- galaxy-announce - lists.galaxyproject.org

Re: [galaxy-announce] [galaxy-dev] Nominate the training topics you want to see at GCC2017
by Dave Clements 18 Jan '17

18 Jan '17

Hello all, Thanks to everyone who's already nominated topics, and a reminder that *Topic Nominations close 20 January, which is this Friday.* You can nominate a topic now: http://bit.ly/gcc2017trainingnom The list of topics nominated thus far is: https://gcc2017.sciencesconf.org/page/training Please nominate the topics you would like to see. And, if you see a nominated topic that you would like to provide a more detailed description for, then please renominate that topic and include the expanded description. Thanks, Dave C, on Behalf of the GCC2017 Organising Committee On Mon, Jan 9, 2017 at 1:02 AM, Olivier Inizan <olivier.inizan(a)inra.fr> wrote: > Hello all, > > Training Day topics are nominated by you, the Galaxy Community. Please > take a minute to nominate a topic. Any topic of interest to the Galaxy > Community can be nominated and you are encouraged to nominate more than one > topic. If you are looking for ideas, see the topic nominated in > > - 2016 bit.ly/gcc2016noms, > - 2015 bit.ly/gcc2015vote, > - 2014 bit.ly/1s6NtMN, > - 2013bit.ly/1i2j1gN, > - and the Galaxy Events page (new.galaxyproject.org/events/) > > > The 2017 Galaxy Community Conference (GCC2017, gcc2017.sciencesconf.org) > will be held 26-30 in Montpellier, France. > > It will feature two days of training: the first day will be single track > focused on introducing Galaxy for bioinformatics analysis; the second day > will feature multiple tracks spanning the breadth of Galaxy usage, admin, > deployment, and tools. > > > Nominated topics will be published on the GCC2017 Training page as they > come in (gcc2017.sciencesconf.org/) > > Topic Nominations close 20 January. Topics will be compiled into a uniform > list by GCC2017 organizers, and then voted on by the Galaxy Community > starting one week later. > > > You can nominate a topic now: > https://t.co/DkOmqELY6h > > Olivier Inizan, > > On behalf of the GCC2017 Organizing Committee > > > > > Olivier Inizan > ------------------------------------------------ > Merci de noter ma nouvelle adresse: > > olivier.inizan(a)inra.fr > > Unité de Recherches en Génomique-Info (UR INRA 1164), > INRA, Centre de recherche de Versailles, bat.18 > RD10, route de Saint Cyr > 78026 Versailles Cedex, FRANCE > > > Tél: +33 1 30 83 38 25 > Fax: +33 1 30 83 38 99 > http://urgi.versailles.inra.fr [urgi.versailles.inra.fr] > Twitter: @OlivierInizan > > > ___________________________________________________________ > Please keep all replies on the list by using "reply all" > in your mail client. To manage your subscriptions to this > and other Galaxy lists, please use the interface at: > https://lists.galaxyproject.org/ > > To search Galaxy mailing lists use the unified search at: > http://galaxyproject.org/search/mailinglists/ > -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

Galaxy Australasia Meeting Update: Register now, Poster Abstracts, Training
by Dave Clements 11 Jan '17

11 Jan '17

Hello all, The Galaxy Australasia Meeting <https://www.embl-abr.org.au/game2017/> will bring together biomedical researchers, bioinformaticians, infrastructure providers, and data producers from across Australia and Asia. GAMe 2017 will be held 3-9 February at the University of Melbourne, in Melbourne, Australia. The schedule of events is: 3 Feb Friday: Researcher Training Day <https://www.embl-abr.org.au/game2017/training-day/>: 4 Feb Saturday: Conference Day 1: BIO Day <https://www.embl-abr.org.au/game2017/conference/#bio> 5 Feb Sunday: Conference Day 2: INFO Day <https://www.embl-abr.org.au/game2017/conference/#info> 6-9 Feb Mon-Thu: Galaxy Administrator Training <https://www.embl-abr.org.au/game2017/training-for-admin-workshop/> You can register <https://www.embl-abr.org.au/game2017/registration/> to attend any combination of these events. (Details on each event are below.) *The Conference is still accepting poster submissions <https://www.embl-abr.org.au/game2017/abstracts/>.* This is a great opportunity to share your work with other researchers facing the challenges of data intensive biology. *On-time registration <https://www.embl-abr.org.au/game2017/registration/> ends 27 January*, and registering now avoids the ~ 80% cost increase for late registrations. (Some training sessions may sell out before then, so you are encouraged to register sooner rather than later.) This is a rare opportunity for the data intensive life science research community to gather, and is the first large multi-day Galaxy event to be offered outside of Europe and North America. You are encouraged to join your fellow researchers in sunny and summery Melbourne this February. Thanks, Dave C PS: And please help spread the word by sharing and posting the attached announcement or this email. Follow us: #GAMe_2017, @GalaxyAustralia ---- *Researcher Training Day <https://www.embl-abr.org.au/game2017/training-day/>, 3 February Friday* Researcher Training Day targets life scientists working with Next-Generation Sequencing data, in particular RNA-Seq, RAD-Seq, and microbial genomes. Session instructors are experienced researchers and trainers and are prominent members of both the Galaxy and Australian training communities. If you want to learn how to do NGS analysis without also having to become a systems admin, then this is the event for you. *Conference Day 1: BIO Day <https://www.embl-abr.org.au/game2017/conference/#bio>, 4 February Saturday* *Conference Day 2: INFO Day <https://www.embl-abr.org.au/game2017/conference/#info>, 5 February Sunday* The two day conference is split into BIO and INFO days. Both days will feature keynotes by prominent community members <https://www.embl-abr.org.au/game2017/conference/#keynotespeakers> James Taylor and Björn Grüning, as well as accepted and invited talks, posters, panels, and birds-of-a-feather and other networking opportunities. Speakers from Australia, Japan, India, the United States, Germany, and Canada are on the program. If you are performing, enabling or supporting data-intensive biology then this meeting will be time well spent. *Galaxy Administrator Training <https://www.embl-abr.org.au/game2017/training-for-admin-workshop/>, 6-9 February Monday-Thursday* This 4-day workshop will be intensive and hands-on, and taught by experienced instructors from the Genomics Virtual Lab, Galaxy Project, and Galaxy Freiburg teams. Participants will learn how to install, configure, customize, and extend their own Galaxy servers. Topics include tool configuration, authentication and user management, using heterogeneous storage and compute services, and many other topics that will enable you to get your own Galaxy server up and running, performing well, and used by your community. This is only the second time this workshop has been offered. -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

Nominate the training topics you want to see at GCC2017
by Olivier Inizan 09 Jan '17

09 Jan '17

Hello all, Training Day topics are nominated by you<http://bit.ly/gcc2014tdnom>, the Galaxy Community. Please take a minute to nominate a topic. Any topic of interest to the Galaxy Community can be nominated and you are encouraged to nominate more than one topic. If you are looking for ideas, see the topic nominated in - 2016 bit.ly/gcc2016noms<https://www.google.com/url?q=http://bit.ly/gcc2016noms&sa=D&ust=14839520754…>, - 2015 bit.ly/gcc2015vote<https://www.google.com/url?q=http://bit.ly/gcc2015vote&sa=D&ust=14839520754…>, - 2014 bit.ly/1s6NtMN<https://www.google.com/url?q=http://bit.ly/1s6NtMN&sa=D&ust=148395207543200…>, - 2013bit.ly/1i2j1gN<https://www.google.com/url?q=http://bit.ly/1i2j1gN&sa=D&ust=148395207543200…>, - and the Galaxy Events page (new.galaxyproject.org/events/<https://www.google.com/url?q=http://new.galaxyproject.org/events/&sa=D&ust=…>). The 2017 Galaxy Community Conference (GCC2017, gcc2017.sciencesconf.org<https://www.google.com/url?q=http://gcc2017.sciencesconf.org&sa=D&ust=14839…>) will be held 26-30 in Montpellier, France. It will feature two days of training: the first day will be single track focused on introducing Galaxy for bioinformatics analysis; the second day will feature multiple tracks spanning the breadth of Galaxy usage, admin, deployment, and tools. Nominated topics will be published on the GCC2017 Training page as they come in (gcc2017.sciencesconf.org/<https://www.google.com/url?q=http://gcc2017.sciencesconf.org/&sa=D&ust=1483…>). Topic Nominations close 20 January. Topics will be compiled into a uniform list by GCC2017 organizers, and then voted on by the Galaxy Community starting one week later. You can nominate a topic now: https://t.co/DkOmqELY6h Olivier Inizan, On behalf of the GCC2017 Organizing Committee Olivier Inizan ------------------------------------------------ Merci de noter ma nouvelle adresse: olivier.inizan(a)inra.fr Unité de Recherches en Génomique-Info (UR INRA 1164), INRA, Centre de recherche de Versailles, bat.18 RD10, route de Saint Cyr 78026 Versailles Cedex, FRANCE Tél: +33 1 30 83 38 25 Fax: +33 1 30 83 38 99 http://urgi.versailles.inra.fr [urgi.versailles.inra.fr] Twitter: @OlivierInizan

1 0

January 2017 News of the Galaxy: Register now for GAMe 2017!
by Dave Clements 04 Jan '17

04 Jan '17

1 0

Announcing the October 2016 (v16.10) Galaxy Release
by Nate Coraor 15 Dec '16

15 Dec '16

The Galaxy Committers team <https://github.com/galaxyproject/galaxy/blob/dev/doc/source/project/organiz…> is pleased to announce the *October 2016 (v16.10) release of Galaxy <https://docs.galaxyproject.org/en/master/releases/16.10_announce.html>*. Security <https://docs.galaxyproject.org/en/master/releases/16.10_announce.html#secur…> An arbitrary code execution vulnerability in two tools and an XSS vulnerability with the upload tool were identified this release cycle and have been fixed concurrently with the release. In addition, the fixes have been backported to older releases. The Galaxy Committers would like to thank David Wyde for disclosing these vulnerabilities. Details follow: 1. The vulnerable tools are “Filter GFF data by attribute” and “Filter GFF data by feature count”, both of which are provided with and enabled by default in the Galaxy server. These two tools share code with each other and the more general “Filter data on any column using simple expressions” tool. The latter was fixed in a previous security disclosure but these GFF variants of the tool were missed when updating the Filter tool. These tools use the Python eval and exec functions and do not properly sanitize input to these functions. The fix for this issue has been applied to Galaxy releases back to v14.10 and can be found in Commit c1e3087 2. An uploaded file’s name was not properly sanitized, and so a specially crafted filename uploaded to the Galaxy server could be used as an XSS attack vector. The fix for this issue has been applied to Galaxy releases back to v16.07 and can be found in Pull Request 3278. Highlighted Enhancements <https://docs.galaxyproject.org/en/master/releases/16.10_announce.html#highl…> - Overhaul of charts visualization - more visualizations, more options, and better user interface. - Paginate contents of large histories. - Implement a collection operation tool for merging collections (thanks to @Takadonet). - Replace reference documentation for tool XML files with automatically generated documentation from a now official Galaxy XSD documentation (with help from many). - Add a password strength evaluation bar (thanks to @benfulton). - Implement a GoDocker job runner (thanks to @varunshankar). - Support for API batch requests. - Allow JSONP to be returned from API endpoints. - Add “Save as” as an option in the workflow editor (thanks to @tmcgowan). - Allow naming input datasets and collections during workflow extraction. - Various enhancements for API driven installation of tool shed repositories. Get Galaxy <http://getgalaxy.org/> The code lives at Github <https://github.com/galaxyproject/galaxy> and you should have Git <https://git-scm.com/> to obtain it. *To get a new Galaxy repository run:* $ git clone -b release_16.10 https://github.com/galaxyproject/galaxy.git *To update an existing Galaxy repository run:* $ git checkout release_16.10 && git pull --ff-only origin release_16.10 Release Notes <https://docs.galaxyproject.org/en/master/releases/16.10_announce.html> For full details on all of the enhancements and fixes in this release, please see the full release notes <https://docs.galaxyproject.org/en/master/releases/16.10_announce.html>. On behalf of the Galaxy Committers <https://github.com/galaxyproject/galaxy/blob/dev/doc/source/project/organiz…> , *Thanks for using Galaxy!* --nate

1 0

Galaxy Security Vulnerability - Arbitrary code execution
by Nate Coraor 15 Dec '16

15 Dec '16

*DESCRIPTION* A security vulnerability was recently discovered by David Wyde in two Galaxy tools that are provided with and enabled by default in the Galaxy server. These vulnerabilities allow malicious actors to execute arbitrary code as the user running the Galaxy server. The vulnerable tools are "Filter GFF data by attribute" and "Filter GFF data by feature count", two tools which share code with each other and the more general "Filter data on any column using simple expressions" tool. The latter was fixed in a previous security disclosure but these GFF variants of the tool were missed when updating the Filter tool. These tools use the Python `eval` and `exec` functions and do not properly sanitize input to these functions. Additionally, an XSS vulnerability with the upload tool: An uploaded file's name was not properly sanitized, and so a specially crafted filename uploaded to the Galaxy server could be used as an XSS attack vector. This vulnerability has already been fixed in the 16.07 and 16.10 Galaxy releases. The Galaxy Committers would like to thank David for disclosing these vulnerabilities. If you discover security vulnerabilities in Galaxy, please report them to the Galaxy Committers at galaxy-committers(a)lists.galaxyproject.org. *AFFECTED VERSIONS* These arbitrary code execution vulnerability is present in all known releases of Galaxy using the default tool config or a tool config in which these tools are loaded. To determine if your Galaxy server is affected, check your tool_conf.xml for the following lines: <tool file="filters/gff/gff_filter_by_attribute.xml" /> <tool file="filters/gff/gff_filter_by_feature_count.xml" /> If you are unsure, you can also check to see if the tools have loaded by searching for them in your Galaxy server logs, e.g.: % grep gff_filter paster.log galaxy.tools.toolbox.base DEBUG 2016-12-08 13:25:16,930 Loaded tool id: gff_filter_by_attribute, version: 0.1 into tool panel.. galaxy.tools.toolbox.base DEBUG 2016-12-08 13:25:16,930 Loaded tool id: gff_filter_by_feature_count, version: 0.1 into tool panel.. *IMPACT* This vulnerability can be exploited to execute arbitrary code as the user that runs Galaxy jobs on any system where Galaxy runs those jobs (potentially a cluster). Such code can be used to provide a remote shell to an attacker, or read/write/delete files that the Galaxy user has appropriate permissions on. *SOLUTION* Multiple solutions exist for the arbitrary code execution vulnerability: 1. Update your Galaxy code. A fix for the issue has been applied to stable releases of Galaxy back to version 14.10. 2. Disable the affected tools. 3. Patch the affected tools. Patches to fix the vulnerabilities (depending on the version of Galaxy that you are running) can be found below. *INSTRUCTIONS* 1. To apply the fix, first identify your current Galaxy release version using the `git branch` command. If you are on a 'release_YY.MM' branch, you can update with: % git pull The process above can also be used to update to the 16.10 release if you are on the 'master' git branch. If you are on the 'master' branch and wish to remain on your current Galaxy major release, check the 'lib/galaxy/version.py' file to determine your major release version, then update to the appropriate branch: % git fetch origin % git checkout -b release_YY.MM origin/release_YY.MM % git pull 2. To disable the tools, locate and remove the following lines from your tool_conf.xml, then restart Galaxy: <tool file="filters/gff/gff_filter_by_attribute.xml" /> <tool file="filters/gff/gff_filter_by_feature_count.xml" /> 3. To manually patch the tools, use the appropriate patch file below: For Galaxy releases 16.01 to dev: https://depot.galaxyproject.org/patch/filter_security_16_01.patch For Galaxy releases 15.07 to 15.10: https://depot.galaxyproject.org/patch/filter_security_15_07.patch For Galaxy releases 14.10 to 15.05: https://depot.galaxyproject.org/patch/filter_security_14_10.patch To apply the patch, navigate to the root of your Galaxy directory, then execute (replacing <patch_url> with the url above appropriate for your current Galaxy release): % wget -O filter_security.patch <patch_url> or: % curl -o filter_security.patch <patch_url> and then test applying the patch: % patch -p1 --dry-run < filter_security.patch checking file tools/filters/gff/gff_filter_by_attribute.py checking file tools/filters/gff/gff_filter_by_attribute.xml checking file tools/filters/gff/gff_filter_by_feature_count.py checking file tools/filters/gff/gff_filter_by_feature_count.xml If this succeeds without error (applying successfully with fuzz/offset is fine), apply with: % patch -p1 < filter_security.patch patching file tools/filters/gff/gff_filter_by_attribute.py patching file tools/filters/gff/gff_filter_by_attribute.xml patching file tools/filters/gff/gff_filter_by_feature_count.py patching file tools/filters/gff/gff_filter_by_feature_count.xml In all cases, for the changes to take effect, *YOU MUST RESTART ALL GALAXY SERVER PROCESSES*. On behalf of the Galaxy Committers, --nate

1 0

December Galaxy News: New web site, GAMe deadline extended
by Dave Clements 06 Dec '16

06 Dec '16

Hello all, The *December Galaxy News <https://new.galaxyproject.org/GalaxyUpdates/2016_12/>* is hot off the press, *and is was produced on a a hot new press. *Highlights this month include: - The *Galaxy Community Hub (the Hub) <https://new.galaxyproject.org/GalaxyUpdates/2016_12/#galaxy-community-hub-t…>* will be the new home for Galaxy Community documentation, replacing the current wiki. - And we are asking for help to get it ready for it's official launch <https://new.galaxyproject.org/GalaxyUpdates/2016_12/#the-community-hub-cont…> - *Galaxy Australasia Meeting (GAMe 2017) <https://new.galaxyproject.org/GalaxyUpdates/2016_12/#galaxy-australasia-mee…>*: February 3-9, Melbourne, Victoria, Australia. - *Talk abstract submission extended to 14 December.* - *Early registration ends 31 December.* - And of course, other upcoming events <https://new.galaxyproject.org/GalaxyUpdates/2016_12/#all-upcoming-events> too There are also 60 new publications (including eight featured pubs), four open positions, two new public Galaxy servers, new releases of Planemo & Pulsar, and other news too. Dave Clements and the Galaxy Team -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

Talk abstracts for Galaxy Australasia Meeting (GAMe 2017) are due 30 Nov
by Dave Clements 23 Nov '16

23 Nov '16

Hello all, This is just a reminder that talk abstracts for the 2017 Galaxy Australasia Meeting (GAMe 2017, https://www.embl-abr.org.au/game2017/) are due Wednesday, 30 November. GAMe 2017 is a series of events in Melbourne, Australia running from 3 February through 11 February. This includes a training day for researchers on *using* Galaxy, a two day meeting, and then a 4 day course on how to set up your own production quality Galaxy server. Oral presentations will be given at the meeting, 4-5 February. The meeting is split into a BIO Day (4 Feb) focusing on biological applications, and an INFO Day (5 Feb) focusing on infrastructure, tools, development and deployment. Participants can register for one or both days, and you can specify a preferred presentation day when you submit your abstract(s). GAMe 2017 will also feature poster presentations, keynotes, birds-of-a-feather meetups, and lots of networking., Poster abstracts are reviewed on a rolling basis and will be accepted until we run out of poster space (so, submitting sooner is better). Early registration ends 31 December. We strongly encourage you to register early can save up to 45% off regular registration rates. We hope to see you in Melbourne! The GAMe 2017 Organising Committee -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

November 2016 Galactic News
by Dave Clements 31 Oct '16

31 Oct '16

1 0

News of the Galaxy: October 2016
by Dave Clements 03 Oct '16

03 Oct '16

1 0