfaces for various pipelines or analysis codes.

After the upgrade to python3, this wrapper has been also upgraded and can be installed as a pip package.
I have a software (A) also installable as a pip package and an interface to the DIRAC grid based on CTADIRAC (B) as a git repo.

I managed to create an environment with the following recipe:

name: environment_B
channels:
  - conda-forge
dependencies:
  - python=3.8
  - pip
  - dirac-grid
  - pip:
    - A
    - CTADIRAC

in which I can get a proxy and e.g. consult the FileCatalog.

I have then 2 issues (possibly correlated).

1st issue

after an apparent successful dirac-proxy-init I see

You did not set X509_VOMSES in your bashrc. DIRAC searches $DIRAC/etc/grid-security/vomses . Please use X509_VOMSES, this auto discovery will be dropped.
Could not add VOMS extensions to the proxy
Failed adding VOMS attribute: VOMS Error ( 1121 : Failed to set VOMS attributes. Command: ['voms-proxy-init', '-cert', '/tmp/x509up_u501', '-
key', '/tmp/x509up_u501', '-out', '/var/folders/2z/142033n17rbfy969s6h4hymw0000gn/T/tmpe3knldtk', '-voms', 'vo.cta.in2p3.fr:/vo.cta.in2p3.fr/Role=users', '-valid', '23:54', '-vomses', '/Users/michele/Applications/miniconda3/envs/protopipe-grid-interface/etc/grid-security/vomses', '-r', '-timeout', '12']; StdOut: ; StdErr: /bin/sh: voms-proxy-init: command not found
)

I can solve the X509_VOMSES part (read: make it disappear) by exporting the variable to my conda environment (which I expected to be automatic), but the VOMS part seems to be related to the fact that the voms-proxy-init command is not supplied by the conda package dirac-grid, but rather DIRACOS2 as far as I know.
I understand that only the DIRACOS2 installation is the one fully supported, but the README describes the 2 methods as independent of each other.

I tested also the DIRACOS2 installation, but I have a few fundamental issues with it:

• that installation assumes you do not have already a conda installed and it interferes with any existent one,
• DIRACOS2/DIRAC is installed in the base environment of this conda installation, which is, as far as I know, bad practice,
• I think the creation of the diracos folder and installation of the material within it plus the initialization of environment variables like $DIRAC should be separated from the creation of the conda environment (but I am not an expert of DIRAC) so one can use the environment he/She wants and do pip install DIRAC and in my case pip install CTADIRAC and the rest.

More in general, I'd like much more to do all in a conda installation and have DIRACOS2 with it, otherwise it's a bit weird, to say the least (perhaps I have made a mistake along the line, or it is already in the works?).

2nd issue

If I try to download a file from the grid I obtain the following error

ERROR {'Successful': {}, 'Failed': {'THE FILE': "Input/output error ( 5 : Failed to determine file size.: GError('srm-ifce err: Input/output error, err: [SE][Ls][] httpg://ccsrm02.in2p3.fr:8443/srm/managerv2: CGSI-gSOAP running on StargatcBookPro reports Could NOT import client credentials\\nGSS Major Status: General failure\\n\\nGSS Minor Status Error Chain:\\nglobus_gsi_gssapi: Unable to read credential for import\\nglobus_gsi_gssapi: Error with gss credential handle\\nglobus_gsi_gssapi: Error with GSI credential\\nglobus_sysconfig: Could not find a valid trusted CA certificates directory: The trusted certificates directory could', 5))"}}

I get this on different machines with the python3 interface and not with the old python2 one.

Many thanks in advance!

[HealthyPear]

Hi again (I thought I already answered but now I can't see my reply, so probably I dreamed of it),

I managed to solve my issues as follows:

• I added the voms conda-forge package to my environment,
• I set the following environment variables from the newly created and activated environment,

export X509_CERT_DIR=$CONDA_PREFIX/etc/grid-security/certificates
export X509_VOMS_DIR=$CONDA_PREFIX/etc/grid-security/vomsdir
export X509_VOMSES=$CONDA_PREFIX/etc/grid-security/vomses

I think such instructions should be added properly to the documentation for non-developer users.
I'll be glad to do it in case you wish me to do so in a PR.

(I have the feeling that the variable exporting should be done by one of either dirac-grid or voms packages.)

[chrisburr]

There are three issues here:

1. voms should have been a dependency of dirac-grid, this is fixed in: Add voms to dependencies conda-forge/dirac-grid-feedstock#76
2. You can get the certificates from ca-policy-lcg, if this is installed X509_CERT_DIR will be set automatically
3. I have no idea how best to handle the two voms variables. Some people want them to come from /etc/grid-security others want them from $CONDA_PREFIX/etc/grid-security/ (populated from dirac-configure).

In LHCb installing the lhcbdirac extension with conda/mamba sets up all of this correctly (including the local dirac.cfg). I don't know what makes the most sense for other VOs.

[HealthyPear]

1. voms should have been a dependency of dirac-grid, this is fixed in: Add voms to dependencies conda-forge/dirac-grid-feedstock#76

Nice! So from the next release, I can expect to be able to remove the voms package from my conda recipe, right?

2. You can get the certificates from ca-policy-lcg, if this is installed X509_CERT_DIR will be set automatically

Not sure if we use this, @arrabito will know more I guess

3. I have no idea how best to handle the two voms variables. Some people want them to come from /etc/grid-security others want them from $CONDA_PREFIX/etc/grid-security/ (populated from dirac-configure).

If the installation happens via conda I think the second option makes sense, no?

Anyway I recently changed my approach to the one suggested by the conda docs,

conda env config vars set A=B -n env_name

but I do this after the creation of the environment, I would have expected these variables to be set by the package itself during installation.

In LHCb installing the lhcbdirac extension with conda/mamba sets up all of this correctly (including the local dirac.cfg). I don't know what makes the most sense for other VOs.

With the solution I wrote above it works nicely for me now, probably there is some tuning to be done

[fstagni]

Hi, and thanks for your input.
@chrisburr might give a more complete answer, anyway:

voms is included in DIRACOS2: https://github.com/DIRACGrid/DIRACOS2/blob/main/construct.yaml#L61. And, it is also included in the DIRAC environment definition: https://github.com/DIRACGrid/DIRAC/blob/integration/environment.yml#L43

DIRACOS2 is the only one supported because it makes sure the environment is correctly created, basically by creating a diracorc file: https://github.com/DIRACGrid/DIRACOS2/blob/main/create_diracosrc.sh so that the env variables above are also set.

I am converting this to a "discussion" rather than staying as issue.