Skip to content
  • Omar Padron's avatar
    Streamline key management for build caches (#17792) · 2d931541
    Omar Padron authored
    * Rework spack.util.web.list_url()
    
    list_url() now accepts an optional recursive argument (default: False)
    for controlling whether to only return files within the prefix url or to
    return all files whose path starts with the prefix url.  Allows for the
    most effecient implementation for the given prefix url scheme.  For
    example, only recursive queries are supported for S3 prefixes, so the
    returned list is trimmed down if recursive == False, but the native
    search is returned as-is when recursive == True.  Suitable
    implementations for each case are also used for file system URLs.
    
    * Switch to using an explicit index for public keys
    
    Switches to maintaining a build cache's keys under build_cache/_pgp.
    Within this directory is an index.json file listing all the available
    keys and a <fingerprint>.pub file for each such key.
    
     - Adds spack.binary_distribution.generate_key_index()
       - (re)generates a build cache's key index
    
     - Modifies spack.binary_distribution.build_tarball()
       - if tarball is signed, automatically pushes the key used for signing
         along with the tarball
       - if regenerate_index == True, automatically (re)generates the build
         cache's key index along with the build cache's package index; as in
         spack.binary_distribution.generate_key_index()
    
     - Modifies spack.binary_distribution.get_keys()
       - a build cache's key index is now used instead of programmatic
         listing
    
     - Adds spack.binary_distribution.push_keys()
       - publishes keys from Spack's keyring to a given list of mirrors
    
     - Adds new spack subcommand: spack gpg publish
       - publishes keys from Spack's keyring to a given list of mirrors
    
     - Modifies spack.util.gpg.Gpg.signing_keys()
       - Accepts optional positional arguments for filtering the set of keys
         returned
    
     - Adds spack.util.gpg.Gpg.public_keys()
       - As spack.util.gpg.Gpg.signing_keys(), except public keys are
         returned
    
     - Modifies spack.util.gpg.Gpg.export_keys()
       - Fixes an issue where GnuPG would prompt for user input if trying to
         overwrite an existing file
    
     - Modifies spack.util.gpg.Gpg.untrust()
       - Fixes an issue where GnuPG would fail for input that were not key
         fingerprints
    
     - Modifies spack.util.web.url_exists()
       - Fixes an issue where url_exists() would throw instead of returning
         False
    
    * rework gpg module/fix error with very long GNUPGHOME dir
    
    * add a shim for functools.cached_property
    
    * handle permission denied error in gpg util
    
    * fix tests/make gpgconf optional if no socket dir is available
    2d931541