feat: set mirrors unsigned

containers/jug/dev.Dockerfile

@@ -71,7 +71,7 @@ spack compiler find --scope site
 spack config blame compilers
 EOF
 
-## Setup eics3 buildcache mirrors
+## Setup buildcache mirrors
 ## - this always adds the read-only mirror to the container
 ## - the write-enabled mirror is provided later as a secret mount
 ARG S3_ACCESS_KEY=""
@@ -79,12 +79,14 @@ ARG S3_SECRET_KEY=""
 RUN --mount=type=cache,target=/var/cache/spack <<EOF
 set -e
 if [ -n "${S3_ACCESS_KEY}" ] ; then
-  spack mirror add --scope site                                         \
+  spack mirror add --scope site --unsigned                              \
       --s3-endpoint-url https://eics3.sdcc.bnl.gov:9000                 \
       --s3-access-key-id "${S3_ACCESS_KEY}"                             \
       --s3-access-key-secret "${S3_SECRET_KEY}"                         \
       eics3 s3://eictest/EPIC/spack/${SPACK_VERSION}
 fi
+spack mirror add --scope site --signed spack-${SPACK_VERSION} https://binaries.spack.io/${SPACK_VERSION}
+spack mirror add --scope site --unsigned ghcr-${SPACK_VERSION} oci://ghcr.io/eic/spack-${SPACK_VERSION}
 spack mirror list
 EOF
 

mirrors.yaml.in

 mirrors:
   eicweb:
     url: oci://${CI_REGISTRY}/${CI_PROJECT_PATH}/spack-${SPACK_VERSION}
+    signed: false
     push:
       access_pair:
       - ${CI_REGISTRY_USER}
       - ${CI_REGISTRY_PASSWORD}
   ghcr:
     url: oci://ghcr.io/eic/spack-${SPACK_VERSION}
+    signed: false
     push:
       access_pair:
       - ${GITHUB_REGISTRY_USER}
       - ${GITHUB_REGISTRY_TOKEN}
   eics3rw:
+    signed: false
     fetch:
       url: s3://eictest/EPIC/spack/${SPACK_VERSION}
       access_pair:

spack.sh

@@ -25,6 +25,7 @@ c07ddf83c32b7129247fe90eed486dd844047087
 64cf67822471ec2d3df2625a6d713f80cbe7ff43
 7a0c4e8017033430e5f15ed628be6b539e935ba9
 48fcfda1e7c1781cab4cada6d099823b263ab0cc
+8c29e90fa9962f4a44f39f47217b46c85176af28
 ---
 ## Ref: https://github.com/spack/spack/commit/[hash]
 ## [hash]: [description]
@@ -45,3 +46,4 @@ c07ddf83c32b7129247fe90eed486dd844047087
 ## 64cf67822471ec2d3df2625a6d713f80cbe7ff43: py-torch: move patch before def patch
 ## 7a0c4e8017033430e5f15ed628be6b539e935ba9: acts: new versions 31.*
 ## 48fcfda1e7c1781cab4cada6d099823b263ab0cc: setup-env.sh: if exe contains qemu, use /proc/$$/comm instead
+## 8c29e90fa9962f4a44f39f47217b46c85176af28: Build cache: make signed/unsigned a mirror property