“Client-side cloud-computing interface to Globus-enabled TeraPort cluster at U of C”

… in these slides: http://eucalyptus.cs.ucsb.edu/documents/eucalyptus-slides-wolski-cloud_expo_apr08.ppt

There is a Nimbus client (which can be replaced by an Amazon’s EC2 client), true. But most of Nimbus is server side software.

Teraport (and other Science Clouds) are not “globus enabled” but rather host the server-side components of Nimbus. Nimbus converts a set of hypervisors into what some will call an “IaaS cloud” or “open source EC2″ (Nimbus was released before EC2 but EC2 protocol support has been added due to customer demand).

The remote messaging modules (EC2 and a separate WS system) are hosted in a container that is based on Axis — some Globus Toolkit components also use that. This is a thin layer that provides marshalling/unmarshalling and security, converting messages to a common format for use with the framework independent “meat” of the Nimbus service (it could be hosted in another container).

See the FAQ, publications, and news if you would like to learn more about Nimbus.

We’ve been running self-configuring 100+ node clusters on EC2 since 2007, but I would be remiss if I did not link to this announcement.

“This report chronicles and analyzes the responses of thirty users to questions about using the Globus Toolkit - starting with summaries of results and conclusions but also including very detailed appendices and even transcripts of the interviews. Very interesting information for those involved in distributed computing.”

http://www.mcs.anl.gov/~childers/perspectives/

See the changelog for all the details.

“As a proof of concept we executed a practical attack scenario and successfully created a rogue Certification Authority (CA) certificate trusted by all common web browsers. This certificate allows us to impersonate any website on the Internet, including banking and e-commerce sites secured using the HTTPS protocol.”

I wrote a program to look through the trusted certs that came with Firefox 3.0.4 for any CAs with MD5 signature algorithms.

[snip]

UPDATE: the list was not relevant because of a feature of the attack (thanks Thomas). Apparently “only RapidSSL and FreeSSL are practically vulnerable”

UPDATE 2: VeriSign responds, no longer possible with RapidSSL. And they’ve been phasing MD5 out across the board.

[via Stephen Spector]

The main new features provided in this release are tools facilitating the deployment, configuration and management of clouds. We also updated our implementation to match the current Amazon EC2 deployment. In addition, the release contains new documentation and bug fixes.

You can download the new release from:
http://workspace.globus.org/downloads/index.html

The full changelog can be found here:
http://workspace.globus.org/vm/changelog.html#TP2.1

Windows in the Cloud? Been there, done that!

GoGrid has already almost a year of proven experience providing Windows Server 2003/2008 to end users… we are also a Microsoft Gold Certified Partner.

We are pleased to announce GridShib for Globus Toolkit v0.6.1:

http://gridshib.globus.org/downloads/gridshib-gt-0_6_1-src.tar.gz
http://gridshib.globus.org/downloads/gridshib-gt-0_6_1-src.zip

Please visit the GridShib for GT home page for an introduction and links to software and documentation:

http://gridshib.globus.org/docs/gridshib-gt-0.6.1/

This version of GridShib for GT is primarily a bug fix release. There is one new feature, and that is, a refactoring of the blacklisting framework that now permits the blacklisting of identity attributes (such as e-mail addresses) in addition to IP addresses and SAML name identifiers. See the CHANGES file for a complete list of changes in this version:

http://gridshib.globus.org/docs/gridshib-gt-0.6.1/CHANGES.txt

Along with GridShib SAML Tools v0.5.0, version 0.6.1 of GridShib for GT will be included in a Capability Kit to supplement the Coordinated TeraGrid Software and Services (CTSS) stack. This is the next step in a focused effort to deploy GridShib software at both the science gateways and resource providers throughout the TeraGrid. This work is funded by the NSF TeraGrid Grid Integration Group through a sub-award to NCSA.

Thank you for your continued support of GridShib!

In a followup post to some apparent misinformation being spread (Microsoft executive “rebuts” our research!), I was surprised by this comment:

Interestingly, if Mr. Riley only attended our Xen 0wning Trilogy at Black Hat, then he would notice that we were actually very positive about Hyper-V. Of course, I pointed out that Xen 3.3 certainly has a more secure architecture right now, but I also said that I knew (from talking to some MS engineers from the virtualization group) that Hyper-V is going to implement similar features in the next version(s) and that this is very good. I also prized the fact it has only about 100k LOC (vs. about 300k LOC in Xen 3.3).

Xen 3.3 has grown to 300k lines of code for the hypervisor?

At what point does the “tight security auditability” argument start to exponentially diminish for hypervisors in ring 0?

Quoting from http://gist.github.com/7263

#!/usr/bin/env ruby
# gcalc  / 26aug2008 chneukirchen / public domain
require ‘open-uri’
q = ARGV.join(” “).gsub(/./m) { “%%%02X” % $&[0] }
html = open(”http://www.google.com/search?q=#{q}”).read
puts (html[%r{(.*?)}, 1] || ‘not a calculation’).
gsub(%r{240| }, “”).gsub(”×”, “x”).
gsub(%r{(.*?)}, ‘^\1 ‘) 

(tip via HubbuH)

From http://vcl.ncsu.edu/:

The Virtual Computing Lab (VCL) is a remote access service that allows you to reserve a computer with a desired set of applications for yourself, and remotely access it over the Internet.

You can use all your favorite applications such as Matlab, Maple, SAS, Solidworks, and many others. Linux, Solaris and numerous Windows environments are now available to all NC State students and faculty.

Leasing custom environments to “public-ish” users via PXE or similar technology was happening in other places in 2004, but I never saw anything at this scale.

It is clear that some kind of reconfiguration/resetting happens:

What rights do I have on the VCL machine?

On custom Windows and Linux environments you have adminstrative and root level rights. Since the VCL system reloads each expired reservations with a clean environment, there is no threat of any residual data being left on a machine for the next user.

On Linux and Solaris Lab machine environments, you only have user level rights. The same premissions as you would experience at the console of a walk-in lab.

I wonder when they added the VM support mentioned at http://vcl.ncsu.edu/help/general-information/how-it-works:

The management nodes each control a subset of the VCL resources. These can be blades, virtual machines or lab machines. Currently, a set of individual blades or virtual machines can only be managed by a single management node. Typically there are anywhere from 80-120 physical computer nodes (blades) under one management node. Again the physical computer nodes can either be running a bare metal environment or a Virtual Machine hypervisor.

Here are deployment stats captured on Aug 25, 2008:

• Total blades online: 438
• Total blades offline: 87
• Active Reservations: 49

Cool.

I was jetlagged, so I tried to read a little bit, learning about some of the deeper corners of the fantastic Spring framework:

Here you can see the northern end of this beautiful city.

I’ve been told several times that they “don’t see Americans too much in this part of the city” so I think I’ve landed in a good spot.

From: Stephen Childs
Subject: Survey on use of virtualization in production grids

Hi all,

Apologies for the slightly off-topic post. I am giving presentations soon on the use of virtualization in production grids and was thinking it might be nice to have some data to present!

I have set up a survey on the usage of virtualization in production grids at http://www.surveymonkey.com/s.aspx?sm=Sukm0sCdun6EAtpi7IXtwA_3d_3d

The survey will remain open until Friday August 29th. It shouldn’t take more than a few minutes to complete, and I think the results should be quite interesting for our community. I get the impression virtualization usage has rocketed in the last year, but haven’t seen any figures on uptake to date.

Please feel free to forward this to anyone else who may be interested in responding.

If you have any comments, please feel free to email me.

Stephen
–
Dr. Stephen Childs,
Research Fellow, EGEE Project, phone: +353-1-8961797
Computer Architecture Group, email: Stephen.Childs @ cs.tcd.ie
Trinity College Dublin, Ireland web: http://www.cs.tcd.ie/Stephen.Childs

Quoting from the Nimbus features page:

There are currently two supported remote protocol sets:

• WSRF based: protocol implementation in longstanding use by previous workspace services and clients including the cloud-client.
• EC2 based: clients written for EC2 can be used with Nimbus installations. For more information, see What is the EC2 frontend?

These protocols happen to both be Web Services based and both run in the Apache Axis based GT Java container. But neither thing is a necessity:

• There is nothing specific to web services based remote protocols in the workspace service implementation, the messaging system just needs to be able to speak to Java based libraries.
• Workspace service dependencies have nothing to do with what container it is running in, they are more “straight Java” style dependencies like Spring, ehcache, backport-util-concurrent, and JDBC (currently using the embedded Derby database).

Check out the changelog and the new FAQ.

Check out some screenshots here of Nimbus resources invovled in supporting this experiment. It’s a small part of things as you can see from the scope of the grid but exciting nonetheless. The AliEn based virtual cluster is now “one-click” and can be launched anywhere running a workspace cloud setup.

If you know anyone that may be interested in the job, please pass this announcement along. It seems like people reading here would have a good probability of knowing someone that may be interested and who also has the experience they are looking for.

Thanks

From http://www.csamuel.org/2008/07/28/vpac-job-grid-systems-administator-programmer

VPAC is looking for someone to join the systems team here to work on grid computing, including things like Shibboleth, SSL certificates, Globus and the like.

The Victorian Partnership for Advanced Computing Limited (VPAC) has a unique opportunity for a person to assist with the operation of a National Distributed Computing and Data Project. VPAC operates a range of large Linux HPC Systems primarily used for scientific research and is part of ARCS, the Australian Research Collaboration Service, building research infrastructure across Australia.

Reporting to the VPAC Operations Manager, you will be working primarily on Linux systems in a distributed computing environment. Specifically, you will be involved in a National Project to provide authentication and authorisation services, and separately, data services across Australia and be a part of the international grid effort. The ability to work with and support our end users (typically scientific researchers and software developers) is very important in this role. Some national and international travel may be involved.

You will gain experience in a range of cutting edge distributed computing technologies.

To be successful in this role you will need Linux (or Unix) experience. A degree in Computer Science or a closely related field would be highly advantageous but hands on Linux experience is essential. Experience in authentication, authorisation and distributed data is highly desirable.

Key Selection Criteria

- A good knowledge of UNIX or LINUX at a systems level.

- Some skills in programming or scripting Python, Perl, Java or similar.

- Good communication skills and an ability to deliver quality services to end users.

Gain bonus points with:

- Experience with authentication, authorisation, Shibboleth and/or distributed data.

- Experience with grid or distributed computing, Globus.

- Experience in building and packaging custom Linux systems.

- Experience in XEN, OpenSSL, X509 certificates, Web Services or similar.

Applicants with specific skills related to the above are strongly advised to mention their experience level with each (e.g, experienced, competent, interested beginner) in their application.

VPAC is an equal opportunity employer and offers an exciting opportunity in a modern work environment with excellent employment conditions and career progression opportunities.

Please send resumes, along with a cover letter and academic transcripts to recruitment@vpac.org. Applications close COB 11th AUGUST 2008.

“Though we’re proud of our operational performance in operating Amazon S3 for almost 2.5 years, we know that any downtime is unacceptable and we won’t be satisfied until performance is statistically indistinguishable from perfect.”

• http://workspace.globus.org/rss.xml

The cluster technology lets you bootstrap generic images into new network and security contexts on the fly. We built a sample cluster on top of the technology that lets you create the cluster and be immediately ready to submit jobs to a Torque cluster fronted by GRAM and GridFTP that use a newly created self-signed certificate:

1. cloud-client.sh –run –hours 12 –cluster base-cluster.xml

2. Wait a few minutes, once launched note the head-node hostname

3. scp -r root@HOSTNAME:certs/*  lib/certs/

   (SSH was bootstrapped end to end already)

4. Make sure your grid tools trust this certificate and then submit work

This can be done with nearly anything that can run on a non-virtual cluster. Check out these links for more information:

• http://workspace.globus.org/clouds/clusters.html
• http://workspace.globus.org/vm/TP1.3.3/index.html

On behalf of the Globus Toolkit development team I am pleased to announce that a new stable release of the Globus Toolkit is now available. GT4.2.0 contains an upgrade to the web services specifications used by the toolkit as well as new features in all services. New users are encouraged to use the 4.2.0 release. Existing users may wish to evaluate the new software while maintaining their existing installations; due to the specification upgrade, the webservices are incompatible with the 4.0.x series. Details on the spec upgrade are available in the release notes.

Relevant 4.2.0 links:

• Release notes: http://www.globus.org/toolkit/docs/4.2/4.2.0/rn/release_notes.html
• Software: http://www.globus.org/toolkit/downloads/4.2.0/
• Documentation: http://www.globus.org/toolkit/docs/4.2/4.2.0/

Thanks for your support of Globus software!

Charles

New Features!

• Persistent HTTP/S connection support in Java WS Core
• Dynamic deployment support in Java WS Core
• JBOSS 4.0.x support in Java WS Core
• An implementation of WS-ServiceGroup added to C WS Core
• C command-line tools for WSRF operations
• Support for GetResourceProperties and QueryResourceProperties in the

Delegation Service

• Added support for the OGSA-AuthZ Authorization Service to CAS
• Server-side attribute-based authorization framework enhancements
• Support for a pluggable Policy Decision Point (PDP) designed to minimize

common authorization errors

• Enhanced security descriptor framework
• A Web service interface for the Replica Location Service (RLS)
• Improved support for multiple TriggerRules in the Trigger Service
• Improved configuration interface for the Trigger Service
• Java API to assist in creating resource properties from external

information sources

• A new resource manager (RM) adapter API in GRAM4

Also see Ian Foster’s blog entry

rPath Enables Cloud Computing for DoE, CERN

RALEIGH, N.C., June 4 — rPath, whose unique technology simplifies application distribution and management through virtual appliances, today announced that the U.S. Department of Energy (DOE) and the European Organization for Nuclear Research (CERN) have been using rBuilder to deliver virtual appliances to both scientists’ desktops and computational clouds. The use of rBuilder in these environments reduces the effort required to support users and allows researchers to take advantage of underutilized computational resources.

rBuilder is the first and only product that simplifies and automates the creation of virtual appliances. A virtual appliance is an application with a streamlined operating system, offered in a format that runs in virtualized environments.

CERN turned to virtual appliances to facilitate the analysis of data created by the Large Hadron Collider (LHC) experiments. The complete software environment needed by the LHC applications is assembled by rBuilder and distributed to run as a virtual machine on physicists’ desktops. Virtual appliances provide a consistent application environment for the LHC applications while, at the same time, allowing scientists to use their desktops for analysis, regardless of operating system.

“The coupling between the LHC applications and the operating system is very strong,” stated Predrag Buncic, virtualization R&D project leader. “By distributing these applications as virtual appliances, we are able to isolate the application from the underlying desktop or laptop operating system, allowing the researchers to run the applications on systems that normally would not be supported.”

The DOE is exploring the concept of using virtual appliances to provide customized environments for scientific applications. Scientific applications are turned into virtual appliances using rPath’s rBuilder. The “Science Clouds” project (http://workspace.globus.org/clouds) provides resources capable of hosting multiple scientific appliances using the Globus Virtual Workspaces software. Scientists submit their virtual appliances to any available resource, knowing that the application environment is controlled and isolated from the underlying system. By relying on portable appliances, the scientists can leverage the resources of science clouds, and seamlessly move to commercial providers, such as Amazon’s EC2, when additional resources are needed.

“For a proof-of-concept, anybody can just configure a virtual machine image by hand,” said Kate Keahey, a scientist at Argonne National Laboratory. “But providing appliance management and maintenance that will scale to many thousands of appliances and that will be truly interoperable between different resource providers requires a new approach.”

About rPath

For application providers that want to accelerate license growth, expand into new markets, and reduce support and development costs, rPath’s platform transforms applications into virtual appliances. A virtual appliance is an application combined with just enough operating system (JeOS) for it to run optimally in any virtualized environment. Virtual appliances eliminate the hassles of installing, configuring and maintaining complex application environments. Only rPath’s technology simplifies application distribution, lowers the customer service costs of maintenance and management, and produces multiple virtual machine formats. The company is headquartered in Raleigh, N.C. For more information, visit www.rpath.com.

—–

Source: rPath

EUCALYPTUS - Elastic Utility Computing Architecture for Linking Your Programs To Useful Systems - is an open-source software infrastructure for implementing “cloud computing” on clusters. The current interface to EUCALYPTUS is compatible with Amazon’s EC2 interface, but the infrastructure is designed to support multiple client-side interfaces.

May 14th, 2008: EUCALYPTUS is publically demonstrated at the Open Source Grid and Cluster conference.

May 29th, 2008: Version 1.0 is released as a feature-limited binary-only beta.

http://eucalyptus.cs.ucsb.edu/

As many of you have probably noticed we have recently been sending announcements about the availability of compute clouds for scientific communities: http://workspace.globus.org/clouds/

In a nutshell, TP 1.3.2 allows you to build your own cloud. The main addition is a new “cloud client” for the workspace service which simplifies (and also hides) much of the workspace functionality to provide an EC2-like set of features. The new client also provides a limited form of “contextualization” (more coming in the next release!). We also provide a step-by-step “cloud guide” that allows you to configure your own cloud.

For a complete set of new features (many more but less significant) look to:
http://workspace.globus.org/vm/TP1.3.2/index.html#changelog

We look forward to hearing from you — and if you do decide to configure a cloud and would like help finding users, please do let us know.

Have fun!

The Workspace Team
–

Kate Keahey,
Mathematics & CS Division, Argonne National Laboratory
Computation Institute, University of Chicago

I am happy to announce the availability of a science cloud (codenamed “Stratus” ;-) at the University of Florida. This cloud introduces a new feature: the use of virtual networks with virtual machines for cloud computing.

The cloud is available for members of the scientific community: to obtain access you will need to provide a justification (a few sentences explaining your science project) to cloud administrators at UFL. To find out more go to:

http://workspace.globus.org/clouds/

The cloud is currently deployed on a modest allocation of resources as a beta project. We welcome comments, feedback, and bug reports.

Today, it is with great pleasure that the GridShib Project announces the immediate release of GridShib for Globus Toolkit v0.6.0. This release culminates a 20-month effort to bring SAML-based attribute push to X.509-based Grids.

GridShib for Globus Toolkit (GT) is an implementation of a Grid Service Provider, an entity much like a SAML Service Provider but for Grids. A Grid Service Provider consumes X.509-bound SAML tokens, a new type of security token that enables attributed-based authorization in X.509-based Grids.

Most everything you need to know about GridShib for GT is on this web page:

http://gridshib.globus.org/docs/gridshib-gt-0.6.0/readme.html

On this readme page, you will find more detailed information about the GridShib for GT software as well as links to downloads and documentation.

A major advance in this version of GridShib for GT is support for the TeraGrid Science Gateway use case where an intermediary makes a grid request on behalf of a browser user. The Gateway binds a SAML token to an X.509 proxy certificate and makes a request to a gridshib-enabled web service. On the service side, GridShib for GT consumes the SAML token and makes an access control decision based on the security information in the token.

As a SAML-consuming software component, GridShib for GT complements the previously released GridShib SAML Tools and GridShib Certification Authority (CA), which are SAML-producing software components. These three components together enable attribute-based authorization in X.509-based Grids. See the Quick Start for step-by-step instructions that show how to use GridShib for GT v0.6, GridShib SAML Tools v0.3, and GridShib CA v0.5.1 together on Windows and UNIX systems:

http://gridshib.globus.org/docs/gridshib/quick-start.html

For links to all GridShib software downloads and additional documentation, visit the GridShib Downloads page:

http://gridshib.globus.org/download.html

Funding for GridShib software has been provided by the NSF NMI program and the NSF TeraGrid program.

Tom Scavo
For the entire GridShib Team

Several community members have contacted me recently about the Xen-API utilities. I looked into this and discovered a great opportunity for community members looking for a project to contribute to. So, I am announcing a new community effort to complete the development of the Xen-API utilities. If you are interested in working on the Xen-API project please email me at stephen.spector@xen.org and I will call a meeting in mid-May with all people interested to get the project underway.

I’m pleased to announce the availability of Xen versions 3.1.4 and 3.2.1 — bugfix releases in the Xen 3.1 and 3.2 series.

The source repositories are available using mercurial from:

• http://xenbits.xensource.com/xen-3.1-testing.hg (tag ‘RELEASE-3.1.4′)
• http://xenbits.xensource.com/xen-3.2-testing.hg (tag ‘RELEASE-3.2.1′)

Tarballs are available for download (and will soon be linked from the xen.org web pages):

• http://bits.xensource.com/oss-xen/release/3.1.4/xen-3.1.4.tar.gz
• http://bits.xensource.com/oss-xen/release/3.2.1/xen-3.2.1.tar.gz

Thanks to everyone who has contributed!

Regards,
Keir

There will be a Virtual Workspaces tutorial at the Open Source Grid Cluster conference in Oakland, CA. The conference is May 12-16, 2008. The Virtualization and Cloud Computing with Globus session is on Wednesday, May 14th, from 4:30-6:00 pm. We hope to see you there!

Quoting from the summary:

One of the primary obstacles users face in grid computing is that Grids provide access to many diverse resources, their applications often require a very specific, customized environment. This disconnect can lead to resource underutilization, user frustration, and much wasted effort spent on bridging the gap between applications and resources. Virtual Workspaces describe the environment required for the execution of an application that can be dynamically deployed across a variety of resources creating a working and consistent platform for grid applications.

This tutorial will introduce the Globus Toolkit workspace service that implements workspaces as Xen virtual machines and enables authorized grid clients to dynamically deploy them and manage their resources. Further, we will describe and demonstrate the workspace “cloudkit” that provides a user-friendly interface on top of the workspace service allowing authorized users to easily provision and run VMs on the available community clouds. Finally, we will describe how the process of contextualization can be used to provide on-demand functioning clusters and give examples of its use by applications.

This points us to Cloud Control with Distributed Rate Limiting which is a paper about distributed bandwidth management.

From the conclusion:

As cloud-based services transition from marketing vaporware to real, deployed systems, the demands on traditional Web-hosting and Internet service providers are likely to shift dramatically. In particular, current models of resource provisioning and accounting lack the flexibility to effectively support the dynamic composition and rapidly shifting load enabled by the software as a service paradigm. We have identified one key aspect of this problem, namely the need to rate limit network traffc in a distributed fashion, and provided two novel algorithms to address this pressing need.

Check out the summary at networkworld but also here is an excerpt from a UCSD post about it:

If half your company’s bandwidth is allocated to your mirror in New York, and it’s the middle of the night there, and your sites in London and Tokyo are slammed, that New York bandwidth is going to waste. UC San Diego computer scientists have designed, implemented, and evaluated a new bandwidth management system for cloud-based applications capable of solving this problem.

The UCSD algorithm enables distributed rate limiters to work together to enforce global bandwidth rate limits, and dynamically shift bandwidth allocations across multiple sites or networks, according to current network demand.”

Here’s a, let’s say… “embellished” example: Gangsta cloud wars could pivot on the traffic-driving power of Google and Microsoft/Yahoo.

When you’re using VMs like Xen (e.g. on EC2), if you design things for it you “should be able to” move without a ton of hassle (research. plan.). The workspace project has been working on portability and usability (see The first one-click STAR production cluster) and one of the things we can do now is use the same VM image on a regular cluster (such as on the Teraport cloud) and EC2. The contextualization software can be configured to sense if it is on EC2 or not (and will bootstrap accordingly). It “would be nice” if such things were standardized but this is not a real problem right now (IMHO).

About something more “strongly typed” like Google’s AppEngine. Application migration might be a bit harder, but not if the APIs are well known and repeatable. Google’s SDK is even Apache 2 licensed.

To that point, have a look at Announcing AppDrop.com (host Google App Engine projects on EC2). It’s not there yet (database is a flat file) but, hey, it was developed in a few days. Cool. Read more at http://appdrop.com.

The long term idea is not that this would solve all your problems magically but that such things are possible, and if there’s a real market for choices, it seems like more work on things of this nature are also inevitable.

I’m no datacenter business expert, but the biggest problem right now seems to be that few people will be able to compete on costs/efficiencies of scale with Google/Amazon/Microsoft/eBay. (<predictions…>) It feels like it would naturally approach the straight web hosting business, though. Let’s say a standard, open source cloud computing infrastructure emerges (such as Apache httpd in the analogy). There will be various levels of players as far as the capital they have and certainly better and worse companies to choose from (including those that differentiate on service etc). But if you’re really sweating the savings an enormous company could provide with such efficiencies vs. a normal size company/datacenter, you’re probably at the point where you could save a whole lot more by buying your own computers.(</predictions…>)

Miscellaneous point about lock-in: something user-facing that ties you to a provider does not seem like a wise idea (e.g. Google’s Users API).

• Ability to create volumes between 1GB and 1TB
• Ability to create any FS on them after the first mount
• Mounted from same availability zone as the EC2 instance
• Snapshots to S3 (awesome)

See Werner Vogels and this RightScale post.

Fifth (and hopefully final!) release candidates are available from the public xen-3.1-testing.hg and xen-3.2-testing.hg trees.

Please give these ones a spin. I hope to roll the releases early next week.

— Keir

[update: http://www.gridvm.org/xen-314-and-321.html]