diff --git a/etc/spack/defaults/config.yaml b/etc/spack/defaults/config.yaml index 6be1d9770b840b5d58264d969fe292eea9e9091b..3aadccfda1cc99ca4f41d49a7ead3fb897979116 100644 --- a/etc/spack/defaults/config.yaml +++ b/etc/spack/defaults/config.yaml @@ -80,6 +80,14 @@ config: verify_ssl: true + # Suppress gpg warnings from binary package verification + # Only suppresses warnings, gpg failure will still fail the install + # Potential rationale to set True: users have already explicitly trusted the + # gpg key they are using, and may not want to see repeated warnings that it + # is self-signed or something of the sort. + suppress_gpg_warnings: false + + # If set to true, Spack will attempt to build any compiler on the spec # that is not already available. If set to False, Spack will only use # compilers already configured in compilers.yaml diff --git a/lib/spack/spack/binary_distribution.py b/lib/spack/spack/binary_distribution.py index 564903f33306f26609093f6ad53ea3156ad6c404..3effc3c71f751def220295cbb48524d4cba831ab 100644 --- a/lib/spack/spack/binary_distribution.py +++ b/lib/spack/spack/binary_distribution.py @@ -21,6 +21,7 @@ from llnl.util.filesystem import mkdirp, install_tree import spack.cmd +import spack.config as config import spack.fetch_strategy as fs import spack.util.gpg as gpg_util import spack.relocate as relocate @@ -594,7 +595,8 @@ def extract_tarball(spec, filename, allow_root=False, unsigned=False, if not unsigned: if os.path.exists('%s.asc' % specfile_path): try: - Gpg.verify('%s.asc' % specfile_path, specfile_path) + suppress = config.get('config:suppress_gpg_warnings', False) + Gpg.verify('%s.asc' % specfile_path, specfile_path, suppress) except Exception as e: shutil.rmtree(tmpdir) tty.die(e) diff --git a/lib/spack/spack/schema/config.py b/lib/spack/spack/schema/config.py index 6eb127a3595ad8d29de328b6e27f3ad4bb811354..7d170bbc9172e540795aab83b92f2ed24121657b 100644 --- a/lib/spack/spack/schema/config.py +++ b/lib/spack/spack/schema/config.py @@ -56,6 +56,7 @@ 'source_cache': {'type': 'string'}, 'misc_cache': {'type': 'string'}, 'verify_ssl': {'type': 'boolean'}, + 'suppress_gpg_warnings': {'type': 'boolean'}, 'install_missing_compilers': {'type': 'boolean'}, 'debug': {'type': 'boolean'}, 'checksum': {'type': 'boolean'}, diff --git a/lib/spack/spack/util/gpg.py b/lib/spack/spack/util/gpg.py index a5c10d2151b3bb227c3573158ccbe4c355d6ad73..a7d1a3d8fa2529c6815a9b6cce0d0c8ffb03c82c 100644 --- a/lib/spack/spack/util/gpg.py +++ b/lib/spack/spack/util/gpg.py @@ -100,8 +100,11 @@ def sign(cls, key, file, output, clearsign=False): cls.gpg()(*args) @classmethod - def verify(cls, signature, file): - cls.gpg()('--verify', signature, file) + def verify(cls, signature, file, suppress_warnings=False): + if suppress_warnings: + cls.gpg()('--verify', signature, file, error=str) + else: + cls.gpg()('--verify', signature, file) @classmethod def list(cls, trusted, signing):