- galaxy-announce - lists.galaxyproject.org

Galactic News! April Edition: GCC2016, DevOps, Hacks, events, papers, jobs, servers, hub entries, releases, tools
by Dave Clements 31 Mar '16

31 Mar '16

Hello all, The *April Galaxy News <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04>* brings more than the usual amount of *News of the Galaxy*. First, there are a plethora of events coming up around the world: - GCC2016 <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#GCC2016>: - *Oral abstracts due April 8 <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#GCC2016_Abstract_Deadl…>* - *Scholarship applications due May 1 <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#Scholarships:_Applicat…>* - Register now and save big <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#GCC2016_Early_Registra…> - Please welcome the the Indiana Health Industry Forum (IHIF) <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#Sponsors> as a GCC2016 Sponsor - Two events sponsored by ELIXIR (and others) are coming up, both prominently featuring Galaxy: - Galaxy DevOps Workshop <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#Galaxy_DevOps_Workshop…>, 6-7 April, Heidelberg, Germany. *And there is still space.* - Hackathon: Tools, Workflows and Workbenches <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#Hackathon:_Tools.2C_Wo…>, 18-20 May, Paris, France - There is also a report from the RADSeq Tools and Workflows Hackathon <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#Report:_IUC_Contributi…> held in March. - Plus 12 additional events <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#Upcoming_Events> on three continents over the next three months. A lot of *new* - Papers <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#New_Papers> (86 of them, 6 highlighted) - Open positions <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#Who.27s_Hiring> (10 of them) - Halogen Bonding <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#New_Public_Galaxy_Serv…> Galaxy server - Galaxy Community Hub <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#Galaxy_Community_Hubs> entries (4 of them) - Releases <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#Releases> (Planemo <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#Planemo_0.24.0> and CloudMan <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#CloudMan_16.03>) - ToolShed Contributions <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#ToolShed_Contributions> And some other news <https://wiki.galaxyproject.org/GalaxyUpdates/2016_04#Other_News> too. Happy April, Dave Clements and the Galaxy Team <https://wiki.galaxyproject.org/GalaxyTeam> -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

GCC2016 Oral Presentation Abstracts due this Friday, March 25
by Dave Clements 22 Mar '16

22 Mar '16

Hello all, The general announcement for GCC2016 is below. Please note: 1) The oral presentation abstract deadline <https://gcc2016.iu.edu/abstracts/index.php> is March 25, *this Friday.* 2) There are scholarships available <https://wiki.galaxyproject.org/News/GCC2016Scholarships> for students and post-docs in historically underrepresented groups. And, please distribute the announcement below to any groups or individuals who might be interested, Thanks, and hope to see you in Bloomington, Dave C --------------------- The *2016 Galaxy Community Conference *(*GCC2016*, *gcc2016.iu.edu <http://gcc2016.iu.edu/>*) features two days of presentations, discussions, poster sessions, lightning talks, computer demos, keynotes, and birds-of-a-feather meetups, *all about data-intensive biology and the tools that support it*. Keynote speaker Yoav Gilad <http://genes.uchicago.edu/directory/yoav-gilad-phd/>, a professor of human genetics at the University of Chicago, will kick-start the main conference with a discussion on the analysis of large gene regulatory data sets. Preconference events include data <https://gcc2016.iu.edu/hacks/hacks-data.php> and coding <https://gcc2016.iu.edu/hacks/hacks-coding.php> hackathons <https://gcc2016.iu.edu/hacks/index.php>, and *two days of training* <https://gcc16.sched.org/overview/type/Training+%E2%80%94+Any> in five concurrent tracks covering 26 topics. *GCC2016* will be held at *Indiana University* in Bloomington, Indiana, June 25-29, 2016. Since it started seven years ago, GCC has been a well-attended gathering of biologists, genome researchers, bioinformaticians, and others in data-intensive biomedical research around the world. Galaxy <https://galaxyproject.org/> is an open, web-based platform for data-intensive biomedical research and enables easy interactive analysis through the web on arbitrarily large data sets. The Galaxy framework is a major resource in achieving key research goals within the biological field. It provides next-generation sequencing (NGS) tools and workflows for short-read mapping, ChIP-seq, RNA-seq, metagenomics, variant analysis, visualization, and support for Galaxy in the cloud. There are hundreds of local installs, and *over 80 publicly accessible servers* around the world. *Abstract submission** for oral presentations closes March 25. *Abstract submission for posters and computer demonstrations closes May 20. *Early registration* is now open. Registration starts at less than $45/day for post-docs and students. Registering early assures you a place at the conference and also a spot in the training workshops <https://gcc16.sched.org/overview/type/Training+%E2%80%94+Any> you want to attend. You can also *book conference housing* when you register. *Registration and lodging scholarships <https://wiki.galaxyproject.org/News/GCC2016Scholarships>* are available for attendees from underrepresented groups and developing countries. Thanks, and we hope to see you in Bloomington! The *GCC2016 Exec* -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

March 2016 Galaxy News: GCC2016 deadlines this month, GSOC 2016, RAD-Seq Hack …
by Dave Clements 01 Mar '16

01 Mar '16

Hello all, The *March 2016 Galactic News <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03>* is hot off the presses: - *GCC2016 <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#GCC2016>* news: - *Oral presentation abstracts due March 20 <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#GCC2016_Abstract_Submi…>.* If you are doing work in data-intensive biology then you are strongly encourage to present your work at the conference. Oral presentations, poster presentations, and the new Visualization Showcase & Software Demos are all opportunities to share your work. - Register early <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#GCC2016_Early_Registra…> and save up to 40% off regular registration costs. Early bird prices start at less than $45 / day for post-docs and students. - Apply for a GCC2016 Scholarship <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#Scholarships:_Internat…> . *Applications from international applicants are due March 20.* - The 2016 GMOD Meeting <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#GMOD_Meeting.2C_June_3…> will be held immediately following GCC2016, also at Indiana University. - And, we have a returning sponsor: Please welcome *BioTeam <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#Sponsors>* to GCC2016. - *March 7-8: Online IUC Contribution Fest - RADSeq Tools and Workflows <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#March_7-8:_Online_IUC_…>* - *Galaxy in Google Summer of Code <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#Galaxy_in_Google_Summe…>* - Twelve other upcoming events <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#Upcoming_Events> - 54 new publications, including 4 highlighted pubs <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#New_Papers> - New jobs <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#Who.27s_Hiring> - New releases <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#Releases>, including the new CloudBridge <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#CloudBridge_0.1.0> and two important security announcements <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#Security_Announcements> - Two new Galaxy servers <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#New_Public_Galaxy_Serv…> - New ToolShed Contributions <https://wiki.galaxyproject.org/GalaxyUpdates/2016_03#ToolShed_Contributions> Dave Clements and the Galaxy Team <https://wiki.galaxyproject.org/GalaxyTeam> -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

Galaxy 16.01 Release
by Nate Coraor 24 Feb '16

24 Feb '16

The Galaxy Committers team is pleased to announce the January 2016 (v16.01) release of Galaxy. Galaxy administrators should also be aware of the security announcements that I am posting simultaneously with this release announcement. The release notes follow. From: https://docs.galaxyproject.org/en/master/releases/16.01_announce.html January 2016 Galaxy Release (v 16.01) Highlights *Interactive Tours* The interactive tours framework allows developers and deployers to build interactive tutorials for users superimposed on the actual Galaxy web front end. Unlike video tutorials, these will not become stale and are truly interactive (allowing users to actually navigate and interact with Galaxy). Galaxy 16.01 ships with two example tours and new ones can easily be added by creating a small YAML file describing the tour. Try the Galaxy UI tour on Main. *Wheels* Galaxy’s Python dependencies have traditionally been distributed as eggs using custom dependency management code to enable Galaxy to distribute binary dependencies (enabling quick downloads and minimal system requirements). With this release all of that infrastructure has been replaced with a modern Python infrastructure based on pip and wheels. Work done as part of this to enable binary dependencies on Linux has been included with the recently released pip 8. Detailed documentation on these changes and their impact under a variety of Galaxy deployment scenarios can be found in the Galaxy Framework Dependencies section of the Admin documentation. *Nested Workflows* Workflows may now run other workflows as a single abstract step in the parent workflow. This allows for reusing or subworkflows in your analyses. Github *New* % git clone -b master https://github.com/galaxyproject/galaxy.git *Update to latest stable release* % git checkout master && pull --ff-only origin master *Update to exact version* % git checkout v16.01 BitBucket *Upgrade* % hg pull % hg update latest_16.01 See our wiki for additional details regarding the source code locations. Deprecation Notices Barring a strong outcry from deployers, 16.01 will be the last release of Galaxy to support Python 2.6. For more information, see Galaxy Github Issue #1596.

1 0

Galaxy Security Vulnerability - Read/write arbitrary filesystem paths, arbitrary code execution
by Nate Coraor 24 Feb '16

24 Feb '16

*DESCRIPTION* Multiple security vulnerabilities were recently discovered in Galaxy that allow malicious actors to read and write files on the Galaxy server. Additionally, Galaxy servers on which a rarely used feature has been enabled are vulnerable to an arbitrary code execution exploit. 1. A write vulnerability exists in the history import mechanism. It is possible to create a history tar archive that contains files with parent directory components in the file path (e.g. "foo/../../bar" would extract to "../bar"), and these archive members would be written if the user running the Galaxy server had write permission to the given path. 2. A read vulnerability exists in the object store path composition code. Galaxy allows clients to add elements to the end of a path to "extra" files associated with a dataset (as is the case with composite datatypes). These elements were not being checked to ensure they did not contain relative parent references ('..') or did not start with an absolute path character ('/'). Because of this, the dataset display methods could be manipulated to return the contents of any files for which the Galaxy server user had read permission. 3. An arbitrary code execution vulnerability exists in the Galaxy sample tracking system. The sample tracking system included a feature which allowed administrators to browse remote "external services" (such as sequencers) to choose files to transfer to the Galaxy server. This browsing code used a shell invocation which did not sanitize user input. However, this code is only reachable if at least one external service has ever been defined. The Galaxy Committers would like to thank Youri Hoogstrate at the Erasmus MC, Rotterdam, who initially reported a similar vulnerability in the Tool Shed. Through additional auditing based on this attack vector, we discovered the other vulnerabilities. *AFFECTED VERSIONS* This issue affects all known releases of Galaxy in at least the last 3 years. *IMPACT* The read and write vulnerabilities can be exploited to write to any path on the Galaxy server writable by the Galaxy user, which can be potentially destructive to Galaxy configuration files and data. Additionally, they can be used to read any file available on the system that is readable by the user running the Galaxy server, including Galaxy config files, data, system config files, contents of /proc, etc. As such, Galaxy administrators are strongly encouraged to update immediately. The arbitrary code execution vulnerability can be exploited to execute any shell command as the Galaxy user, which is also very dangerous. If your Galaxy instance has had an external service configured at any point in the past, you are strongly encouraged to update immediately. *SOLUTION* Fixes for these vulnerabilities have been applied to the 14.10 and newer release branches in the public GitHub and Bitbucket repositories. Galaxy versions older than 14.10 should upgrade (preferably to 16.01). To apply the fix, first identify your current Galaxy release version using the `git branch` or `hg branch` commands. If you are on a 'release_YY.MM' branch, you can update with: % git pull or: % hg pull -u The process above can also be used to update to the 16.01 release if you are on the 'master' git branch or the 'stable' hg branch. If you are on the 'master'/'stable' branch and wish to remain on your current Galaxy major release, check the 'lib/galaxy/version.py' file to determine your major release version, then update to the appropriate branch: % git checkout -b release_YY.MM origin/release_YY.MM % git pull or: % hg pull % hg update release_YY.MM For the changes to take effect, *YOU MUST RESTART ALL GALAXY SERVER PROCESSES*. On behalf of the Galaxy Committers, --nate

1 0

Galaxy/Tool Shed Security Vulnerability - Read/write arbitrary filesystem paths
by Nate Coraor 24 Feb '16

24 Feb '16

*DESCRIPTION* Multiple security vulnerabilities were recently discovered in the Tool Shed that allow malicious actors to read and write files on the Tool Shed server outside of normal Tool Shed repository directories. 1. A write vulnerability exists in the Tool Shed tarball and capsule upload functionality. It is possible to create a tar archive that contains files with parent directory components in the file path (e.g. "foo/../../bar" would extract to "../bar"), and these archive members would be written if the user running the Tool Shed had write permission to the given path. The Tool Shed tarball handling code checked for invalid characters ('/' or '..') at the beginning of the path but not for '..' in the middle of a path. 2. A read vulnerability exists in multiple places. The first is in the (now deprecated) `hg push` functionality for updating Tool Shed repositories. This method allows malicious actors to push symlinks whose targets are outside the repository (either via an absolute or relative path). The contents of the targets would then be visible in the Tool Shed repository contents viewer, if the Tool Shed user has read permission on the target. 3. A second read vulnerability exists in the Tool Shed repository contents viewer. The viewer would allow a malicious actor to specify a path outside the repository, and if the Tool Shed system user had read permissions on that path, it would be displayed. The viewer also did not check to ensure that the targets of symlinks in a repository did not point outside the repository. The repository contents viewer read vulnerability also exists in Galaxy, but is only reachable/exploitable by admin users. The Galaxy Committers would like to thank Youri Hoogstrate at the Erasmus MC, Rotterdam, who initially reported the `hg push` vulnerability. Through additional auditing based on this attack vector, we discovered the other vulnerabilities. *AFFECTED VERSIONS* These issues affect all known releases of the Tool Shed and Galaxy in at least the last 3 years. *IMPACT* This vulnerability can be exploited to read any file available on the system that is readable by the user running the Tool Shed or Galaxy server, including Galaxy/Tool Shed config files, data, system config files, contents of /proc, etc. As such, Tool Shed administrators are strongly encouraged to update immediately. For Galaxy administrators, the impact is not as great, unless Galaxy administrators do not have access to the Galaxy server command line. *SOLUTION* Fixes for these vulnerabilities have been applied to the 15.01 and newer (14.10 in the case of the portion of the vulnerability affecting Galaxy) release branches in the public GitHub and Bitbucket repositories. Tool Shed versions older than 15.01 should upgrade (preferably to 16.01). To apply the fix, first identify your current Galaxy release version using the `git branch` or `hg branch` commands. If you are on a 'release_YY.MM' branch, you can update with: % git pull or: % hg pull -u The process above can also be used to update to the 16.01 release if you are on the 'master' git branch or the 'stable' hg branch. If you are on the 'master'/'stable' branch and wish to remain on your current Galaxy major release, check the 'lib/galaxy/version.py' file to determine your major release version, then update to the appropriate branch: % git checkout -b release_YY.MM origin/release_YY.MM % git pull or: % hg pull % hg update release_YY.MM For the changes to take effect, *YOU MUST RESTART ALL GALAXY SERVER PROCESSES*. On behalf of the Galaxy Committers, --nate

1 0

GCC2016 Registration & Lodging Scholarships
by Dave Clements 18 Feb '16

18 Feb '16

We are pleased to offer scholarships <https://docs.google.com/forms/d/1IbMoNcA6z31a8hvqjSdfQRIQ92wo-HxXvA5uk0Uiln…> for the 2016 Galaxy Community Conference <http://gcc2016.iu.edu/>, being held in Bloomington, Indiana, United States, June 25-29. Scholarships are available to students and post-docs in historically under-represented groups, and to those from or based in Low and Lower-Middle Income Economies, as defined by the World Bank <http://bit.ly/1nO82wD>. If this describes you or one of your students then we hope to receive an application. *Scholarships cover registration <http://gcc2016.iu.edu/registration> and lodging <http://gcc2016.iu.edu/location> during the GCC Meeting, and for any Training or Hackathon events the applicant chooses to attend.* Scholarships do not cover travel or other expenses. Applicants are required to 1. Either • Submit a poster and/or demo abstract <http://bit.ly/gcc2016abssub>. Or, • Submit a 200-250 word essay on how attending GCC2016 will benefit your research and career. *Poster/demo abstracts are strongly preferred.* The essay option should only be used by those who are starting their research careers. 2. Have a faculty member / PI send a letter of recommendation to community-fund(a)lists.galaxyproject.org no later than May 10 or March 27 (depending on your deadline). 3. Submit an application form <https://docs.google.com/forms/d/1IbMoNcA6z31a8hvqjSdfQRIQ92wo-HxXvA5uk0Uiln…> . 4. Have sufficient funds to cover your own travel and other expenses If you are submitting a poster or demo, please do so *before* submitting an application <https://docs.google.com/forms/d/1IbMoNcA6z31a8hvqjSdfQRIQ92wo-HxXvA5uk0Uiln…>. You also need to identify and ask a faculty member to write a letter of recommendation prior to applying. *The application deadline is May 1 for members of historically underrepresented groups and March 20 for those from Low and Lower-Middle Income Economies*. Applicants will be notified of their scholarship status no later than two weeks after the deadline. Dave Clements on behalf of the Galaxy Community Fund Board -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

February 2016 Galaxy News: GCC2016 Registration and Abstract Submission are Open
by Dave Clements 02 Feb '16

02 Feb '16

Hello all, The *February 2016 Galactic News <https://wiki.galaxyproject.org/GalaxyUpdates/2016_02>* is hot off the presses: *GCC2016 <https://wiki.galaxyproject.org/GalaxyUpdates/2016_02#GCC2016> early registration and abstract submission are now open.* - Register early <https://wiki.galaxyproject.org/GalaxyUpdates/2016_02#GCC2016_Early_Registra…> and save up to 40% off regular registration costs. Early bird prices start at less than $45 / day for post-docs and students. - Abstract submission is open <https://wiki.galaxyproject.org/GalaxyUpdates/2016_02#GCC2016_Abstract_Submi…> as well. If you are doing work in data-intensive biology then you are strongly encourage to present your work at the conference. Oral presentations, poster presentations, and the new Visualization Showcase & Software Demos are all opportunities to share your work. - And, we have two new sponsors: Please welcome Lenovo and Globus Genomics <https://wiki.galaxyproject.org/GalaxyUpdates/2016_02#Sponsors> to GCC2016. *And lots of new, new, new, new:* - New Tutorials ... and Interactive Tours! <https://wiki.galaxyproject.org/GalaxyUpdates/2016_02#New_Tutorials_..._and_…> - 156 new publications, including 8 highlighted pubs <https://wiki.galaxyproject.org/GalaxyUpdates/2016_02#New_Papers> - New jobs <https://wiki.galaxyproject.org/GalaxyUpdates/2016_02#Who.27s_Hiring> - New releases <https://wiki.galaxyproject.org/GalaxyUpdates/2016_02#Releases> - New Galaxy servers <https://wiki.galaxyproject.org/GalaxyUpdates/2016_02#New_Public_Galaxy_Serv…> - New ToolShed Contributions <https://wiki.galaxyproject.org/GalaxyUpdates/2016_02#ToolShed_Contributions> *And other cool bits too:* - Galaxy Goes Mobile <https://wiki.galaxyproject.org/GalaxyUpdates/2016_02#Galaxy_Goes_Mobile.21> - Galaxy on Windows and OS X using Kitematic <https://wiki.galaxyproject.org/GalaxyUpdates/2016_02#Galaxy_on_Windows_and_…> - Ten upcoming events <https://wiki.galaxyproject.org/GalaxyUpdates/2016_02#Upcoming_Events> Happy February! Dave Clements and the Galaxy Team <https://wiki.galaxyproject.org/GalaxyTeam> -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0

January 2016 Galactic News
by Dave Clements 04 Jan '16

04 Jan '16

1 0

GCC2016 Web Site is Up: Including registration rates, and full training schedule
by Dave Clements 18 Dec '15

18 Dec '15

Hello all, We are pleased to announce that the *2016 Galaxy Community Conference website is now online <http://gcc2016.iu.edu/>* and includes registration information <http://gcc2016.iu.edu/registration/index.php> and the full training schedule <https://gcc16.sched.org/grid-full#2016-06-26>. GCC2016 <http://gcc2016.iu.edu/> will be held June 25-29 at Indiana University <http://indiana.edu/> in Bloomington, Indiana, United States. This will be the 7th annual gathering of the Galaxy community, and we are expecting over 200 participants again this year. Registration information <http://gcc2016.iu.edu/registration/index.php> includes the different registration packages, rates, and deadlines. Our inexpensive early registration rates start at less than $40 per day for students and post-docs. Registration will open within a month. The training schedule <https://gcc16.sched.org/grid-full#2016-06-26> includes session descriptions, prerequisites, and instructors. Many thanks to everyone who nominated and voted on topics, and especially to the many instructors <https://gcc16.sched.org/directory/artists> who are contributing their time and effort to make GCC2016 a success. Thanks also go to the Indiana University Pervasive Technology Institute (PTI) <https://pti.iu.edu/>, who are supporting GCC2016 as a *Platinum Sponsor <https://gcc2016.iu.edu/sponsors/index.php>*. PTI is home to the National Center for Genome Analysis Support <http://ncgas.org/> (for which NSF funding was recently renewed <https://itnews.iu.edu/articles/2015/iu-genome-analysis-center-wins-national…>), and the Galaxy Trinity instance <https://galaxy.ncgas-trinity.indiana.edu/root>, and is a long time supporter of the Galaxy Community. PTI pairs fundamental academic computational research with the widely known strengths of Indiana University through innovations and service delivery in networking and high performance computing. See the PTI website <http://pti.iu.edu/> for more information. We continue to seek other sponsors as well and offer a wide range of sponsorship plans <https://gcc2016.iu.edu/sponsors/index.php>. If your organization is interested in having a presence at GCC2016, please contact the GCC2016 Exec <gcc2016-exec(a)lists.galaxyproject.org> for more information. Hope to see you in Bloomington! The GCC2016 Exec <gcc2016-exec(a)lists.galaxyproject.org> -- http://galaxyproject.org/ http://getgalaxy.org/ http://usegalaxy.org/ https://wiki.galaxyproject.org/

1 0