summaryrefslogtreecommitdiff
path: root/.github
diff options
context:
space:
mode:
authorScott Wittenburg <scott.wittenburg@kitware.com>2022-05-24 15:39:20 -0600
committerGitHub <noreply@github.com>2022-05-24 17:39:20 -0400
commit70824e4a5eaee7841f8199c90cdf9d44e9a2984e (patch)
tree951bb5bfaeef919ff1f0fda7dae00d563d30d4f8 /.github
parent0fe5e72744378deebb0418885a03163d6d2b4d47 (diff)
downloadspack-70824e4a5eaee7841f8199c90cdf9d44e9a2984e.tar.gz
spack-70824e4a5eaee7841f8199c90cdf9d44e9a2984e.tar.bz2
spack-70824e4a5eaee7841f8199c90cdf9d44e9a2984e.tar.xz
spack-70824e4a5eaee7841f8199c90cdf9d44e9a2984e.zip
buildcache: Update layout and signing (#30750)
This PR introduces a new build cache layout and package format, with improvements for both efficiency and security. ## Old Format Currently a binary package consists of a `spec.json` file at the root and a `.spack` file, which is a `tar` archive containing a copy of the `spec.json` format, possibly a detached signature (`.asc`) file, and a tar-gzip compressed archive containing the install tree. ``` build_cache/ # metadata (for indexing) <arch>-<compiler>-<name>-<ver>-24zvipcqgg2wyjpvdq2ajy5jnm564hen.spec.json <arch>/ <compiler>/ <name>-<ver>/ # tar archive <arch>-<compiler>-<name>-<ver>-24zvipcqgg2wyjpvdq2ajy5jnm564hen.spack # tar archive contents: # metadata (contains sha256 of internal .tar.gz) <arch>-<compiler>-<name>-<ver>-24zvipcqgg2wyjpvdq2ajy5jnm564hen.spec.json # signature <arch>-<compiler>-<name>-<ver>-24zvipcqgg2wyjpvdq2ajy5jnm564hen.spec.json.asc # tar.gz-compressed prefix <arch>-<compiler>-<name>-<ver>-24zvipcqgg2wyjpvdq2ajy5jnm564hen.tar.gz ``` After this change, the nesting has been removed so that the `.spack` file is the compressed archive of the install tree. Now signed binary packages, will take the form of a clearsigned `spec.json` file (a `spec.json.sig`) at the root, while unsigned binary packages will contain a `spec.json` at the root. ## New Format ``` build_cache/ # metadata (for indexing, contains sha256 of .spack file) <arch>-<compiler>-<name>-<ver>-24zvipcqgg2wyjpvdq2ajy5jnm564hen.spec.json # clearsigned spec.json metadata <arch>-<compiler>-<name>-<ver>-24zvipcqgg2wyjpvdq2ajy5jnm564hen.spec.json.sig <arch>/ <compiler>/ <name>-<ver>/ # tar.gz-compressed prefix (may support more compression formats later) <arch>-<compiler>-<name>-<ver>-24zvipcqgg2wyjpvdq2ajy5jnm564hen.spack ``` ## Benefits The major benefit of this change is that the signatures on binary packages can be verified without: 1. Having to download the tarball, or 2. having to extract an unknown tarball. (1) is an improvement in efficiency; (2) is a security fix: we now ensure that we trust the binary before we try to run it through `tar`, which avoids potential attacks. ## Backward compatibility Also after this change, spack should still be able to handle the previous buildcache structure and binary mirrors with mixed layouts.
Diffstat (limited to '.github')
-rw-r--r--.github/workflows/setup_git.ps11
1 files changed, 1 insertions, 0 deletions
diff --git a/.github/workflows/setup_git.ps1 b/.github/workflows/setup_git.ps1
index 36e0157c54..d68f90a7ae 100644
--- a/.github/workflows/setup_git.ps1
+++ b/.github/workflows/setup_git.ps1
@@ -4,6 +4,7 @@ Set-Location spack
git config --global user.email "spack@example.com"
git config --global user.name "Test User"
+git config --global core.longpaths true
if ($(git branch --show-current) -ne "develop")
{