SUSE-RU-2024:0452-1: Recommended update for spack

Published Feb 13, 2024
·
Updated

This update for spack fixes the following issues: spack was updated to version 0.21.1 (bsc#1219480): Version 0.21.1:

Add support for reading buildcaches created by Spack v0.22

Bugfixes:

spack graph: fix coloring with environments spack info: sort variants in --variants-by-name Spec.format: error on old style format strings

ASP-based solver:

fix infinite recursion when computing concretization errors

don't error for type mismatch on preferences

don't emit spurious debug output.

Improve the error message for deprecated preferences

Fix multi-word aliases Add a warning for unconfigured compiler environment: fix an issue with deconcretization/reconcretization of specs buildcache: don't error if a patch is missing, when installing from binaries

Version 0.21.0:

New features:

Better error messages with condition chaining: In v0.18, we added better error messages that could tell you what problem happened, but they couldn't tell you why it happened. 0.21 adds condition chaining to the solver, and Spack can now trace back through the conditions that led to an error and build a tree of causes potential causes and where they came from.

OCI build caches: You can now use an arbitrary OCI registry as a build cache:

For Dockerhub: $ spack mirror add myregistry oci://user/image

For another registry (GHCR): $ spack mirror add myregistry oci://ghcr.io/haampie/spack-test

Then set the login credentials: $ spack mirror set --push --oci-username ... --oci-password ... myregistry and push to it: $ spack buildcache push myregistry [specs...] You can optionally add a base image to get runnable images: $ spack buildcache push --base-image leap:15.5 myregistry python Pushed ... as [image]:python-3.11.2-65txfcpqbmpawclvtasuog4yzmxwaoia.spack $ docker run --rm -it [image]:python-3.11.2-65txfcpqbmpawclvtasuog4yzmxwaoia.spack This creates a container image from the Spack installations on the host system, without the need to run spack install from a Dockerfile or sif file. It also addresses the inconvenience of losing binaries of dependencies when RUN spack install fails inside docker build. Further, the container image layers and build cache tarballs are the same files. This means that spack install and docker pull use the exact same underlying binaries. If you previously used spack install inside of docker build, this feature helps you save storage by a factor two. + Multiple versions of build dependencies: Increasingly, complex package builds require multiple versions of some build dependencies. For example, Python packages frequently require very specific versions of setuptools, cython, while different physics packages require different versions of Python to build. The concretizer enforced that every solve was unified, i.e., so that there was only one version of every package. The concretizer now supports "duplicate" nodes for build dependencies, but enforces unification through transitive link and run dependencies. This will allow it to better resolve complex dependency graphs in ecosystems like Python. + Cherry-picking virtual dependencies: You can now select only a subset of virtual dependencies from a spec that may provide more. For example, to make mpich your mpi provider, you can be explicit by writing: hdf5 ^[virtuals=mpi] mpich Or, to use, e.g., intel-parallel-studio for blas along with an external lapack like openblas, you could write: strumpack ^[virtuals=mpi] intel-parallel-studio+mkl ^[virtuals=lapack] openblas The virtuals=mpi is an edge attribute, and dependency edges in Spack graphs now track which virtuals they satisfied. + The spack deconcretize command gives you control over what you want to update in an already concrete environment. As an example, with an environment built with meson, and you want to update your meson version, you can run: $spack deconcretize meson and have everything that depends on meson rebuilt the next time you run spack concretize. In the future, we'll handle this in a single command, but for now you can use this to drop bits of your lockfile and resolve your dependencies again. + UI Improvements: The spack info received a rework to make the output more appealing. It is now on par with the rest of Spack's UI. spack info now makes much better use of terminal space and shows variants, their values, and their descriptions more clearly. Conditional variants are grouped separately so you can more easily understand how packages are structured. spack checksum now allows you to filter versions from your editor, or by version range. It also notifies you about potential download URL changes. + Environments can include definitions: Spack did not previously support using include: with The definitions section of an environment, but now it does. You can use this to curate lists of specs and more easily reuse them across environments. + Aliases: You can now add aliases to Spack commands in config.yaml, e.g. this might enshrine your favorite args to spack find as spack f: config: aliases: f: find -lv

Improved autoloading of modules: In this release, you can start using hideimplicits: true instead, which exposes only explicitly installed packages to the user, while still autoloading dependencies. On top of that, you can safely use hashlength: 0, as this config now only applies to the modules exposed to the user -- you don't have to worry about file name clashes for hidden dependencies. Note: for Tcl this feature requires Modules 4.7 or higher

Other new commands and directives:

spack env activate without arguments now loads a default environment that you do not have to create. spack find -H / --hashes: a new shortcut for piping spack find output to other commands. Add spack checksum --verify, fix --add. New defaultargs context manager factors out common args for directives. spack compiler find --[no]-mixed-toolchain lets you easily mix clang and gfortran on Linux

Performance improvements:

spack external find execution is now much faster. spack location -i is now much faster on success. Drop redundant rpaths post install. ASP-based solver: avoid cycles in clingo using hidden directive. Fix multiple quadratic complexity issues in environments

Other new features of note:

archspec: update to v0.2.2, support for Sapphire Rapids, Power10, Neoverse V2. Propagate variants across nodes that don't have that variant Implement fish shell completion. Can now distinguish between source/binary mirror; don't ping mirror.spack.io as much. Improve status reporting on spack install (add [n/total] display...).

Affected Software

10 affected componentsFixes available
All of the following
SUSE openSUSE Leap 15.3 (noarch)
Any of the following
suse/spack-info<0.21.1-150300.12.1
0.21.1-150300.12.1
suse/spack-recipes<0.21.1-150300.12.1
0.21.1-150300.12.1
suse/spack<0.21.1-150300.12.1
0.21.1-150300.12.1
suse/spack-man<0.21.1-150300.12.1
0.21.1-150300.12.1
All of the following
SUSE SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch)
Any of the following
suse/spack-info<0.21.1-150300.12.1
0.21.1-150300.12.1
suse/spack-recipes<0.21.1-150300.12.1
0.21.1-150300.12.1
suse/spack<0.21.1-150300.12.1
0.21.1-150300.12.1
suse/spack-man<0.21.1-150300.12.1
0.21.1-150300.12.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade suse/spack-info to a version that resolves this vulnerability.

    Fixed in 0.21.1-150300.12.1
  2. Upgrade

    Upgrade suse/spack-recipes to a version that resolves this vulnerability.

    Fixed in 0.21.1-150300.12.1
  3. Upgrade

    Upgrade suse/spack to a version that resolves this vulnerability.

    Fixed in 0.21.1-150300.12.1
  4. Upgrade

    Upgrade suse/spack-man to a version that resolves this vulnerability.

    Fixed in 0.21.1-150300.12.1
  5. Upgrade

    Upgrade Spack to a version that resolves this vulnerability.

    Fixed in 0.21.1
  6. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch SUSE-2024-452=1
  7. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-452=1

Event History

Feb 13, 2024
Advisory Published
via SUSE·08:33 AM

Frequently Asked Questions

1

Which systems and packages are covered by this update?

The update covers spack, spack-info, spack-man, and spack-recipes for openSUSE Leap 15.3 and SUSE Linux Enterprise High Performance Computing LTSS 15 SP3, in noarch builds.

2

What version does the update install?

The update brings Spack to version 0.21.1. It includes support for reading buildcaches created by Spack v0.22 and multiple solver, environment, buildcache, and command-line bug fixes.

3

How can I verify that the update has been applied?

Check the installed Spack package version and confirm it has been updated to 0.21.1. The provided information does not identify a separate fixed package release number for the related spack subpackages.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203