From 3050e6dbebb4b1c00e20c8bb5b6c585ed531aab7 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Thu, 18 Dec 2025 16:27:17 -0600
Subject: [PATCH 001/106] Add macOS CI workflow using spack/setup-spack and
 spack/github-actions-buildcache

This workflow builds the ci environment on macOS using:
- spack/setup-spack@v2.1.1 for Spack installation
- spack/github-actions-buildcache@v2 for build cache management
- Matrix strategy for both gcc and clang compilers
- Automatic buildcache push/pull for faster rebuilds
---
 .github/workflows/macos-ci.yml | 79 ++++++++++++++++++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 .github/workflows/macos-ci.yml

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
new file mode 100644
index 000000000..78644313c
--- /dev/null
+++ b/.github/workflows/macos-ci.yml
@@ -0,0 +1,79 @@
+name: macOS CI Build
+
+on:
+  push:
+    branches:
+      - master
+      - macos-ci-workflow
+  pull_request:
+    branches:
+      - master
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    runs-on: macos-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        compiler: [gcc, clang]
+    
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      
+      - name: Setup Spack
+        uses: spack/setup-spack@v2.1.1
+        with:
+          ref: develop
+          color: true
+          path: ${{ github.workspace }}/spack
+      
+      - name: Add Spack environment
+        run: |
+          spack env create ci spack-environment/ci
+          spack env activate ci
+          spack -e ci compiler find
+          spack -e ci external find --not-buildable cmake
+      
+      - name: Concretize
+        run: |
+          spack -e ci concretize -f
+      
+      - name: Setup buildcache access
+        uses: spack/github-actions-buildcache@v2
+        with:
+          mode: readwrite
+          key: macos-${{ matrix.compiler }}-ci
+      
+      - name: Install
+        run: |
+          spack -e ci install --no-check-signature --show-log-on-error
+      
+      - name: Push to buildcache
+        if: always()
+        run: |
+          spack -e ci buildcache push --update-index --only=package --unsigned ${{ github.workspace }}/buildcache-macos
+      
+      - name: Show environment info
+        if: always()
+        run: |
+          spack -e ci find -lv
+          spack -e ci graph --dot > ci-graph.dot
+      
+      - name: Upload environment graph
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ci-environment-graph-${{ matrix.compiler }}
+          path: ci-graph.dot

From bebe4c1823c37410a20421607a2d3a9fc6c4922a Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Thu, 18 Dec 2025 20:52:37 -0600
Subject: [PATCH 002/106] Align macOS CI with container build: derive
 configuration at runtime (#96)

* Initial plan

* Align macOS CI with container build: spack versions, cherry-picks, externals, and buildcache

Co-authored-by: wdconinc <4656391+wdconinc@users.noreply.github.com>

* Derive spack configuration from spack.sh and spack-packages.sh at runtime

Co-authored-by: wdconinc <4656391+wdconinc@users.noreply.github.com>

* Fix cherry-pick loops to filter heredoc delimiters and empty lines

Co-authored-by: wdconinc <4656391+wdconinc@users.noreply.github.com>

* Improve cherry-pick filtering and add proper quoting for security

Co-authored-by: wdconinc <4656391+wdconinc@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: wdconinc <4656391+wdconinc@users.noreply.github.com>
---
 .github/workflows/macos-ci.yml | 80 ++++++++++++++++++++++++----------
 1 file changed, 56 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 78644313c..1fc9527cc 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -32,48 +32,80 @@ jobs:
         with:
           submodules: recursive
       
+      - name: Extract Spack configuration
+        id: spack-config
+        run: |
+          # Source spack.sh to get SPACK_VERSION and SPACK_CHERRYPICKS
+          source spack.sh
+          echo "spack-version=${SPACK_VERSION}" >> $GITHUB_OUTPUT
+          echo "spack-cherrypicks<<EOF" >> $GITHUB_OUTPUT
+          echo "${SPACK_CHERRYPICKS}" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+          
+          # Source spack-packages.sh to get SPACKPACKAGES_VERSION and SPACKPACKAGES_CHERRYPICKS
+          source spack-packages.sh
+          echo "spackpackages-version=${SPACKPACKAGES_VERSION}" >> $GITHUB_OUTPUT
+          echo "spackpackages-cherrypicks<<EOF" >> $GITHUB_OUTPUT
+          echo "${SPACKPACKAGES_CHERRYPICKS}" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+          
+          # Extract buildcache URL from mirrors.yaml.in (simplified - get the version)
+          echo "buildcache-version=${SPACKPACKAGES_VERSION}" >> $GITHUB_OUTPUT
+      
       - name: Setup Spack
         uses: spack/setup-spack@v2.1.1
         with:
-          ref: develop
+          ref: ${{ steps.spack-config.outputs.spack-version }}
           color: true
           path: ${{ github.workspace }}/spack
       
+      - name: Apply Spack cherry-picks
+        run: |
+          cd ${{ github.workspace }}/spack
+          git config user.name "GitHub Actions"
+          git config user.email "actions@github.com"
+          
+          # Apply cherry-picks from spack.sh (match only valid git commit hashes)
+          echo "${{ steps.spack-config.outputs.spack-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' | while read -r commit; do
+            echo "Cherry-picking ${commit}"
+            git cherry-pick "${commit}"
+          done
+      
+      - name: Checkout and configure spack-packages
+        run: |
+          cd ${{ github.workspace }}/spack
+          git clone https://github.com/spack/spack-packages.git var/spack/repos/spack-packages
+          cd var/spack/repos/spack-packages
+          git checkout ${{ steps.spack-config.outputs.spackpackages-version }}
+          git config user.name "GitHub Actions"
+          git config user.email "actions@github.com"
+          
+          # Apply cherry-picks from spack-packages.sh (match only valid git commit hashes)
+          echo "${{ steps.spack-config.outputs.spackpackages-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' | while read -r commit; do
+            echo "Cherry-picking ${commit}"
+            git cherry-pick "${commit}"
+          done
+          
+          cd ${{ github.workspace }}/spack
+          spack repo add var/spack/repos/spack-packages
+      
       - name: Add Spack environment
         run: |
           spack env create ci spack-environment/ci
           spack env activate ci
           spack -e ci compiler find
+          spack -e ci external find llvm
           spack -e ci external find --not-buildable cmake
       
       - name: Concretize
         run: |
           spack -e ci concretize -f
       
-      - name: Setup buildcache access
-        uses: spack/github-actions-buildcache@v2
-        with:
-          mode: readwrite
-          key: macos-${{ matrix.compiler }}-ci
+      - name: Configure buildcache
+        run: |
+          spack -e ci mirror add eic oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
+          spack -e ci buildcache keys --install --trust
       
       - name: Install
         run: |
           spack -e ci install --no-check-signature --show-log-on-error
-      
-      - name: Push to buildcache
-        if: always()
-        run: |
-          spack -e ci buildcache push --update-index --only=package --unsigned ${{ github.workspace }}/buildcache-macos
-      
-      - name: Show environment info
-        if: always()
-        run: |
-          spack -e ci find -lv
-          spack -e ci graph --dot > ci-graph.dot
-      
-      - name: Upload environment graph
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: ci-environment-graph-${{ matrix.compiler }}
-          path: ci-graph.dot

From eff1f041b19f24ec5a50f508513af1e611e93ce9 Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Sun, 9 Aug 2026 17:47:42 +0000
Subject: [PATCH 003/106] [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci
---
 .github/workflows/macos-ci.yml | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 1fc9527cc..e36479916 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -25,13 +25,13 @@ jobs:
       fail-fast: false
       matrix:
         compiler: [gcc, clang]
-    
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           submodules: recursive
-      
+
       - name: Extract Spack configuration
         id: spack-config
         run: |
@@ -41,36 +41,36 @@ jobs:
           echo "spack-cherrypicks<<EOF" >> $GITHUB_OUTPUT
           echo "${SPACK_CHERRYPICKS}" >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
-          
+
           # Source spack-packages.sh to get SPACKPACKAGES_VERSION and SPACKPACKAGES_CHERRYPICKS
           source spack-packages.sh
           echo "spackpackages-version=${SPACKPACKAGES_VERSION}" >> $GITHUB_OUTPUT
           echo "spackpackages-cherrypicks<<EOF" >> $GITHUB_OUTPUT
           echo "${SPACKPACKAGES_CHERRYPICKS}" >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
-          
+
           # Extract buildcache URL from mirrors.yaml.in (simplified - get the version)
           echo "buildcache-version=${SPACKPACKAGES_VERSION}" >> $GITHUB_OUTPUT
-      
+
       - name: Setup Spack
         uses: spack/setup-spack@v2.1.1
         with:
           ref: ${{ steps.spack-config.outputs.spack-version }}
           color: true
           path: ${{ github.workspace }}/spack
-      
+
       - name: Apply Spack cherry-picks
         run: |
           cd ${{ github.workspace }}/spack
           git config user.name "GitHub Actions"
           git config user.email "actions@github.com"
-          
+
           # Apply cherry-picks from spack.sh (match only valid git commit hashes)
           echo "${{ steps.spack-config.outputs.spack-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' | while read -r commit; do
             echo "Cherry-picking ${commit}"
             git cherry-pick "${commit}"
           done
-      
+
       - name: Checkout and configure spack-packages
         run: |
           cd ${{ github.workspace }}/spack
@@ -79,16 +79,16 @@ jobs:
           git checkout ${{ steps.spack-config.outputs.spackpackages-version }}
           git config user.name "GitHub Actions"
           git config user.email "actions@github.com"
-          
+
           # Apply cherry-picks from spack-packages.sh (match only valid git commit hashes)
           echo "${{ steps.spack-config.outputs.spackpackages-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' | while read -r commit; do
             echo "Cherry-picking ${commit}"
             git cherry-pick "${commit}"
           done
-          
+
           cd ${{ github.workspace }}/spack
           spack repo add var/spack/repos/spack-packages
-      
+
       - name: Add Spack environment
         run: |
           spack env create ci spack-environment/ci
@@ -96,16 +96,16 @@ jobs:
           spack -e ci compiler find
           spack -e ci external find llvm
           spack -e ci external find --not-buildable cmake
-      
+
       - name: Concretize
         run: |
           spack -e ci concretize -f
-      
+
       - name: Configure buildcache
         run: |
           spack -e ci mirror add eic oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
           spack -e ci buildcache keys --install --trust
-      
+
       - name: Install
         run: |
           spack -e ci install --no-check-signature --show-log-on-error

From 6e979d7f7163df365034623d58590397d4994b83 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 13:01:22 -0500
Subject: [PATCH 004/106] fix(ci): matrix on ENV [ci, xl] instead of compiler

---
 .github/workflows/macos-ci.yml | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index e36479916..9ae76eca1 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -22,9 +22,8 @@ jobs:
   build:
     runs-on: macos-latest
     strategy:
-      fail-fast: false
       matrix:
-        compiler: [gcc, clang]
+        ENV: [ci, xl]
 
     steps:
       - name: Checkout repository
@@ -91,21 +90,23 @@ jobs:
 
       - name: Add Spack environment
         run: |
-          spack env create ci spack-environment/ci
-          spack env activate ci
-          spack -e ci compiler find
-          spack -e ci external find llvm
-          spack -e ci external find --not-buildable cmake
+          spack env activate -d spack-environment/${{matrix.ENV}}
+          spack compiler find
+          spack external find llvm
+          spack external find --not-buildable cmake
 
       - name: Concretize
         run: |
-          spack -e ci concretize -f
+          spack env activate -d spack-environment/${{matrix.ENV}}
+          spack concretize -f
 
       - name: Configure buildcache
         run: |
-          spack -e ci mirror add eic oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
-          spack -e ci buildcache keys --install --trust
+          spack env activate -d spack-environment/${{matrix.ENV}}
+          spack mirror add eic oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
+          spack buildcache keys --install --trust
 
       - name: Install
         run: |
-          spack -e ci install --no-check-signature --show-log-on-error
+          spack env activate -d spack-environment/${{matrix.ENV}}
+          spack install --no-check-signature --show-log-on-error

From 57176578ba1cbb922d97256e7463333c3db60a28 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 13:06:44 -0500
Subject: [PATCH 005/106] fix: spack/setup-spack => manual clone

Updated the Spack setup process by changing the method of cloning the Spack repository and applying cherry-picks.
---
 .github/workflows/macos-ci.yml | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 9ae76eca1..e22a9eb02 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -51,16 +51,11 @@ jobs:
           # Extract buildcache URL from mirrors.yaml.in (simplified - get the version)
           echo "buildcache-version=${SPACKPACKAGES_VERSION}" >> $GITHUB_OUTPUT
 
-      - name: Setup Spack
-        uses: spack/setup-spack@v2.1.1
-        with:
-          ref: ${{ steps.spack-config.outputs.spack-version }}
-          color: true
-          path: ${{ github.workspace }}/spack
-
-      - name: Apply Spack cherry-picks
+      - name: Checkout and configure spack
         run: |
+          git clone --filter=tree:0 https://github.com/spack/spack-packages.git ${{ github.workspace }}/spack
           cd ${{ github.workspace }}/spack
+          git checkout ${{ steps.spack-config.outputs.spack-version }}
           git config user.name "GitHub Actions"
           git config user.email "actions@github.com"
 
@@ -73,7 +68,7 @@ jobs:
       - name: Checkout and configure spack-packages
         run: |
           cd ${{ github.workspace }}/spack
-          git clone https://github.com/spack/spack-packages.git var/spack/repos/spack-packages
+          git clone --filter=tree:0 https://github.com/spack/spack-packages.git var/spack/repos/spack-packages
           cd var/spack/repos/spack-packages
           git checkout ${{ steps.spack-config.outputs.spackpackages-version }}
           git config user.name "GitHub Actions"

From 6308bd154a5fd8672dbf39d858cf6cf2dddcc050 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 13:08:36 -0500
Subject: [PATCH 006/106] fix(ci): only run on push to master

---
 .github/workflows/macos-ci.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index e22a9eb02..d6a8759fd 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - master
-      - macos-ci-workflow
   pull_request:
     branches:
       - master

From 0bd9f2b81fc93f9336d8b2ee71e58f7d262a1441 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 13:12:15 -0500
Subject: [PATCH 007/106] fix(macos): avoid external cmake

---
 .github/workflows/macos-ci.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index d6a8759fd..ac239514d 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -87,7 +87,6 @@ jobs:
           spack env activate -d spack-environment/${{matrix.ENV}}
           spack compiler find
           spack external find llvm
-          spack external find --not-buildable cmake
 
       - name: Concretize
         run: |

From 2b649b0430c30b7a826cbd4dfd5f0be1478c2b40 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 13:16:37 -0500
Subject: [PATCH 008/106] fix(macos): buildcache autopush unsigned with secrets

Added environment variables for GitHub registry authentication.
---
 .github/workflows/macos-ci.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index ac239514d..4b5e555d4 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -24,6 +24,10 @@ jobs:
       matrix:
         ENV: [ci, xl]
 
+    env:
+      GITHUB_REGISTRY_USER: ${{ secrets.GHCR_REGISTRY_USER }}
+      GITHUB_REGISTRY_TOKEN: ${{ secrets.GHCR_REGISTRY_TOKEN }}
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -96,8 +100,11 @@ jobs:
       - name: Configure buildcache
         run: |
           spack env activate -d spack-environment/${{matrix.ENV}}
-          spack mirror add eic oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
-          spack buildcache keys --install --trust
+          spack mirror add eic \
+            --autopush --unsigned \
+            --oci-username-variable GITHUB_REGISTRY_USER \
+            --oci-password-variable GITHUB_REGISTRY_TOKEN \
+            oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
 
       - name: Install
         run: |

From 2ace61fd39e7f19ab855cd910a3cf1f5aad9c711 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 13:17:08 -0500
Subject: [PATCH 009/106] fix(macos): clone spack for spack

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/macos-ci.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 4b5e555d4..55502c50d 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -56,9 +56,10 @@ jobs:
 
       - name: Checkout and configure spack
         run: |
-          git clone --filter=tree:0 https://github.com/spack/spack-packages.git ${{ github.workspace }}/spack
+          git clone --filter=tree:0 https://github.com/spack/spack.git ${{ github.workspace }}/spack
           cd ${{ github.workspace }}/spack
           git checkout ${{ steps.spack-config.outputs.spack-version }}
+          echo "${{ github.workspace }}/spack/bin" >> $GITHUB_PATH
           git config user.name "GitHub Actions"
           git config user.email "actions@github.com"
 

From d1c88bf5b22eb91aada16818547370b25cc5622d Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 13:38:43 -0500
Subject: [PATCH 010/106] fix(ci): add key4hep-spack, eic-spack, and fixup
 repo.yaml location

---
 .github/workflows/macos-ci.yml | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 55502c50d..78d909117 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -51,6 +51,14 @@ jobs:
           echo "${SPACKPACKAGES_CHERRYPICKS}" >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
 
+          # Source key4hep-spack.sh to get KEY4HEPSPACK_VERSION
+          source key4hep-spack.sh
+          echo "key4hepspack-version=${KEY4HEPSPACK_VERSION}" >> $GITHUB_OUTPUT
+
+          # Source eic-spack.sh to get EICSPACK_VERSION
+          source eic-spack.sh
+          echo "eicspack-version=${EICSPACK_VERSION}" >> $GITHUB_OUTPUT
+
           # Extract buildcache URL from mirrors.yaml.in (simplified - get the version)
           echo "buildcache-version=${SPACKPACKAGES_VERSION}" >> $GITHUB_OUTPUT
 
@@ -85,7 +93,21 @@ jobs:
           done
 
           cd ${{ github.workspace }}/spack
-          spack repo add var/spack/repos/spack-packages
+          spack repo add var/spack/repos/spack-packages/repos/spack_repo/builtin
+
+      - name: Checkout and configure key4hep-spack
+        run: |
+          cd ${{ github.workspace }}/spack
+          git clone --filter=tree:0 https://github.com/key4hep-spack/key4hep-spack.git var/spack/repos/key4hep-spack
+          git checkout ${{ steps.spack-config.outputs.key4hepspack-version }}
+          spack repo add var/spack/repos/key4hep-spack
+
+      - name: Checkout and configure eic-spack
+        run: |
+          cd ${{ github.workspace }}/spack
+          git clone --filter=tree:0 https://github.com/eic/eic-spack.git var/spack/repos/eic-spack
+          git checkout ${{ steps.spack-config.outputs.eicspack-version }}
+          spack repo add var/spack/repos/eic-spack/spack_repo/eic
 
       - name: Add Spack environment
         run: |

From 965e3352d994a961b7928ef36cfe2106a70d6576 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 13:42:50 -0500
Subject: [PATCH 011/106] fix: key4hep url fix

---
 .github/workflows/macos-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 78d909117..c2f07b5c4 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -98,7 +98,7 @@ jobs:
       - name: Checkout and configure key4hep-spack
         run: |
           cd ${{ github.workspace }}/spack
-          git clone --filter=tree:0 https://github.com/key4hep-spack/key4hep-spack.git var/spack/repos/key4hep-spack
+          git clone --filter=tree:0 https://github.com/key4hep/key4hep-spack.git var/spack/repos/key4hep-spack
           git checkout ${{ steps.spack-config.outputs.key4hepspack-version }}
           spack repo add var/spack/repos/key4hep-spack
 

From d3af3f3f1d07b1ee942b47e2b73122e251f605b9 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 13:51:01 -0500
Subject: [PATCH 012/106] fix: cd into cloned path

---
 .github/workflows/macos-ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index c2f07b5c4..3571b6f59 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -99,6 +99,7 @@ jobs:
         run: |
           cd ${{ github.workspace }}/spack
           git clone --filter=tree:0 https://github.com/key4hep/key4hep-spack.git var/spack/repos/key4hep-spack
+          cd var/spack/repos/key4hep-spack
           git checkout ${{ steps.spack-config.outputs.key4hepspack-version }}
           spack repo add var/spack/repos/key4hep-spack
 
@@ -106,6 +107,7 @@ jobs:
         run: |
           cd ${{ github.workspace }}/spack
           git clone --filter=tree:0 https://github.com/eic/eic-spack.git var/spack/repos/eic-spack
+          cd var/spack/repos/eic-spack
           git checkout ${{ steps.spack-config.outputs.eicspack-version }}
           spack repo add var/spack/repos/eic-spack/spack_repo/eic
 

From e3b063d062b84677f4efaf43975e44a93eb28737 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 13:58:00 -0500
Subject: [PATCH 013/106] fix: spack repo add relative to spack root

---
 .github/workflows/macos-ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 3571b6f59..bac28e09a 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -101,6 +101,8 @@ jobs:
           git clone --filter=tree:0 https://github.com/key4hep/key4hep-spack.git var/spack/repos/key4hep-spack
           cd var/spack/repos/key4hep-spack
           git checkout ${{ steps.spack-config.outputs.key4hepspack-version }}
+
+          cd ${{ github.workspace }}/spack
           spack repo add var/spack/repos/key4hep-spack
 
       - name: Checkout and configure eic-spack
@@ -109,6 +111,8 @@ jobs:
           git clone --filter=tree:0 https://github.com/eic/eic-spack.git var/spack/repos/eic-spack
           cd var/spack/repos/eic-spack
           git checkout ${{ steps.spack-config.outputs.eicspack-version }}
+
+          cd ${{ github.workspace }}/spack
           spack repo add var/spack/repos/eic-spack/spack_repo/eic
 
       - name: Add Spack environment

From 08dee5c2566f0c3881407a7d0707fddcc3d828b0 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 14:04:22 -0500
Subject: [PATCH 014/106] fix: avoid activate; install both ENV and ENV/epic

---
 .github/workflows/macos-ci.yml | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index bac28e09a..027d3795b 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -117,25 +117,25 @@ jobs:
 
       - name: Add Spack environment
         run: |
-          spack env activate -d spack-environment/${{matrix.ENV}}
-          spack compiler find
-          spack external find llvm
+          spack -e spack-environment/${{matrix.ENV}} compiler find
+          spack -e spack-environment/${{matrix.ENV}} external find llvm
 
       - name: Concretize
         run: |
-          spack env activate -d spack-environment/${{matrix.ENV}}
-          spack concretize -f
+          spack -e spack-environment/${{matrix.ENV}} concretize -f
 
       - name: Configure buildcache
         run: |
-          spack env activate -d spack-environment/${{matrix.ENV}}
-          spack mirror add eic \
+          spack -e spack-environment/${{matrix.ENV}} mirror add eic \
             --autopush --unsigned \
             --oci-username-variable GITHUB_REGISTRY_USER \
             --oci-password-variable GITHUB_REGISTRY_TOKEN \
             oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
 
-      - name: Install
+      - name: Install base environment
         run: |
-          spack env activate -d spack-environment/${{matrix.ENV}}
-          spack install --no-check-signature --show-log-on-error
+          spack -e spack-environment/${{matrix.ENV}} install --no-check-signature --show-log-on-error
+
+      - name: Install epic environment
+        run: |
+          spack -e spack-environment/${{matrix.ENV}}/epic install --no-check-signature --show-log-on-error

From 3b289e0a2a4d3227baacd5a144b83d7d14106e09 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 14:13:44 -0500
Subject: [PATCH 015/106] fix: packages: clang on darwin

---
 spack-environment/packages.yaml | 36 ++++++++++++++++++++++++---------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/spack-environment/packages.yaml b/spack-environment/packages.yaml
index 4f0f8bb8e..5aba64d86 100644
--- a/spack-environment/packages.yaml
+++ b/spack-environment/packages.yaml
@@ -73,14 +73,26 @@ packages:
     - cxxstd=20
   c:
     prefer:
-    - gcc
-    require:
-    - gcc
+    - spec: gcc
+      when: platform=linux
+    - spec: clang
+      when: platform=darwin
+    require:
+    - spec: gcc
+      when: platform=linux
+    - spec: clang
+      when: platform=darwin
   cxx:
     prefer:
-    - gcc
-    require:
-    - gcc
+    - spec: gcc
+      when: platform=linux
+    - spec: clang
+      when: platform=darwin
+    require:
+    - spec: gcc
+      when: platform=linux
+    - spec: clang
+      when: platform=darwin
   cairo:
     require:
     - '@1.18.2:'
@@ -211,9 +223,15 @@ packages:
     - +shared cxxstd=20
   fortran:
     prefer:
-    - gcc
-    require:
-    - gcc
+    - spec: gcc
+      when: platform=linux
+    - spec: clang
+      when: platform=darwin
+    require:
+    - spec: gcc
+      when: platform=linux
+    - spec: clang
+      when: platform=darwin
   freetype:
     require:
     - build_system=autotools

From f0547f374195618327cd223619bebbb45a28d33e Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 14:21:16 -0500
Subject: [PATCH 016/106] fix: strace on linux only

---
 spack-environment/xl/spack.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/spack-environment/xl/spack.yaml b/spack-environment/xl/spack.yaml
index 5b842c125..c863a1f8e 100644
--- a/spack-environment/xl/spack.yaml
+++ b/spack-environment/xl/spack.yaml
@@ -141,7 +141,8 @@ spack:
   - snakemake
   - spdlog
   - stow
-  - strace
+  - spec: strace
+    when: platform=linux
   - uproot-mcp-server
   - valgrind
   - xeyes

From 762e4adac72ee2b8de259782b481b522d79f88c6 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 14:27:05 -0500
Subject: [PATCH 017/106] fix: gl/glu provided by apple-gl/glu on darwin

---
 spack-environment/packages.yaml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/spack-environment/packages.yaml b/spack-environment/packages.yaml
index 5aba64d86..5507cb46e 100644
--- a/spack-environment/packages.yaml
+++ b/spack-environment/packages.yaml
@@ -290,10 +290,16 @@ packages:
     - ~gtk
   gl:
     require:
-    - glx
+    - spec: glx
+      when: platform=linux
+    - spec: apple-gl
+      when: platform=darwin
   glu:
     require:
-    - openglu
+    - spec: openglu
+      when: platform=linux
+    - spec: apple-glu
+      when: platform=darwin
   gloo:
     require:
     - '@2023-12-03'

From b7577a2cf2c1c32d7cce2b9cd163acbb847ec14b Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 14:28:46 -0500
Subject: [PATCH 018/106] fix: darwin: c,cxx=apple-clang, fortran=gcc

---
 spack-environment/packages.yaml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/spack-environment/packages.yaml b/spack-environment/packages.yaml
index 5507cb46e..b16ea041f 100644
--- a/spack-environment/packages.yaml
+++ b/spack-environment/packages.yaml
@@ -75,23 +75,23 @@ packages:
     prefer:
     - spec: gcc
       when: platform=linux
-    - spec: clang
+    - spec: apple-clang
       when: platform=darwin
     require:
     - spec: gcc
       when: platform=linux
-    - spec: clang
+    - spec: apple-clang
       when: platform=darwin
   cxx:
     prefer:
     - spec: gcc
       when: platform=linux
-    - spec: clang
+    - spec: apple-clang
       when: platform=darwin
     require:
     - spec: gcc
       when: platform=linux
-    - spec: clang
+    - spec: apple-clang
       when: platform=darwin
   cairo:
     require:
@@ -225,12 +225,12 @@ packages:
     prefer:
     - spec: gcc
       when: platform=linux
-    - spec: clang
+    - spec: gcc
       when: platform=darwin
     require:
     - spec: gcc
       when: platform=linux
-    - spec: clang
+    - spec: gcc
       when: platform=darwin
   freetype:
     require:

From 1572b08c0b2dcbdf5aca6985cb098307180ba428 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 15:23:13 -0500
Subject: [PATCH 019/106] fix: use definitions for extra packages per platform

---
 spack-environment/xl/spack.yaml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/spack-environment/xl/spack.yaml b/spack-environment/xl/spack.yaml
index c863a1f8e..96dc9ae97 100644
--- a/spack-environment/xl/spack.yaml
+++ b/spack-environment/xl/spack.yaml
@@ -5,7 +5,13 @@ spack:
   - ../packages.yaml
   - ../packages_root_with_opengl.yaml
   - ../view.yaml
+  definitions:
+  - when: arch.satisfies("platform=linux")
+    extra_packages: [strace]
+  - when: arch.satisfies("platform=darwin")
+    extra_packages: []
   specs:
+  - $extra_packages
   - acts
   - actsvg
   - afterburner
@@ -141,8 +147,6 @@ spack:
   - snakemake
   - spdlog
   - stow
-  - spec: strace
-    when: platform=linux
   - uproot-mcp-server
   - valgrind
   - xeyes

From 687d5921d6ded0ef2a1651ac519cc1b38c4ddff6 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 16:55:38 -0500
Subject: [PATCH 020/106] fix: disable view in macOS (/opt/local not writable)

---
 .github/workflows/macos-ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 027d3795b..0de867617 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -122,7 +122,7 @@ jobs:
 
       - name: Concretize
         run: |
-          spack -e spack-environment/${{matrix.ENV}} concretize -f
+          spack -e spack-environment/${{matrix.ENV}} -c view:false concretize --force
 
       - name: Configure buildcache
         run: |
@@ -134,7 +134,7 @@ jobs:
 
       - name: Install base environment
         run: |
-          spack -e spack-environment/${{matrix.ENV}} install --no-check-signature --show-log-on-error
+          spack -e spack-environment/${{matrix.ENV}} -c view:false install --no-check-signature --show-log-on-error
 
       - name: Install epic environment
         run: |

From 9782cc332ca8c07e438511b5ddde858cd98720c9 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 17:01:59 -0500
Subject: [PATCH 021/106] fix: add comment on definitions:when syntax

Added comments to clarify the use of definitions in the Spack environment.
---
 spack-environment/xl/spack.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/spack-environment/xl/spack.yaml b/spack-environment/xl/spack.yaml
index 96dc9ae97..3444a9a37 100644
--- a/spack-environment/xl/spack.yaml
+++ b/spack-environment/xl/spack.yaml
@@ -6,6 +6,8 @@ spack:
   - ../packages_root_with_opengl.yaml
   - ../view.yaml
   definitions:
+  # Note that in definitions, when takes a python expression as argument
+  # https://spack.readthedocs.io/en/latest/environments.html#spec-list-references
   - when: arch.satisfies("platform=linux")
     extra_packages: [strace]
   - when: arch.satisfies("platform=darwin")

From 04566b26936d2a1576aa6b961fb14ab443d46945 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 17:11:22 -0500
Subject: [PATCH 022/106] fix: epic: install with view:false

---
 .github/workflows/macos-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 0de867617..e305f4e4e 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -138,4 +138,4 @@ jobs:
 
       - name: Install epic environment
         run: |
-          spack -e spack-environment/${{matrix.ENV}}/epic install --no-check-signature --show-log-on-error
+          spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install install --no-check-signature --show-log-on-error

From 9a999c134567b8f8127003cd6953cfc21a6d377d Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 17:13:47 -0500
Subject: [PATCH 023/106] fix: allow for empty and duplicative cherry-picks

---
 .github/workflows/macos-ci.yml | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index e305f4e4e..3e8711491 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -72,10 +72,14 @@ jobs:
           git config user.email "actions@github.com"
 
           # Apply cherry-picks from spack.sh (match only valid git commit hashes)
-          echo "${{ steps.spack-config.outputs.spack-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' | while read -r commit; do
+          while read -r commit; do
+            if git merge-base --is-ancestor "${commit}" HEAD; then
+              echo "Skipping already applied ${commit}"
+              continue
+            fi
             echo "Cherry-picking ${commit}"
             git cherry-pick "${commit}"
-          done
+          done < <(echo "${{ steps.spack-config.outputs.spack-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
 
       - name: Checkout and configure spack-packages
         run: |
@@ -87,10 +91,14 @@ jobs:
           git config user.email "actions@github.com"
 
           # Apply cherry-picks from spack-packages.sh (match only valid git commit hashes)
-          echo "${{ steps.spack-config.outputs.spackpackages-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' | while read -r commit; do
+          while read -r commit; do
+            if git merge-base --is-ancestor "${commit}" HEAD; then
+              echo "Skipping already applied ${commit}"
+              continue
+            fi
             echo "Cherry-picking ${commit}"
             git cherry-pick "${commit}"
-          done
+          done < <(echo "${{ steps.spack-config.outputs.spackpackages-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
 
           cd ${{ github.workspace }}/spack
           spack repo add var/spack/repos/spack-packages/repos/spack_repo/builtin

From 7810826ebe21f6bdc7a0f8d77055a29d15a45d5a Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 17:25:28 -0500
Subject: [PATCH 024/106] fix: packages: require: ~opengl when platform=darwin

---
 spack-environment/packages.yaml | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/spack-environment/packages.yaml b/spack-environment/packages.yaml
index b16ea041f..65a65e376 100644
--- a/spack-environment/packages.yaml
+++ b/spack-environment/packages.yaml
@@ -276,6 +276,8 @@ packages:
     - '@11.4.1.east'
     - cxxstd=20 -vecgeom +threads -vtk
     - any_of: [+opengl +qt +x11, -opengl -qt -x11]
+    - spec: -opengl -qt -x11
+      when: platform=darwin
   geant4-data:
     require:
     - +nudexlib +tendl +urrpt
@@ -680,11 +682,17 @@ packages:
   qt:
     require:
     - '@5.15.12:'
-    - +opengl
+    - spec: +opengl
+      when: platform=linux
+    - spec: ~opengl
+      when: platform=darwin
   qt-base:
     require:
     - '@6.7.2:'
-    - +opengl
+    - spec: +opengl
+      when: platform=linux
+    - spec: ~opengl
+      when: platform=darwin
   rdma-core:
     require:
     - ~pyverbs  # avoid constraint in https://github.com/spack/spack-packages/pull/2791
@@ -697,6 +705,8 @@ packages:
     - '@6.40.04'
     - cxxstd=20 +fftw +fortran +gdml +http -ipo +mlp +python +root7 +tmva +tmva-sofie +x +xrootd +ssl
     - any_of: [+opengl +webgui, -opengl -webgui]
+    - spec: -opengl -webgui
+      when: platform=darwin
   rucio-eic-mcp-server:
     require:
     - '@=0.2.0'

From b6a961809416dd7747bb05b2f108ae61506e3128 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 17:37:07 -0500
Subject: [PATCH 025/106] fix: packages: geant4: require: ~x11 when
 platform=linux

---
 spack-environment/packages.yaml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/spack-environment/packages.yaml b/spack-environment/packages.yaml
index 65a65e376..fe474bc9f 100644
--- a/spack-environment/packages.yaml
+++ b/spack-environment/packages.yaml
@@ -275,8 +275,12 @@ packages:
     require:
     - '@11.4.1.east'
     - cxxstd=20 -vecgeom +threads -vtk
-    - any_of: [+opengl +qt +x11, -opengl -qt -x11]
-    - spec: -opengl -qt -x11
+    - any_of: [+opengl +qt, -opengl -qt]
+    - spec: ~x11
+      when: ~opengl platform=linux
+    - spec: +x11
+      when: +opengl platform=linux
+    - spec: ~x11
       when: platform=darwin
   geant4-data:
     require:

From da8928d33f26a758b7fd2863f5471d99bc0a171d Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 17:48:59 -0500
Subject: [PATCH 026/106] fix: packages: qt{-base}: require: +opengl also on
 darwin

Removed conditional OpenGL requirements for qt and qt-base.
---
 spack-environment/packages.yaml | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/spack-environment/packages.yaml b/spack-environment/packages.yaml
index fe474bc9f..e74d3b635 100644
--- a/spack-environment/packages.yaml
+++ b/spack-environment/packages.yaml
@@ -686,17 +686,11 @@ packages:
   qt:
     require:
     - '@5.15.12:'
-    - spec: +opengl
-      when: platform=linux
-    - spec: ~opengl
-      when: platform=darwin
+    - +opengl
   qt-base:
     require:
     - '@6.7.2:'
-    - spec: +opengl
-      when: platform=linux
-    - spec: ~opengl
-      when: platform=darwin
+    - +opengl
   rdma-core:
     require:
     - ~pyverbs  # avoid constraint in https://github.com/spack/spack-packages/pull/2791

From 5d39f5785d178dc42f9789f77cd6dd654e44e787 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 17:56:44 -0500
Subject: [PATCH 027/106] fix: packages: root: require: ~x when darwin

---
 spack-environment/packages.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/spack-environment/packages.yaml b/spack-environment/packages.yaml
index e74d3b635..817445f1e 100644
--- a/spack-environment/packages.yaml
+++ b/spack-environment/packages.yaml
@@ -701,9 +701,11 @@ packages:
   root:
     require:
     - '@6.40.04'
-    - cxxstd=20 +fftw +fortran +gdml +http -ipo +mlp +python +root7 +tmva +tmva-sofie +x +xrootd +ssl
+    - cxxstd=20 +fftw +fortran +gdml +http -ipo +mlp +python +root7 +tmva +tmva-sofie +xrootd +ssl
     - any_of: [+opengl +webgui, -opengl -webgui]
-    - spec: -opengl -webgui
+    - spec: +x
+      when: platform=linux
+    - spec: ~x
       when: platform=darwin
   rucio-eic-mcp-server:
     require:

From d8ddcb7d03001f41ffeb9de4a24f7803214d93af Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 18:11:21 -0500
Subject: [PATCH 028/106] fix: grammar

---
 spack-environment/xl/spack.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spack-environment/xl/spack.yaml b/spack-environment/xl/spack.yaml
index 3444a9a37..7b4be6c94 100644
--- a/spack-environment/xl/spack.yaml
+++ b/spack-environment/xl/spack.yaml
@@ -6,7 +6,7 @@ spack:
   - ../packages_root_with_opengl.yaml
   - ../view.yaml
   definitions:
-  # Note that in definitions, when takes a python expression as argument
+  # Note that in definitions 'when' takes a python expression as argument
   # https://spack.readthedocs.io/en/latest/environments.html#spec-list-references
   - when: arch.satisfies("platform=linux")
     extra_packages: [strace]

From d812bdc7006ca26047085e39de69235f1408178f Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 18:12:13 -0500
Subject: [PATCH 029/106] fix: spack install ~~install~~ epic

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/macos-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 3e8711491..8998a8f55 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -146,4 +146,4 @@ jobs:
 
       - name: Install epic environment
         run: |
-          spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install install --no-check-signature --show-log-on-error
+          spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install --no-check-signature --show-log-on-error

From 2d70280cfe7b3f4f732ff5fd67171ce245ea0ef8 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 18:26:53 -0500
Subject: [PATCH 030/106] fix(ci): fail-fast: false, cancel-in-progress: false

---
 .github/workflows/macos-ci.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 8998a8f55..d09d1acfc 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -11,7 +11,7 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 permissions:
   contents: read
@@ -21,6 +21,7 @@ jobs:
   build:
     runs-on: macos-latest
     strategy:
+      fail-fast: false
       matrix:
         ENV: [ci, xl]
 

From 1b46646e1aae004f82262ff66d7fcca9b37a7cab Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 18:32:31 -0500
Subject: [PATCH 031/106] fix: use actions/checkout (faster)

---
 .github/workflows/macos-ci.yml | 57 ++++++++++++++++++++--------------
 1 file changed, 34 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index d09d1acfc..72787abfd 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -31,9 +31,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
+        uses: actions/checkout@v7
 
       - name: Extract Spack configuration
         id: spack-config
@@ -63,11 +61,16 @@ jobs:
           # Extract buildcache URL from mirrors.yaml.in (simplified - get the version)
           echo "buildcache-version=${SPACKPACKAGES_VERSION}" >> $GITHUB_OUTPUT
 
-      - name: Checkout and configure spack
+      - name: Checkout Spack repository
+        uses: actions/checkout@v7
+        with:
+          repo: https://github.com/spack/spack.git
+          path: ${{ github.workspace }}/spack
+          ref: ${{ steps.spack-config.outputs.spack-version }}
+
+      - name: Configure spack
         run: |
-          git clone --filter=tree:0 https://github.com/spack/spack.git ${{ github.workspace }}/spack
           cd ${{ github.workspace }}/spack
-          git checkout ${{ steps.spack-config.outputs.spack-version }}
           echo "${{ github.workspace }}/spack/bin" >> $GITHUB_PATH
           git config user.name "GitHub Actions"
           git config user.email "actions@github.com"
@@ -82,12 +85,16 @@ jobs:
             git cherry-pick "${commit}"
           done < <(echo "${{ steps.spack-config.outputs.spack-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
 
-      - name: Checkout and configure spack-packages
+      - name: Checkout spack-packages repository
+        uses: actions/checkout@v7
+        with:
+          repo: https://github.com/spack/spack-packages.git
+          path: ${{ github.workspace }}/spack/var/spack/repos/spack-packages
+          ref: ${{ steps.spack-config.outputs.spackpackages-version }}
+
+      - name: Configure spack-packages
         run: |
-          cd ${{ github.workspace }}/spack
-          git clone --filter=tree:0 https://github.com/spack/spack-packages.git var/spack/repos/spack-packages
-          cd var/spack/repos/spack-packages
-          git checkout ${{ steps.spack-config.outputs.spackpackages-version }}
+          cd ${{ github.workspace }}/spack/var/spack/repos/spack-packages
           git config user.name "GitHub Actions"
           git config user.email "actions@github.com"
 
@@ -104,23 +111,27 @@ jobs:
           cd ${{ github.workspace }}/spack
           spack repo add var/spack/repos/spack-packages/repos/spack_repo/builtin
 
-      - name: Checkout and configure key4hep-spack
-        run: |
-          cd ${{ github.workspace }}/spack
-          git clone --filter=tree:0 https://github.com/key4hep/key4hep-spack.git var/spack/repos/key4hep-spack
-          cd var/spack/repos/key4hep-spack
-          git checkout ${{ steps.spack-config.outputs.key4hepspack-version }}
+      - name: Checkout key4hep-spack repository
+        uses: actions/checkout@v7
+        with:
+          repo: https://github.com/key4hep/key4hep-spack.git
+          path: ${{ github.workspace }}/spack/var/spack/repos/key4hep-spack
+          ref: ${{ steps.spack-config.outputs.key4hepspack-version }}
 
+      - name: Configure key4hep-spack
+        run: |
           cd ${{ github.workspace }}/spack
           spack repo add var/spack/repos/key4hep-spack
 
-      - name: Checkout and configure eic-spack
-        run: |
-          cd ${{ github.workspace }}/spack
-          git clone --filter=tree:0 https://github.com/eic/eic-spack.git var/spack/repos/eic-spack
-          cd var/spack/repos/eic-spack
-          git checkout ${{ steps.spack-config.outputs.eicspack-version }}
+      - name: Checkout eic-spack repository
+        uses: actions/checkout@v7
+        with:
+          repo: https://github.com/eic/eic-spack.git
+          path: ${{ github.workspace }}/spack/var/spack/repos/eic-spack
+          ref: ${{ steps.spack-config.outputs.eicspack-version }}
 
+      - name: Configure eic-spack
+        run: |
           cd ${{ github.workspace }}/spack
           spack repo add var/spack/repos/eic-spack/spack_repo/eic
 

From f65263482cbef744f0782bdf8553d56f1bd716e5 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 18:56:57 -0500
Subject: [PATCH 032/106] fix: correct checkout syntax

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/macos-ci.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 72787abfd..a93f9221b 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -64,9 +64,10 @@ jobs:
       - name: Checkout Spack repository
         uses: actions/checkout@v7
         with:
-          repo: https://github.com/spack/spack.git
-          path: ${{ github.workspace }}/spack
+          repository: spack/spack
+          path: spack
           ref: ${{ steps.spack-config.outputs.spack-version }}
+          fetch-depth: 0
 
       - name: Configure spack
         run: |

From b1865274eb930453035a0e9ff2c1bbf8d3bfe8ba Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 19:20:40 -0500
Subject: [PATCH 033/106] fix: checkout syntax

---
 .github/workflows/macos-ci.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index a93f9221b..f1a29a259 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -89,8 +89,8 @@ jobs:
       - name: Checkout spack-packages repository
         uses: actions/checkout@v7
         with:
-          repo: https://github.com/spack/spack-packages.git
-          path: ${{ github.workspace }}/spack/var/spack/repos/spack-packages
+          repository: spack/spack-packages
+          path: spack/var/spack/repos/spack-packages
           ref: ${{ steps.spack-config.outputs.spackpackages-version }}
 
       - name: Configure spack-packages
@@ -115,8 +115,8 @@ jobs:
       - name: Checkout key4hep-spack repository
         uses: actions/checkout@v7
         with:
-          repo: https://github.com/key4hep/key4hep-spack.git
-          path: ${{ github.workspace }}/spack/var/spack/repos/key4hep-spack
+          repository: key4hep/key4hep-spack
+          path: spack/var/spack/repos/key4hep-spack
           ref: ${{ steps.spack-config.outputs.key4hepspack-version }}
 
       - name: Configure key4hep-spack
@@ -127,8 +127,8 @@ jobs:
       - name: Checkout eic-spack repository
         uses: actions/checkout@v7
         with:
-          repo: https://github.com/eic/eic-spack.git
-          path: ${{ github.workspace }}/spack/var/spack/repos/eic-spack
+          repository: eic/eic-spack
+          path: spack/var/spack/repos/eic-spack
           ref: ${{ steps.spack-config.outputs.eicspack-version }}
 
       - name: Configure eic-spack

From c90be1a7ed9f8c010852b3ca2b9f1d8e0262ca66 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 19:37:19 -0500
Subject: [PATCH 034/106] fix: fetch pull request for cherry-picking in CI

---
 .github/workflows/macos-ci.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index f1a29a259..a54aeb37c 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -76,6 +76,9 @@ jobs:
           git config user.name "GitHub Actions"
           git config user.email "actions@github.com"
 
+          # Fetch branches from which we cherry-pick
+          git fetch origin pull/51584/head:pr-51584
+
           # Apply cherry-picks from spack.sh (match only valid git commit hashes)
           while read -r commit; do
             if git merge-base --is-ancestor "${commit}" HEAD; then

From a73d6c87e99b6225d3ad4d8815ada4b5e7ba05e1 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 19:44:42 -0500
Subject: [PATCH 035/106] fix: add fetch for pull request 52207 in macOS CI

---
 .github/workflows/macos-ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index a54aeb37c..3ac2f2413 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -78,6 +78,7 @@ jobs:
 
           # Fetch branches from which we cherry-pick
           git fetch origin pull/51584/head:pr-51584
+          git fetch origin pull/52207/head:pr-52207
 
           # Apply cherry-picks from spack.sh (match only valid git commit hashes)
           while read -r commit; do

From 71e40f4d7d2a916cf8e6900a13c0517632f717d1 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 20:03:49 -0500
Subject: [PATCH 036/106] Fetch develop branch in macOS CI workflow

Added fetching of the develop branch for cherry-picking.
---
 .github/workflows/macos-ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 3ac2f2413..f046ef17e 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -77,6 +77,7 @@ jobs:
           git config user.email "actions@github.com"
 
           # Fetch branches from which we cherry-pick
+          git fetch origin refs/heads/develop:refs/heads/develop
           git fetch origin pull/51584/head:pr-51584
           git fetch origin pull/52207/head:pr-52207
 
@@ -103,6 +104,9 @@ jobs:
           git config user.name "GitHub Actions"
           git config user.email "actions@github.com"
 
+          # Fetch branches from which we cherry-pick
+          git fetch origin refs/heads/develop:refs/heads/develop
+
           # Apply cherry-picks from spack-packages.sh (match only valid git commit hashes)
           while read -r commit; do
             if git merge-base --is-ancestor "${commit}" HEAD; then

From f13a9d4906094dcf6cd22a858398f1e84362f4a4 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 20:37:29 -0500
Subject: [PATCH 037/106] Add fetch for pull request 3698 in macOS CI

Fetch pull request 3698 for cherry-picking.
---
 .github/workflows/macos-ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index f046ef17e..e29bc1693 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -106,6 +106,7 @@ jobs:
 
           # Fetch branches from which we cherry-pick
           git fetch origin refs/heads/develop:refs/heads/develop
+          git fetch origin pull/3698/head:pr-3698
 
           # Apply cherry-picks from spack-packages.sh (match only valid git commit hashes)
           while read -r commit; do

From 9fb8690958801308248f6cb1e904b14e6776cec9 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 21:01:19 -0500
Subject: [PATCH 038/106] Add fetch for pull request 4871 in macOS CI workflow

---
 .github/workflows/macos-ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index e29bc1693..843084d45 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -107,6 +107,7 @@ jobs:
           # Fetch branches from which we cherry-pick
           git fetch origin refs/heads/develop:refs/heads/develop
           git fetch origin pull/3698/head:pr-3698
+          git fetch origin pull/4871/head:pr-4871
 
           # Apply cherry-picks from spack-packages.sh (match only valid git commit hashes)
           while read -r commit; do

From 7181f35fedd87cd7edf6d22b76ccb551c56293f7 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 21:08:08 -0500
Subject: [PATCH 039/106] Add fetch for pull request 5856 in macOS CI workflow

---
 .github/workflows/macos-ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 843084d45..f786c5005 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -108,6 +108,7 @@ jobs:
           git fetch origin refs/heads/develop:refs/heads/develop
           git fetch origin pull/3698/head:pr-3698
           git fetch origin pull/4871/head:pr-4871
+          git fetch origin pull/5856/head:pr-5856
 
           # Apply cherry-picks from spack-packages.sh (match only valid git commit hashes)
           while read -r commit; do

From 9cd443994c307662b405829f7a5aa4873fb9ba76 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 21:17:36 -0500
Subject: [PATCH 040/106] Add 'tf' to the environment matrix in CI workflow

---
 .github/workflows/macos-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index f786c5005..e554fe65e 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -23,7 +23,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ENV: [ci, xl]
+        ENV: [ci, xl, tf]
 
     env:
       GITHUB_REGISTRY_USER: ${{ secrets.GHCR_REGISTRY_USER }}

From a5720dfe16961a3e5b0c6ecb8127093cc280e23e Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 9 Aug 2026 21:54:54 -0500
Subject: [PATCH 041/106] Add platform-specific TensorFlow definitions

Added conditional definitions for TensorFlow based on platform.
---
 spack-environment/tf/spack.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/spack-environment/tf/spack.yaml b/spack-environment/tf/spack.yaml
index 5813947b8..6c24037a2 100644
--- a/spack-environment/tf/spack.yaml
+++ b/spack-environment/tf/spack.yaml
@@ -4,7 +4,13 @@ spack:
   - ../config.yaml
   - ../packages.yaml
   - ../view.yaml
+  definitions:
+  - when: arch.satisfies("platform=linux")
+    tensorflow: [py-tensorflow +cuda]
+  - when: arch.satisfies("platform=darwin")
+    tensorflow: [py-tensorflow ~cuda]
   specs:
+  - $tensorflow
   - edm4hep
   - onnx
   - osg-ca-certs
@@ -42,7 +48,6 @@ spack:
   - py-rucio-clients
   - py-scipy
   - py-seaborn
-  - py-tensorflow +cuda
   - py-tf2onnx
   - py-toml
   - py-uproot

From a3a576d4c386ca98074886e12de3860eb2f5afd5 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Mon, 10 Aug 2026 12:35:34 -0500
Subject: [PATCH 042/106] fix: concretize $ENV/epic; move
 compilers/externals/mirrors to scope site

---
 .github/workflows/macos-ci.yml | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index e554fe65e..e59bd352f 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -149,25 +149,29 @@ jobs:
 
       - name: Add Spack environment
         run: |
-          spack -e spack-environment/${{matrix.ENV}} compiler find
-          spack -e spack-environment/${{matrix.ENV}} external find llvm
-
-      - name: Concretize
-        run: |
-          spack -e spack-environment/${{matrix.ENV}} -c view:false concretize --force
+          spack compiler find --scope site
+          spack external find --scope site llvm
 
       - name: Configure buildcache
         run: |
-          spack -e spack-environment/${{matrix.ENV}} mirror add eic \
+          spack mirror add --scope site eic \
             --autopush --unsigned \
             --oci-username-variable GITHUB_REGISTRY_USER \
             --oci-password-variable GITHUB_REGISTRY_TOKEN \
             oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
 
+      - name: Concretize base environment
+        run: |
+          spack -e spack-environment/${{matrix.ENV}} -c view:false concretize --force
+
       - name: Install base environment
         run: |
           spack -e spack-environment/${{matrix.ENV}} -c view:false install --no-check-signature --show-log-on-error
 
+      - name: Concretize epic environment
+        run: |
+          spack -e spack-environment/${{matrix.ENV}}/epic -c view:false concretize --force
+
       - name: Install epic environment
         run: |
           spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install --no-check-signature --show-log-on-error

From 34a0d2729c420ac705f0f14dd23b530ad81dc1a9 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Mon, 10 Aug 2026 15:47:53 -0500
Subject: [PATCH 043/106] fix: add valgrind to linux_packages

---
 spack-environment/xl/spack.yaml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/spack-environment/xl/spack.yaml b/spack-environment/xl/spack.yaml
index 7b4be6c94..e70d6c253 100644
--- a/spack-environment/xl/spack.yaml
+++ b/spack-environment/xl/spack.yaml
@@ -9,11 +9,11 @@ spack:
   # Note that in definitions 'when' takes a python expression as argument
   # https://spack.readthedocs.io/en/latest/environments.html#spec-list-references
   - when: arch.satisfies("platform=linux")
-    extra_packages: [strace]
+    linux_packages: [strace, valgrind]
   - when: arch.satisfies("platform=darwin")
-    extra_packages: []
+    linux_packages: []
   specs:
-  - $extra_packages
+  - $linux_packages
   - acts
   - actsvg
   - afterburner
@@ -150,7 +150,6 @@ spack:
   - spdlog
   - stow
   - uproot-mcp-server
-  - valgrind
   - xeyes
   - xrootd
   - xrootd-mcp-server

From c448ea2a9e397941ebb19330846e4a6eea4f6642 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Mon, 10 Aug 2026 17:11:28 -0500
Subject: [PATCH 044/106] fix: unpin binutils

---
 spack-environment/packages.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spack-environment/packages.yaml b/spack-environment/packages.yaml
index 817445f1e..393fed4f7 100644
--- a/spack-environment/packages.yaml
+++ b/spack-environment/packages.yaml
@@ -60,7 +60,7 @@ packages:
     - +brotli +bz2 +dataset +filesystem +glog +ipc +jemalloc +lz4 +parquet +snappy +zlib +zstd
   binutils:
     require:
-    - ~gold
+    - '@2.44:'
   blas:
     require:
     - openblas

From 641e8621500be57d5b724dd38d2fd34c699ba647 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Mon, 10 Aug 2026 17:52:59 -0500
Subject: [PATCH 045/106] Set MACOSX_DEPLOYMENT_TARGET in macOS CI workflow

---
 .github/workflows/macos-ci.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index e59bd352f..31a8216e9 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -33,6 +33,14 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
 
+      - name: Set Deployment Target to match runner SDK
+        run: |
+          # Fetch the active SDK version (e.g., 14.5)
+          CURRENT_SDK=$(xcrun --show-sdk-version)
+          
+          # Export it to the GitHub environment so all future steps use it
+          echo "MACOSX_DEPLOYMENT_TARGET=$CURRENT_SDK" >> $GITHUB_ENV
+
       - name: Extract Spack configuration
         id: spack-config
         run: |

From 9a42132a61b15020d2fb4a66f783102562f65d30 Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Mon, 10 Aug 2026 22:53:06 +0000
Subject: [PATCH 046/106] [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci
---
 .github/workflows/macos-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 31a8216e9..77e6d6dd7 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -37,7 +37,7 @@ jobs:
         run: |
           # Fetch the active SDK version (e.g., 14.5)
           CURRENT_SDK=$(xcrun --show-sdk-version)
-          
+
           # Export it to the GitHub environment so all future steps use it
           echo "MACOSX_DEPLOYMENT_TARGET=$CURRENT_SDK" >> $GITHUB_ENV
 

From 8fcb22b0695fdbfcc032a643b9450101940995a8 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Tue, 11 Aug 2026 11:01:56 -0500
Subject: [PATCH 047/106] fix: ci: move more packages to linux-only

---
 spack-environment/ci/spack.yaml | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/spack-environment/ci/spack.yaml b/spack-environment/ci/spack.yaml
index b3a0c8f1d..7cab31c0b 100644
--- a/spack-environment/ci/spack.yaml
+++ b/spack-environment/ci/spack.yaml
@@ -5,6 +5,18 @@ spack:
   - ../packages.yaml
   - ../packages_root_without_opengl.yaml
   - ../view.yaml
+  definitions:
+  # Note that in definitions 'when' takes a python expression as argument
+  # https://spack.readthedocs.io/en/latest/environments.html#spec-list-references
+  - when: arch.satisfies("platform=linux")
+    linux_packages: 
+    - imagemagick
+    - nopayloadclient
+    - ollama
+    - py-numpy
+    - py-scipy
+  - when: arch.satisfies("platform=darwin")
+    linux_packages: []
   specs:
   - acts
   - actsvg
@@ -25,15 +37,12 @@ spack:
   - hepmc3
   - hepmcmerger
   - heppdt
-  - imagemagick
   - irt
   - irt2
   - iwyu
   - jana2
   - just
-  - nopayloadclient
   - npsim -geocad
-  - ollama
   - onnx
   - osg-ca-certs
   - pandorasdk
@@ -60,14 +69,12 @@ spack:
   - py-matplotlib
   - py-mplhep
   - py-htgettoken
-  - py-numpy
   - py-onnx
   - py-onnxruntime
   - py-pandas
   - py-particle
   - py-pip
   - py-rucio-clients
-  - py-scipy
   - py-seaborn
   - py-snakemake-storage-plugin-fs
   - py-snakemake-storage-plugin-pelican

From c0e6e1b9097ce466acc67a48ca308ba15475016a Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Mon, 5 Oct 2026 23:19:48 +0000
Subject: [PATCH 048/106] [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci
---
 spack-environment/ci/spack.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spack-environment/ci/spack.yaml b/spack-environment/ci/spack.yaml
index 7cab31c0b..3d380ea1c 100644
--- a/spack-environment/ci/spack.yaml
+++ b/spack-environment/ci/spack.yaml
@@ -9,7 +9,7 @@ spack:
   # Note that in definitions 'when' takes a python expression as argument
   # https://spack.readthedocs.io/en/latest/environments.html#spec-list-references
   - when: arch.satisfies("platform=linux")
-    linux_packages: 
+    linux_packages:
     - imagemagick
     - nopayloadclient
     - ollama

From 9de42a4ec37b6b94bb22134e9301fd73f20532da Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Mon, 5 Oct 2026 18:40:10 -0500
Subject: [PATCH 049/106] fix(ci): fetch spack-packages cherry-picks by SHA
 when missing locally

---
 .github/workflows/macos-ci.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 77e6d6dd7..9fbbe41de 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -120,6 +120,12 @@ jobs:
 
           # Apply cherry-picks from spack-packages.sh (match only valid git commit hashes)
           while read -r commit; do
+            # Commits on forks/unmerged PRs are not in the default clone, but
+            # GitHub serves any commit in the fork network by SHA from the parent
+            if ! git cat-file -e "${commit}^{commit}" 2>/dev/null; then
+              echo "Fetching ${commit} by SHA"
+              git fetch origin "${commit}"
+            fi
             if git merge-base --is-ancestor "${commit}" HEAD; then
               echo "Skipping already applied ${commit}"
               continue

From 639d277e0f06ec3747f2783f5efdc455764ccc06 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 9 Oct 2026 14:37:10 -0500
Subject: [PATCH 050/106] Update SPACK_CHERRYPICKS with new commit hash

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 spack.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/spack.sh b/spack.sh
index 0dcd622bb..f3406cd56 100644
--- a/spack.sh
+++ b/spack.sh
@@ -11,7 +11,7 @@ SPACK_VERSION="v1.2.2"
 read -r -d '' SPACK_CHERRYPICKS <<- \
 --- || true
 292b0dcaba3b2a5e3f9668d205d39fee2c715721
-678e506a95b319c573ba7e84703b06d7275ab80e
+473d1459fba532de0d3d7edc34d27b1432bc90cd
 0971885764f8d75ff838b4ab45f692a762888821
 ---
 ## Optional hash table with comma-separated file list
@@ -21,5 +21,5 @@ read -r -d '' SPACK_CHERRYPICKS_FILES <<- \
 ## Ref: https://github.com/spack/spack/commit/[hash]
 ## [hash]: [description]
 ## 292b0dcaba3b2a5e3f9668d205d39fee2c715721: fix: write created time field with OCI buildcache config
-## 678e506a95b319c573ba7e84703b06d7275ab80e: fix: don't map prefix to view root for pkgs excluded from view
+## 473d1459fba532de0d3d7edc34d27b1432bc90cd: fix: don't map prefix to view root for pkgs excluded from view
 ## 0971885764f8d75ff838b4ab45f692a762888821: lock.py: fall back to read-only open on EROFS

From bda77afade98645ba4b90ee91ad94f2de6084798 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 9 Oct 2026 14:39:07 -0500
Subject: [PATCH 051/106] fix(ci): fetch spack cherry-picks by SHA when missing
 locally

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 9fbbe41de..eb7e20873 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -91,6 +91,11 @@ jobs:
 
           # Apply cherry-picks from spack.sh (match only valid git commit hashes)
           while read -r commit; do
+            # Commits on branches/forks not fetched above are served by SHA
+            if ! git cat-file -e "${commit}^{commit}" 2>/dev/null; then
+              echo "Fetching ${commit} by SHA"
+              git fetch origin "${commit}"
+            fi
             if git merge-base --is-ancestor "${commit}" HEAD; then
               echo "Skipping already applied ${commit}"
               continue

From f734222b020392db3e1b66cc2d34876367362779 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 9 Oct 2026 15:03:10 -0500
Subject: [PATCH 052/106] fix(ci): move gfal2, graphviz, py-onnxruntime to
 linux-only; include $linux_packages in ci specs

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 spack-environment/ci/spack.yaml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/spack-environment/ci/spack.yaml b/spack-environment/ci/spack.yaml
index 3d380ea1c..be4c47af3 100644
--- a/spack-environment/ci/spack.yaml
+++ b/spack-environment/ci/spack.yaml
@@ -10,14 +10,19 @@ spack:
   # https://spack.readthedocs.io/en/latest/environments.html#spec-list-references
   - when: arch.satisfies("platform=linux")
     linux_packages:
+    - gfal2
+    - gfal2-util
+    - graphviz
     - imagemagick
     - nopayloadclient
     - ollama
     - py-numpy
+    - py-onnxruntime
     - py-scipy
   - when: arch.satisfies("platform=darwin")
     linux_packages: []
   specs:
+  - $linux_packages
   - acts
   - actsvg
   - afterburner
@@ -31,9 +36,6 @@ spack:
   - fjcontrib
   - fmt
   - geant4 -opengl
-  - gfal2
-  - gfal2-util
-  - graphviz
   - hepmc3
   - hepmcmerger
   - heppdt
@@ -70,7 +72,6 @@ spack:
   - py-mplhep
   - py-htgettoken
   - py-onnx
-  - py-onnxruntime
   - py-pandas
   - py-particle
   - py-pip

From 0ac72e8f197027a08cfb51516cd03abe072edffe Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 9 Oct 2026 15:32:35 -0500
Subject: [PATCH 053/106] fix(ci): make py-onnxruntime linux-only in tf;
 diagnose numpy import failures on macOS

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml  | 21 +++++++++++++++++++++
 spack-environment/tf/spack.yaml |  6 +++++-
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index eb7e20873..495d04608 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -194,3 +194,24 @@ jobs:
       - name: Install epic environment
         run: |
           spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install --no-check-signature --show-log-on-error
+
+      - name: Diagnose numpy import
+        if: failure()
+        continue-on-error: true
+        run: |
+          # Surface the real exception behind numpy's generic
+          # "should not import numpy from its source directory" message
+          for env in spack-environment/${{matrix.ENV}} spack-environment/${{matrix.ENV}}/epic; do
+            echo "::group::${env}"
+            spack -e "${env}" find -lpv py-numpy openblas || true
+            eval "$(spack -e "${env}" load --sh py-numpy)" || true
+            cd /tmp
+            which python3 || true
+            python3 -v -c 'import numpy' 2>&1 | tail -40 || true
+            python3 -c 'import numpy.version; print(numpy.version.version)' || true
+            for so in $(find "$(spack -e "${env}" location -i py-numpy)" -name '_multiarray_umath*.so' | head -1); do
+              otool -L "${so}" || true
+            done
+            cd - > /dev/null
+            echo "::endgroup::"
+          done
diff --git a/spack-environment/tf/spack.yaml b/spack-environment/tf/spack.yaml
index 6c24037a2..e95b7231e 100644
--- a/spack-environment/tf/spack.yaml
+++ b/spack-environment/tf/spack.yaml
@@ -9,8 +9,13 @@ spack:
     tensorflow: [py-tensorflow +cuda]
   - when: arch.satisfies("platform=darwin")
     tensorflow: [py-tensorflow ~cuda]
+  - when: arch.satisfies("platform=linux")
+    linux_packages: [py-onnxruntime]
+  - when: arch.satisfies("platform=darwin")
+    linux_packages: []
   specs:
   - $tensorflow
+  - $linux_packages
   - edm4hep
   - onnx
   - osg-ca-certs
@@ -40,7 +45,6 @@ spack:
   - py-numba
   - py-numpy
   - py-onnx
-  - py-onnxruntime
   - py-pandas
   - py-particle
   - py-pip

From 2ec30acee4fa4fbedc8779ecba97b149f9bfb2e0 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 9 Oct 2026 16:50:24 -0500
Subject: [PATCH 054/106] fix(ci): move non-macOS packages to linux-only in xl;
 fix numpy diagnostic step

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml  | 25 +++++++++++++++----------
 spack-environment/xl/spack.yaml | 32 +++++++++++++++++---------------
 2 files changed, 32 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 495d04608..17438405f 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -200,18 +200,23 @@ jobs:
         continue-on-error: true
         run: |
           # Surface the real exception behind numpy's generic
-          # "should not import numpy from its source directory" message
+          # "should not import numpy from its source directory" message,
+          # both in a plain loaded environment and in a package build environment
           for env in spack-environment/${{matrix.ENV}} spack-environment/${{matrix.ENV}}/epic; do
             echo "::group::${env}"
-            spack -e "${env}" find -lpv py-numpy openblas || true
-            eval "$(spack -e "${env}" load --sh py-numpy)" || true
-            cd /tmp
-            which python3 || true
-            python3 -v -c 'import numpy' 2>&1 | tail -40 || true
-            python3 -c 'import numpy.version; print(numpy.version.version)' || true
-            for so in $(find "$(spack -e "${env}" location -i py-numpy)" -name '_multiarray_umath*.so' | head -1); do
-              otool -L "${so}" || true
+            spack -e "${env}" -c view:false find -lpv py-numpy openblas || true
+            echo "--- loaded environment"
+            (
+              eval "$(spack -e "${env}" -c view:false load --sh py-numpy)"
+              cd /tmp
+              python3 -c 'import numpy; print(numpy.__version__, numpy.__file__)' 2>&1 | tail -30
+              so=$(find "$(spack -e "${env}" -c view:false location -i py-numpy)" -name '_multiarray_umath*.so' | head -1)
+              otool -L "${so}"
+            ) || true
+            echo "--- build environment of a failing dependent"
+            for pkg in py-scipy py-numexpr; do
+              spack -e "${env}" -c view:false build-env "${pkg}" -- \
+                python3 -c 'import sys, numpy; print(numpy.__file__)' 2>&1 | tail -40 || true
             done
-            cd - > /dev/null
             echo "::endgroup::"
           done
diff --git a/spack-environment/xl/spack.yaml b/spack-environment/xl/spack.yaml
index e70d6c253..0727be0f6 100644
--- a/spack-environment/xl/spack.yaml
+++ b/spack-environment/xl/spack.yaml
@@ -9,7 +9,23 @@ spack:
   # Note that in definitions 'when' takes a python expression as argument
   # https://spack.readthedocs.io/en/latest/environments.html#spec-list-references
   - when: arch.satisfies("platform=linux")
-    linux_packages: [strace, valgrind]
+    linux_packages:
+    - dawncut
+    - gdb
+    - gfal2
+    - gfal2-util
+    - graphviz
+    - herwig3
+    - imagemagick
+    - lcov
+    - madx
+    - mosquitto
+    - nopayloadclient
+    - ollama
+    - py-onnxruntime
+    - slurm sysconfdir=/etc/slurm
+    - strace
+    - valgrind
   - when: arch.satisfies("platform=darwin")
     linux_packages: []
   specs:
@@ -31,7 +47,6 @@ spack:
   - covfie
   - cppcoro
   - dawn
-  - dawncut
   - dd4hep
   - doxygen
   - dusk
@@ -49,36 +64,25 @@ spack:
   - fjcontrib
   - fmt
   - g4occt
-  - gdb
   - geant4 +opengl
-  - gfal2
-  - gfal2-util
   - github-copilot
-  - graphviz
   - hepmc3
   - hepmcmerger
   - heppdt
-  - herwig3
-  - imagemagick
   - irt
   - irt2
   - iwyu
   - jana2
   - just
   - lager
-  - lcov
   - lhapdf
   - lhapdfsets
   - libtool
   - lzo
-  - madx
-  - mosquitto
   - multitime
   - nano
   - ninja
-  - nopayloadclient
   - npsim
-  - ollama
   - onnx
   - opencascade
   - opencode
@@ -117,7 +121,6 @@ spack:
   - py-htgettoken
   - py-numpy
   - py-onnx
-  - py-onnxruntime
   - py-openpyxl
   - py-pandas
   - py-particle
@@ -145,7 +148,6 @@ spack:
   - timeframebuilder
   - sherpa
   - simsipm
-  - slurm sysconfdir=/etc/slurm
   - snakemake
   - spdlog
   - stow

From f9a80c1cb8e3bd5e6f54872069ebb3586ed03d70 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 9 Oct 2026 16:58:41 -0500
Subject: [PATCH 055/106] fix(ci): make macOS buildcache read-only outside
 trusted contexts; fetch full spack-packages history

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 17438405f..1d7cc3fbd 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -109,6 +109,7 @@ jobs:
         with:
           repository: spack/spack-packages
           path: spack/var/spack/repos/spack-packages
+          fetch-depth: 0
           ref: ${{ steps.spack-config.outputs.spackpackages-version }}
 
       - name: Configure spack-packages
@@ -172,12 +173,23 @@ jobs:
           spack external find --scope site llvm
 
       - name: Configure buildcache
+        env:
+          # Only push to the buildcache from trusted contexts: pushes to
+          # master, manual runs, and PRs from this repository. PRs from forks
+          # get no secrets and only read from the (public) buildcache.
+          PUSH_BUILDCACHE: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
         run: |
-          spack mirror add --scope site eic \
-            --autopush --unsigned \
-            --oci-username-variable GITHUB_REGISTRY_USER \
-            --oci-password-variable GITHUB_REGISTRY_TOKEN \
-            oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
+          mirror=oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
+          if [ "${PUSH_BUILDCACHE}" = "true" ] && [ -n "${GITHUB_REGISTRY_TOKEN}" ]; then
+            spack mirror add --scope site eic \
+              --autopush --unsigned \
+              --oci-username-variable GITHUB_REGISTRY_USER \
+              --oci-password-variable GITHUB_REGISTRY_TOKEN \
+              "${mirror}"
+          else
+            echo "Buildcache is read-only for this run"
+            spack mirror add --scope site eic --unsigned "${mirror}"
+          fi
 
       - name: Concretize base environment
         run: |

From eda8473b34217ed21c55756027a7b29336e3a465 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 9 Oct 2026 18:27:54 -0500
Subject: [PATCH 056/106] fix(spack): restore Linux packages.yaml; move macOS
 overrides to packages_darwin.yaml

Conditional (when: platform=linux) requirements on the virtual packages
c, cxx and fortran were not applied on Linux, so Linux builds silently
switched from gcc to clang. Restore the unconditional settings from
master and put the macOS overrides in a darwin-only include scope.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 spack-environment/ci/epic/spack.yaml   |  2 +
 spack-environment/ci/spack.yaml        |  4 +-
 spack-environment/packages.yaml        | 62 ++++++--------------------
 spack-environment/packages_darwin.yaml | 38 ++++++++++++++++
 spack-environment/tf/epic/spack.yaml   |  2 +
 spack-environment/tf/spack.yaml        |  2 +
 spack-environment/xl/epic/spack.yaml   |  2 +
 spack-environment/xl/spack.yaml        |  4 +-
 8 files changed, 66 insertions(+), 50 deletions(-)
 create mode 100644 spack-environment/packages_darwin.yaml

diff --git a/spack-environment/ci/epic/spack.yaml b/spack-environment/ci/epic/spack.yaml
index b06813bb4..d5a5607b5 100644
--- a/spack-environment/ci/epic/spack.yaml
+++ b/spack-environment/ci/epic/spack.yaml
@@ -3,6 +3,8 @@ spack:
   - ../spack.lock
   - ../../concretizer.yaml
   - ../../config.yaml
+  - path: ../../packages_darwin.yaml
+    when: platform == "darwin"
   - ../../packages.yaml
   - ../../view.yaml
   packages:
diff --git a/spack-environment/ci/spack.yaml b/spack-environment/ci/spack.yaml
index be4c47af3..f6942d2bb 100644
--- a/spack-environment/ci/spack.yaml
+++ b/spack-environment/ci/spack.yaml
@@ -2,8 +2,10 @@ spack:
   include:
   - ../concretizer.yaml
   - ../config.yaml
-  - ../packages.yaml
   - ../packages_root_without_opengl.yaml
+  - path: ../packages_darwin.yaml
+    when: platform == "darwin"
+  - ../packages.yaml
   - ../view.yaml
   definitions:
   # Note that in definitions 'when' takes a python expression as argument
diff --git a/spack-environment/packages.yaml b/spack-environment/packages.yaml
index 393fed4f7..4f0f8bb8e 100644
--- a/spack-environment/packages.yaml
+++ b/spack-environment/packages.yaml
@@ -60,7 +60,7 @@ packages:
     - +brotli +bz2 +dataset +filesystem +glog +ipc +jemalloc +lz4 +parquet +snappy +zlib +zstd
   binutils:
     require:
-    - '@2.44:'
+    - ~gold
   blas:
     require:
     - openblas
@@ -73,26 +73,14 @@ packages:
     - cxxstd=20
   c:
     prefer:
-    - spec: gcc
-      when: platform=linux
-    - spec: apple-clang
-      when: platform=darwin
-    require:
-    - spec: gcc
-      when: platform=linux
-    - spec: apple-clang
-      when: platform=darwin
+    - gcc
+    require:
+    - gcc
   cxx:
     prefer:
-    - spec: gcc
-      when: platform=linux
-    - spec: apple-clang
-      when: platform=darwin
-    require:
-    - spec: gcc
-      when: platform=linux
-    - spec: apple-clang
-      when: platform=darwin
+    - gcc
+    require:
+    - gcc
   cairo:
     require:
     - '@1.18.2:'
@@ -223,15 +211,9 @@ packages:
     - +shared cxxstd=20
   fortran:
     prefer:
-    - spec: gcc
-      when: platform=linux
-    - spec: gcc
-      when: platform=darwin
-    require:
-    - spec: gcc
-      when: platform=linux
-    - spec: gcc
-      when: platform=darwin
+    - gcc
+    require:
+    - gcc
   freetype:
     require:
     - build_system=autotools
@@ -275,13 +257,7 @@ packages:
     require:
     - '@11.4.1.east'
     - cxxstd=20 -vecgeom +threads -vtk
-    - any_of: [+opengl +qt, -opengl -qt]
-    - spec: ~x11
-      when: ~opengl platform=linux
-    - spec: +x11
-      when: +opengl platform=linux
-    - spec: ~x11
-      when: platform=darwin
+    - any_of: [+opengl +qt +x11, -opengl -qt -x11]
   geant4-data:
     require:
     - +nudexlib +tendl +urrpt
@@ -296,16 +272,10 @@ packages:
     - ~gtk
   gl:
     require:
-    - spec: glx
-      when: platform=linux
-    - spec: apple-gl
-      when: platform=darwin
+    - glx
   glu:
     require:
-    - spec: openglu
-      when: platform=linux
-    - spec: apple-glu
-      when: platform=darwin
+    - openglu
   gloo:
     require:
     - '@2023-12-03'
@@ -701,12 +671,8 @@ packages:
   root:
     require:
     - '@6.40.04'
-    - cxxstd=20 +fftw +fortran +gdml +http -ipo +mlp +python +root7 +tmva +tmva-sofie +xrootd +ssl
+    - cxxstd=20 +fftw +fortran +gdml +http -ipo +mlp +python +root7 +tmva +tmva-sofie +x +xrootd +ssl
     - any_of: [+opengl +webgui, -opengl -webgui]
-    - spec: +x
-      when: platform=linux
-    - spec: ~x
-      when: platform=darwin
   rucio-eic-mcp-server:
     require:
     - '@=0.2.0'
diff --git a/spack-environment/packages_darwin.yaml b/spack-environment/packages_darwin.yaml
new file mode 100644
index 000000000..39b2d13f9
--- /dev/null
+++ b/spack-environment/packages_darwin.yaml
@@ -0,0 +1,38 @@
+# macOS overrides for packages.yaml, included only on darwin via
+#   - path: ../packages_darwin.yaml
+#     when: platform == "darwin"
+# This scope must be listed after any packages_root_*.yaml and before
+# packages.yaml, so that `::` replaces the Linux settings of packages.yaml
+# but keeps the lists from the more specific includes.
+packages:
+  binutils:
+    require::
+    - '@2.44:'
+  c:
+    prefer::
+    - apple-clang
+    require::
+    - apple-clang
+  cxx:
+    prefer::
+    - apple-clang
+    require::
+    - apple-clang
+  geant4:
+    require::
+    - '@11.4.1.east'
+    - cxxstd=20 -vecgeom +threads -vtk
+    - any_of: [+opengl +qt, -opengl -qt]
+    - ~x11
+  gl:
+    require::
+    - apple-gl
+  glu:
+    require::
+    - apple-glu
+  root:
+    require::
+    - '@6.40.04'
+    - cxxstd=20 +fftw +fortran +gdml +http -ipo +mlp +python +root7 +tmva +tmva-sofie +xrootd +ssl
+    - any_of: [+opengl +webgui, -opengl -webgui]
+    - ~x
diff --git a/spack-environment/tf/epic/spack.yaml b/spack-environment/tf/epic/spack.yaml
index 180cd3abb..7690005e5 100644
--- a/spack-environment/tf/epic/spack.yaml
+++ b/spack-environment/tf/epic/spack.yaml
@@ -3,6 +3,8 @@ spack:
   - ../spack.lock
   - ../../concretizer.yaml
   - ../../config.yaml
+  - path: ../../packages_darwin.yaml
+    when: platform == "darwin"
   - ../../packages.yaml
   - ../../view.yaml
   specs:
diff --git a/spack-environment/tf/spack.yaml b/spack-environment/tf/spack.yaml
index e95b7231e..923002ba2 100644
--- a/spack-environment/tf/spack.yaml
+++ b/spack-environment/tf/spack.yaml
@@ -2,6 +2,8 @@ spack:
   include:
   - ../concretizer.yaml
   - ../config.yaml
+  - path: ../packages_darwin.yaml
+    when: platform == "darwin"
   - ../packages.yaml
   - ../view.yaml
   definitions:
diff --git a/spack-environment/xl/epic/spack.yaml b/spack-environment/xl/epic/spack.yaml
index 4ed7e3636..5543e4a3b 100644
--- a/spack-environment/xl/epic/spack.yaml
+++ b/spack-environment/xl/epic/spack.yaml
@@ -3,6 +3,8 @@ spack:
   - ../spack.lock
   - ../../concretizer.yaml
   - ../../config.yaml
+  - path: ../../packages_darwin.yaml
+    when: platform == "darwin"
   - ../../packages.yaml
   - ../../view.yaml
   concretizer:
diff --git a/spack-environment/xl/spack.yaml b/spack-environment/xl/spack.yaml
index 0727be0f6..d1ad73624 100644
--- a/spack-environment/xl/spack.yaml
+++ b/spack-environment/xl/spack.yaml
@@ -2,8 +2,10 @@ spack:
   include:
   - ../concretizer.yaml
   - ../config.yaml
-  - ../packages.yaml
   - ../packages_root_with_opengl.yaml
+  - path: ../packages_darwin.yaml
+    when: platform == "darwin"
+  - ../packages.yaml
   - ../view.yaml
   definitions:
   # Note that in definitions 'when' takes a python expression as argument

From 3dcd0f0d036137eb5219e206d3620cfb6be13185 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 9 Oct 2026 18:31:01 -0500
Subject: [PATCH 057/106] refactor(spack): split platform-specific settings
 into packages_linux.yaml and packages_darwin.yaml

packages.yaml is now cross-platform. All environments include the
platform file matching the host via a conditional include.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 AGENTS.md                                     |  2 ++
 containers/eic/Dockerfile                     |  1 +
 docs/architecture.md                          |  1 +
 spack-environment/ci/epic/spack.yaml          |  2 ++
 spack-environment/ci/spack.yaml               |  2 ++
 .../ci_without_acts/epic/spack.yaml           |  4 +++
 spack-environment/ci_without_acts/spack.yaml  |  4 +++
 spack-environment/cuda/epic/spack.yaml        |  4 +++
 spack-environment/cuda/spack.yaml             |  4 +++
 spack-environment/cvmfs/epic/spack.yaml       |  4 +++
 spack-environment/cvmfs/spack.yaml            |  4 +++
 spack-environment/dbg/epic/spack.yaml         |  4 +++
 spack-environment/dbg/spack.yaml              |  4 +++
 spack-environment/jl/epic/spack.yaml          |  4 +++
 spack-environment/jl/spack.yaml               |  4 +++
 spack-environment/packages.yaml               | 22 +------------
 spack-environment/packages_darwin.yaml        | 30 +++++++----------
 spack-environment/packages_linux.yaml         | 33 +++++++++++++++++++
 spack-environment/prod/epic/spack.yaml        |  4 +++
 spack-environment/prod/spack.yaml             |  4 +++
 spack-environment/tf/epic/spack.yaml          |  2 ++
 spack-environment/tf/spack.yaml               |  2 ++
 spack-environment/xl/epic/spack.yaml          |  2 ++
 spack-environment/xl/spack.yaml               |  2 ++
 24 files changed, 110 insertions(+), 39 deletions(-)
 create mode 100644 spack-environment/packages_linux.yaml

diff --git a/AGENTS.md b/AGENTS.md
index bca7e2bdd..c2a71a60b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -61,6 +61,8 @@ All images support both `linux/amd64` and `linux/arm64` architectures through pa
 ├── spack-environment/          # Nine environments: ci, ci_without_acts,
 │   │                           # cuda, cvmfs, dbg, jl, prod, tf, xl
 │   ├── packages.yaml           # Package versions, variants, and preferences
+│   ├── packages_linux.yaml     # Linux-only settings (included when platform == "linux")
+│   ├── packages_darwin.yaml    # macOS-only settings (included when platform == "darwin")
 │   ├── <env>/spack.yaml        # Default spec list for that environment
 │   └── <env>/epic/spack.yaml   # Custom-version overlay (epic, eicrecon, ...)
 ├── spack.sh                    # Spack core version and cherry-picks
diff --git a/containers/eic/Dockerfile b/containers/eic/Dockerfile
index eff6b432f..6b999b703 100644
--- a/containers/eic/Dockerfile
+++ b/containers/eic/Dockerfile
@@ -248,6 +248,7 @@ COPY --from=builder_installation_custom \
   /opt/spack-environment/${ENV}/epic/
 COPY --from=builder_installation_custom \
   /opt/spack-environment/packages.yaml \
+  /opt/spack-environment/packages_linux.yaml \
   /opt/spack-environment/
 
 
diff --git a/docs/architecture.md b/docs/architecture.md
index 948d3546f..ff3703881 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -152,3 +152,4 @@ Package versions are controlled through several configuration files:
 | `key4hep-spack.sh` | Key4HEP-spack version |
 | `eic-spack.sh` | EIC-spack version |
 | `spack-environment/packages.yaml` | Package version preferences and variants |
+| `spack-environment/packages_linux.yaml`, `packages_darwin.yaml` | Platform-specific settings (compiler, GL, X11), included per platform |
diff --git a/spack-environment/ci/epic/spack.yaml b/spack-environment/ci/epic/spack.yaml
index d5a5607b5..f0f6d82a4 100644
--- a/spack-environment/ci/epic/spack.yaml
+++ b/spack-environment/ci/epic/spack.yaml
@@ -6,6 +6,8 @@ spack:
   - path: ../../packages_darwin.yaml
     when: platform == "darwin"
   - ../../packages.yaml
+  - path: ../../packages_linux.yaml
+    when: platform == "linux"
   - ../../view.yaml
   packages:
     geant4:
diff --git a/spack-environment/ci/spack.yaml b/spack-environment/ci/spack.yaml
index f6942d2bb..d42e611dd 100644
--- a/spack-environment/ci/spack.yaml
+++ b/spack-environment/ci/spack.yaml
@@ -6,6 +6,8 @@ spack:
   - path: ../packages_darwin.yaml
     when: platform == "darwin"
   - ../packages.yaml
+  - path: ../packages_linux.yaml
+    when: platform == "linux"
   - ../view.yaml
   definitions:
   # Note that in definitions 'when' takes a python expression as argument
diff --git a/spack-environment/ci_without_acts/epic/spack.yaml b/spack-environment/ci_without_acts/epic/spack.yaml
index 89dd0e3aa..0625311b6 100644
--- a/spack-environment/ci_without_acts/epic/spack.yaml
+++ b/spack-environment/ci_without_acts/epic/spack.yaml
@@ -4,6 +4,10 @@ spack:
   - ../../concretizer.yaml
   - ../../config.yaml
   - ../../packages.yaml
+  - path: ../../packages_darwin.yaml
+    when: platform == "darwin"
+  - path: ../../packages_linux.yaml
+    when: platform == "linux"
   - ../../view.yaml
   specs:
   - algorithms
diff --git a/spack-environment/ci_without_acts/spack.yaml b/spack-environment/ci_without_acts/spack.yaml
index 42667a53a..3e58e90d7 100644
--- a/spack-environment/ci_without_acts/spack.yaml
+++ b/spack-environment/ci_without_acts/spack.yaml
@@ -3,6 +3,10 @@ spack:
   - ../concretizer.yaml
   - ../config.yaml
   - ../packages.yaml
+  - path: ../packages_darwin.yaml
+    when: platform == "darwin"
+  - path: ../packages_linux.yaml
+    when: platform == "linux"
   - ../packages_root_without_opengl.yaml
   - ../view.yaml
   specs:
diff --git a/spack-environment/cuda/epic/spack.yaml b/spack-environment/cuda/epic/spack.yaml
index 9a9e89479..498cd7f25 100644
--- a/spack-environment/cuda/epic/spack.yaml
+++ b/spack-environment/cuda/epic/spack.yaml
@@ -4,6 +4,10 @@ spack:
   - ../../concretizer.yaml
   - ../../config.yaml
   - ../../packages.yaml
+  - path: ../../packages_darwin.yaml
+    when: platform == "darwin"
+  - path: ../../packages_linux.yaml
+    when: platform == "linux"
   - ../../view.yaml
   concretizer:
     unify: when_possible
diff --git a/spack-environment/cuda/spack.yaml b/spack-environment/cuda/spack.yaml
index bc6721d61..b2ad1c293 100644
--- a/spack-environment/cuda/spack.yaml
+++ b/spack-environment/cuda/spack.yaml
@@ -3,6 +3,10 @@ spack:
   - ../concretizer.yaml
   - ../config.yaml
   - ../packages.yaml
+  - path: ../packages_darwin.yaml
+    when: platform == "darwin"
+  - path: ../packages_linux.yaml
+    when: platform == "linux"
   - ../packages_root_with_opengl.yaml
   - ../view.yaml
   specs:
diff --git a/spack-environment/cvmfs/epic/spack.yaml b/spack-environment/cvmfs/epic/spack.yaml
index a96ce0e07..0e0881372 100644
--- a/spack-environment/cvmfs/epic/spack.yaml
+++ b/spack-environment/cvmfs/epic/spack.yaml
@@ -4,6 +4,10 @@ spack:
   - ../../concretizer.yaml
   - ../../config.yaml
   - ../../packages.yaml
+  - path: ../../packages_darwin.yaml
+    when: platform == "darwin"
+  - path: ../../packages_linux.yaml
+    when: platform == "linux"
   - ../../packages_cvmfs_geant4data.yaml
   - ../../view.yaml
   specs:
diff --git a/spack-environment/cvmfs/spack.yaml b/spack-environment/cvmfs/spack.yaml
index ff410c14e..02f93c076 100644
--- a/spack-environment/cvmfs/spack.yaml
+++ b/spack-environment/cvmfs/spack.yaml
@@ -3,6 +3,10 @@ spack:
   - ../concretizer.yaml
   - ../config.yaml
   - ../packages.yaml
+  - path: ../packages_darwin.yaml
+    when: platform == "darwin"
+  - path: ../packages_linux.yaml
+    when: platform == "linux"
   - ../packages_cvmfs_geant4data.yaml
   - ../packages_root_without_opengl.yaml
   - ../view.yaml
diff --git a/spack-environment/dbg/epic/spack.yaml b/spack-environment/dbg/epic/spack.yaml
index 26fe88789..61d6d426d 100644
--- a/spack-environment/dbg/epic/spack.yaml
+++ b/spack-environment/dbg/epic/spack.yaml
@@ -4,6 +4,10 @@ spack:
   - ../../concretizer.yaml
   - ../../config.yaml
   - ../../packages.yaml
+  - path: ../../packages_darwin.yaml
+    when: platform == "darwin"
+  - path: ../../packages_linux.yaml
+    when: platform == "linux"
   - ../../view.yaml
   specs:
   - algorithms build_type=Debug
diff --git a/spack-environment/dbg/spack.yaml b/spack-environment/dbg/spack.yaml
index b544d7fb3..712f779dc 100644
--- a/spack-environment/dbg/spack.yaml
+++ b/spack-environment/dbg/spack.yaml
@@ -3,6 +3,10 @@ spack:
   - ../concretizer.yaml
   - ../config.yaml
   - ../packages.yaml
+  - path: ../packages_darwin.yaml
+    when: platform == "darwin"
+  - path: ../packages_linux.yaml
+    when: platform == "linux"
   - ../packages_root_without_opengl.yaml
   - ../view.yaml
   specs:
diff --git a/spack-environment/jl/epic/spack.yaml b/spack-environment/jl/epic/spack.yaml
index a9309851b..91ec0e11c 100644
--- a/spack-environment/jl/epic/spack.yaml
+++ b/spack-environment/jl/epic/spack.yaml
@@ -4,6 +4,10 @@ spack:
   - ../../concretizer.yaml
   - ../../config.yaml
   - ../../packages.yaml
+  - path: ../../packages_darwin.yaml
+    when: platform == "darwin"
+  - path: ../../packages_linux.yaml
+    when: platform == "linux"
   - ../../view.yaml
   specs:
   - algorithms
diff --git a/spack-environment/jl/spack.yaml b/spack-environment/jl/spack.yaml
index d03e09fe4..6c5bd5fc2 100644
--- a/spack-environment/jl/spack.yaml
+++ b/spack-environment/jl/spack.yaml
@@ -3,6 +3,10 @@ spack:
   - ../concretizer.yaml
   - ../config.yaml
   - ../packages.yaml
+  - path: ../packages_darwin.yaml
+    when: platform == "darwin"
+  - path: ../packages_linux.yaml
+    when: platform == "linux"
   - ../packages_root_without_opengl.yaml
   - ../view.yaml
   concretizer:
diff --git a/spack-environment/packages.yaml b/spack-environment/packages.yaml
index 4f0f8bb8e..78cada7b7 100644
--- a/spack-environment/packages.yaml
+++ b/spack-environment/packages.yaml
@@ -58,9 +58,6 @@ packages:
     require:
     - '@22:'
     - +brotli +bz2 +dataset +filesystem +glog +ipc +jemalloc +lz4 +parquet +snappy +zlib +zstd
-  binutils:
-    require:
-    - ~gold
   blas:
     require:
     - openblas
@@ -71,16 +68,6 @@ packages:
     - +iostreams +locale +log +math +program_options +python +random +regex
     - +serialization +system +test +thread +timer +wave
     - cxxstd=20
-  c:
-    prefer:
-    - gcc
-    require:
-    - gcc
-  cxx:
-    prefer:
-    - gcc
-    require:
-    - gcc
   cairo:
     require:
     - '@1.18.2:'
@@ -257,7 +244,6 @@ packages:
     require:
     - '@11.4.1.east'
     - cxxstd=20 -vecgeom +threads -vtk
-    - any_of: [+opengl +qt +x11, -opengl -qt -x11]
   geant4-data:
     require:
     - +nudexlib +tendl +urrpt
@@ -270,12 +256,6 @@ packages:
   ghostscript:
     require:
     - ~gtk
-  gl:
-    require:
-    - glx
-  glu:
-    require:
-    - openglu
   gloo:
     require:
     - '@2023-12-03'
@@ -671,7 +651,7 @@ packages:
   root:
     require:
     - '@6.40.04'
-    - cxxstd=20 +fftw +fortran +gdml +http -ipo +mlp +python +root7 +tmva +tmva-sofie +x +xrootd +ssl
+    - cxxstd=20 +fftw +fortran +gdml +http -ipo +mlp +python +root7 +tmva +tmva-sofie +xrootd +ssl
     - any_of: [+opengl +webgui, -opengl -webgui]
   rucio-eic-mcp-server:
     require:
diff --git a/spack-environment/packages_darwin.yaml b/spack-environment/packages_darwin.yaml
index 39b2d13f9..88ba7bfaa 100644
--- a/spack-environment/packages_darwin.yaml
+++ b/spack-environment/packages_darwin.yaml
@@ -1,38 +1,32 @@
-# macOS overrides for packages.yaml, included only on darwin via
+# macOS-specific settings, complementing the cross-platform packages.yaml.
+# Included from the environments via
 #   - path: ../packages_darwin.yaml
 #     when: platform == "darwin"
-# This scope must be listed after any packages_root_*.yaml and before
-# packages.yaml, so that `::` replaces the Linux settings of packages.yaml
-# but keeps the lists from the more specific includes.
+# See packages_linux.yaml for the Linux counterpart.
 packages:
   binutils:
-    require::
+    require:
     - '@2.44:'
   c:
-    prefer::
+    prefer:
     - apple-clang
-    require::
+    require:
     - apple-clang
   cxx:
-    prefer::
+    prefer:
     - apple-clang
-    require::
+    require:
     - apple-clang
   geant4:
-    require::
-    - '@11.4.1.east'
-    - cxxstd=20 -vecgeom +threads -vtk
+    require:
     - any_of: [+opengl +qt, -opengl -qt]
     - ~x11
   gl:
-    require::
+    require:
     - apple-gl
   glu:
-    require::
+    require:
     - apple-glu
   root:
-    require::
-    - '@6.40.04'
-    - cxxstd=20 +fftw +fortran +gdml +http -ipo +mlp +python +root7 +tmva +tmva-sofie +xrootd +ssl
-    - any_of: [+opengl +webgui, -opengl -webgui]
+    require:
     - ~x
diff --git a/spack-environment/packages_linux.yaml b/spack-environment/packages_linux.yaml
new file mode 100644
index 000000000..25f6457f4
--- /dev/null
+++ b/spack-environment/packages_linux.yaml
@@ -0,0 +1,33 @@
+# Linux-specific settings, complementing the cross-platform packages.yaml.
+# Included from the environments via
+#   - path: ../packages_linux.yaml
+#     when: platform == "linux"
+# See packages_darwin.yaml for the macOS counterpart. Do not use `when:` on
+# the virtual packages (c, cxx, ...) here: such conditional requirements are
+# not applied, which silently switches the compiler.
+packages:
+  binutils:
+    require:
+    - ~gold
+  c:
+    prefer:
+    - gcc
+    require:
+    - gcc
+  cxx:
+    prefer:
+    - gcc
+    require:
+    - gcc
+  geant4:
+    require:
+    - any_of: [+opengl +qt +x11, -opengl -qt -x11]
+  gl:
+    require:
+    - glx
+  glu:
+    require:
+    - openglu
+  root:
+    require:
+    - +x
diff --git a/spack-environment/prod/epic/spack.yaml b/spack-environment/prod/epic/spack.yaml
index a9309851b..91ec0e11c 100644
--- a/spack-environment/prod/epic/spack.yaml
+++ b/spack-environment/prod/epic/spack.yaml
@@ -4,6 +4,10 @@ spack:
   - ../../concretizer.yaml
   - ../../config.yaml
   - ../../packages.yaml
+  - path: ../../packages_darwin.yaml
+    when: platform == "darwin"
+  - path: ../../packages_linux.yaml
+    when: platform == "linux"
   - ../../view.yaml
   specs:
   - algorithms
diff --git a/spack-environment/prod/spack.yaml b/spack-environment/prod/spack.yaml
index 6a949a669..3da94513a 100644
--- a/spack-environment/prod/spack.yaml
+++ b/spack-environment/prod/spack.yaml
@@ -3,6 +3,10 @@ spack:
   - ../concretizer.yaml
   - ../config.yaml
   - ../packages.yaml
+  - path: ../packages_darwin.yaml
+    when: platform == "darwin"
+  - path: ../packages_linux.yaml
+    when: platform == "linux"
   - ../packages_root_without_opengl.yaml
   - ../view.yaml
   specs:
diff --git a/spack-environment/tf/epic/spack.yaml b/spack-environment/tf/epic/spack.yaml
index 7690005e5..7a2824984 100644
--- a/spack-environment/tf/epic/spack.yaml
+++ b/spack-environment/tf/epic/spack.yaml
@@ -6,6 +6,8 @@ spack:
   - path: ../../packages_darwin.yaml
     when: platform == "darwin"
   - ../../packages.yaml
+  - path: ../../packages_linux.yaml
+    when: platform == "linux"
   - ../../view.yaml
   specs:
   - edm4eic
diff --git a/spack-environment/tf/spack.yaml b/spack-environment/tf/spack.yaml
index 923002ba2..cd9908981 100644
--- a/spack-environment/tf/spack.yaml
+++ b/spack-environment/tf/spack.yaml
@@ -5,6 +5,8 @@ spack:
   - path: ../packages_darwin.yaml
     when: platform == "darwin"
   - ../packages.yaml
+  - path: ../packages_linux.yaml
+    when: platform == "linux"
   - ../view.yaml
   definitions:
   - when: arch.satisfies("platform=linux")
diff --git a/spack-environment/xl/epic/spack.yaml b/spack-environment/xl/epic/spack.yaml
index 5543e4a3b..ad5bc96c9 100644
--- a/spack-environment/xl/epic/spack.yaml
+++ b/spack-environment/xl/epic/spack.yaml
@@ -6,6 +6,8 @@ spack:
   - path: ../../packages_darwin.yaml
     when: platform == "darwin"
   - ../../packages.yaml
+  - path: ../../packages_linux.yaml
+    when: platform == "linux"
   - ../../view.yaml
   concretizer:
     unify: when_possible
diff --git a/spack-environment/xl/spack.yaml b/spack-environment/xl/spack.yaml
index d1ad73624..2587c9245 100644
--- a/spack-environment/xl/spack.yaml
+++ b/spack-environment/xl/spack.yaml
@@ -6,6 +6,8 @@ spack:
   - path: ../packages_darwin.yaml
     when: platform == "darwin"
   - ../packages.yaml
+  - path: ../packages_linux.yaml
+    when: platform == "linux"
   - ../view.yaml
   definitions:
   # Note that in definitions 'when' takes a python expression as argument

From 65b46a6de09d0621b1a4c32690fd878d7f4c34f2 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 9 Oct 2026 18:47:16 -0500
Subject: [PATCH 058/106] refactor(spack): list packages.yaml last in
 environment includes

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 spack-environment/ci/epic/spack.yaml              | 2 +-
 spack-environment/ci/spack.yaml                   | 2 +-
 spack-environment/ci_without_acts/epic/spack.yaml | 2 +-
 spack-environment/ci_without_acts/spack.yaml      | 2 +-
 spack-environment/cuda/epic/spack.yaml            | 2 +-
 spack-environment/cuda/spack.yaml                 | 2 +-
 spack-environment/cvmfs/epic/spack.yaml           | 2 +-
 spack-environment/cvmfs/spack.yaml                | 2 +-
 spack-environment/dbg/epic/spack.yaml             | 2 +-
 spack-environment/dbg/spack.yaml                  | 2 +-
 spack-environment/jl/epic/spack.yaml              | 2 +-
 spack-environment/jl/spack.yaml                   | 2 +-
 spack-environment/prod/epic/spack.yaml            | 2 +-
 spack-environment/prod/spack.yaml                 | 2 +-
 spack-environment/tf/epic/spack.yaml              | 2 +-
 spack-environment/tf/spack.yaml                   | 2 +-
 spack-environment/xl/epic/spack.yaml              | 2 +-
 spack-environment/xl/spack.yaml                   | 2 +-
 18 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/spack-environment/ci/epic/spack.yaml b/spack-environment/ci/epic/spack.yaml
index f0f6d82a4..29779dbfe 100644
--- a/spack-environment/ci/epic/spack.yaml
+++ b/spack-environment/ci/epic/spack.yaml
@@ -5,10 +5,10 @@ spack:
   - ../../config.yaml
   - path: ../../packages_darwin.yaml
     when: platform == "darwin"
-  - ../../packages.yaml
   - path: ../../packages_linux.yaml
     when: platform == "linux"
   - ../../view.yaml
+  - ../../packages.yaml
   packages:
     geant4:
       require:
diff --git a/spack-environment/ci/spack.yaml b/spack-environment/ci/spack.yaml
index d42e611dd..fc95eb872 100644
--- a/spack-environment/ci/spack.yaml
+++ b/spack-environment/ci/spack.yaml
@@ -5,10 +5,10 @@ spack:
   - ../packages_root_without_opengl.yaml
   - path: ../packages_darwin.yaml
     when: platform == "darwin"
-  - ../packages.yaml
   - path: ../packages_linux.yaml
     when: platform == "linux"
   - ../view.yaml
+  - ../packages.yaml
   definitions:
   # Note that in definitions 'when' takes a python expression as argument
   # https://spack.readthedocs.io/en/latest/environments.html#spec-list-references
diff --git a/spack-environment/ci_without_acts/epic/spack.yaml b/spack-environment/ci_without_acts/epic/spack.yaml
index 0625311b6..21c74ff17 100644
--- a/spack-environment/ci_without_acts/epic/spack.yaml
+++ b/spack-environment/ci_without_acts/epic/spack.yaml
@@ -3,12 +3,12 @@ spack:
   - ../spack.lock
   - ../../concretizer.yaml
   - ../../config.yaml
-  - ../../packages.yaml
   - path: ../../packages_darwin.yaml
     when: platform == "darwin"
   - path: ../../packages_linux.yaml
     when: platform == "linux"
   - ../../view.yaml
+  - ../../packages.yaml
   specs:
   - algorithms
   - edm4eic
diff --git a/spack-environment/ci_without_acts/spack.yaml b/spack-environment/ci_without_acts/spack.yaml
index 3e58e90d7..659c46afe 100644
--- a/spack-environment/ci_without_acts/spack.yaml
+++ b/spack-environment/ci_without_acts/spack.yaml
@@ -2,13 +2,13 @@ spack:
   include:
   - ../concretizer.yaml
   - ../config.yaml
-  - ../packages.yaml
   - path: ../packages_darwin.yaml
     when: platform == "darwin"
   - path: ../packages_linux.yaml
     when: platform == "linux"
   - ../packages_root_without_opengl.yaml
   - ../view.yaml
+  - ../packages.yaml
   specs:
   - actsvg
   - afterburner
diff --git a/spack-environment/cuda/epic/spack.yaml b/spack-environment/cuda/epic/spack.yaml
index 498cd7f25..8bf64e042 100644
--- a/spack-environment/cuda/epic/spack.yaml
+++ b/spack-environment/cuda/epic/spack.yaml
@@ -3,12 +3,12 @@ spack:
   - ../spack.lock
   - ../../concretizer.yaml
   - ../../config.yaml
-  - ../../packages.yaml
   - path: ../../packages_darwin.yaml
     when: platform == "darwin"
   - path: ../../packages_linux.yaml
     when: platform == "linux"
   - ../../view.yaml
+  - ../../packages.yaml
   concretizer:
     unify: when_possible
     duplicates:
diff --git a/spack-environment/cuda/spack.yaml b/spack-environment/cuda/spack.yaml
index b2ad1c293..ab51abd50 100644
--- a/spack-environment/cuda/spack.yaml
+++ b/spack-environment/cuda/spack.yaml
@@ -2,13 +2,13 @@ spack:
   include:
   - ../concretizer.yaml
   - ../config.yaml
-  - ../packages.yaml
   - path: ../packages_darwin.yaml
     when: platform == "darwin"
   - path: ../packages_linux.yaml
     when: platform == "linux"
   - ../packages_root_with_opengl.yaml
   - ../view.yaml
+  - ../packages.yaml
   specs:
   - acts +cuda
   - actsvg
diff --git a/spack-environment/cvmfs/epic/spack.yaml b/spack-environment/cvmfs/epic/spack.yaml
index 0e0881372..ed69ca9c4 100644
--- a/spack-environment/cvmfs/epic/spack.yaml
+++ b/spack-environment/cvmfs/epic/spack.yaml
@@ -3,13 +3,13 @@ spack:
   - ../spack.lock
   - ../../concretizer.yaml
   - ../../config.yaml
-  - ../../packages.yaml
   - path: ../../packages_darwin.yaml
     when: platform == "darwin"
   - path: ../../packages_linux.yaml
     when: platform == "linux"
   - ../../packages_cvmfs_geant4data.yaml
   - ../../view.yaml
+  - ../../packages.yaml
   specs:
   - algorithms
   - edm4eic
diff --git a/spack-environment/cvmfs/spack.yaml b/spack-environment/cvmfs/spack.yaml
index 02f93c076..82fb5e83e 100644
--- a/spack-environment/cvmfs/spack.yaml
+++ b/spack-environment/cvmfs/spack.yaml
@@ -2,7 +2,6 @@ spack:
   include:
   - ../concretizer.yaml
   - ../config.yaml
-  - ../packages.yaml
   - path: ../packages_darwin.yaml
     when: platform == "darwin"
   - path: ../packages_linux.yaml
@@ -10,6 +9,7 @@ spack:
   - ../packages_cvmfs_geant4data.yaml
   - ../packages_root_without_opengl.yaml
   - ../view.yaml
+  - ../packages.yaml
   specs:
   - acts
   - actsvg
diff --git a/spack-environment/dbg/epic/spack.yaml b/spack-environment/dbg/epic/spack.yaml
index 61d6d426d..37c1dcbe5 100644
--- a/spack-environment/dbg/epic/spack.yaml
+++ b/spack-environment/dbg/epic/spack.yaml
@@ -3,12 +3,12 @@ spack:
   - ../spack.lock
   - ../../concretizer.yaml
   - ../../config.yaml
-  - ../../packages.yaml
   - path: ../../packages_darwin.yaml
     when: platform == "darwin"
   - path: ../../packages_linux.yaml
     when: platform == "linux"
   - ../../view.yaml
+  - ../../packages.yaml
   specs:
   - algorithms build_type=Debug
   - edm4eic build_type=Debug
diff --git a/spack-environment/dbg/spack.yaml b/spack-environment/dbg/spack.yaml
index 712f779dc..dc7f6d0b5 100644
--- a/spack-environment/dbg/spack.yaml
+++ b/spack-environment/dbg/spack.yaml
@@ -2,13 +2,13 @@ spack:
   include:
   - ../concretizer.yaml
   - ../config.yaml
-  - ../packages.yaml
   - path: ../packages_darwin.yaml
     when: platform == "darwin"
   - path: ../packages_linux.yaml
     when: platform == "linux"
   - ../packages_root_without_opengl.yaml
   - ../view.yaml
+  - ../packages.yaml
   specs:
   - acts build_type=Debug
   - cmake
diff --git a/spack-environment/jl/epic/spack.yaml b/spack-environment/jl/epic/spack.yaml
index 91ec0e11c..ade6a5d0d 100644
--- a/spack-environment/jl/epic/spack.yaml
+++ b/spack-environment/jl/epic/spack.yaml
@@ -3,12 +3,12 @@ spack:
   - ../spack.lock
   - ../../concretizer.yaml
   - ../../config.yaml
-  - ../../packages.yaml
   - path: ../../packages_darwin.yaml
     when: platform == "darwin"
   - path: ../../packages_linux.yaml
     when: platform == "linux"
   - ../../view.yaml
+  - ../../packages.yaml
   specs:
   - algorithms
   - edm4eic
diff --git a/spack-environment/jl/spack.yaml b/spack-environment/jl/spack.yaml
index 6c5bd5fc2..e682a1ce9 100644
--- a/spack-environment/jl/spack.yaml
+++ b/spack-environment/jl/spack.yaml
@@ -2,13 +2,13 @@ spack:
   include:
   - ../concretizer.yaml
   - ../config.yaml
-  - ../packages.yaml
   - path: ../packages_darwin.yaml
     when: platform == "darwin"
   - path: ../packages_linux.yaml
     when: platform == "linux"
   - ../packages_root_without_opengl.yaml
   - ../view.yaml
+  - ../packages.yaml
   concretizer:
     duplicates:
       max_dupes:
diff --git a/spack-environment/prod/epic/spack.yaml b/spack-environment/prod/epic/spack.yaml
index 91ec0e11c..ade6a5d0d 100644
--- a/spack-environment/prod/epic/spack.yaml
+++ b/spack-environment/prod/epic/spack.yaml
@@ -3,12 +3,12 @@ spack:
   - ../spack.lock
   - ../../concretizer.yaml
   - ../../config.yaml
-  - ../../packages.yaml
   - path: ../../packages_darwin.yaml
     when: platform == "darwin"
   - path: ../../packages_linux.yaml
     when: platform == "linux"
   - ../../view.yaml
+  - ../../packages.yaml
   specs:
   - algorithms
   - edm4eic
diff --git a/spack-environment/prod/spack.yaml b/spack-environment/prod/spack.yaml
index 3da94513a..1f0dbc155 100644
--- a/spack-environment/prod/spack.yaml
+++ b/spack-environment/prod/spack.yaml
@@ -2,13 +2,13 @@ spack:
   include:
   - ../concretizer.yaml
   - ../config.yaml
-  - ../packages.yaml
   - path: ../packages_darwin.yaml
     when: platform == "darwin"
   - path: ../packages_linux.yaml
     when: platform == "linux"
   - ../packages_root_without_opengl.yaml
   - ../view.yaml
+  - ../packages.yaml
   specs:
   - acts
   - dd4hep
diff --git a/spack-environment/tf/epic/spack.yaml b/spack-environment/tf/epic/spack.yaml
index 7a2824984..0e5179f77 100644
--- a/spack-environment/tf/epic/spack.yaml
+++ b/spack-environment/tf/epic/spack.yaml
@@ -5,9 +5,9 @@ spack:
   - ../../config.yaml
   - path: ../../packages_darwin.yaml
     when: platform == "darwin"
-  - ../../packages.yaml
   - path: ../../packages_linux.yaml
     when: platform == "linux"
   - ../../view.yaml
+  - ../../packages.yaml
   specs:
   - edm4eic
diff --git a/spack-environment/tf/spack.yaml b/spack-environment/tf/spack.yaml
index cd9908981..96dfb05f6 100644
--- a/spack-environment/tf/spack.yaml
+++ b/spack-environment/tf/spack.yaml
@@ -4,10 +4,10 @@ spack:
   - ../config.yaml
   - path: ../packages_darwin.yaml
     when: platform == "darwin"
-  - ../packages.yaml
   - path: ../packages_linux.yaml
     when: platform == "linux"
   - ../view.yaml
+  - ../packages.yaml
   definitions:
   - when: arch.satisfies("platform=linux")
     tensorflow: [py-tensorflow +cuda]
diff --git a/spack-environment/xl/epic/spack.yaml b/spack-environment/xl/epic/spack.yaml
index ad5bc96c9..8accd5cbd 100644
--- a/spack-environment/xl/epic/spack.yaml
+++ b/spack-environment/xl/epic/spack.yaml
@@ -5,10 +5,10 @@ spack:
   - ../../config.yaml
   - path: ../../packages_darwin.yaml
     when: platform == "darwin"
-  - ../../packages.yaml
   - path: ../../packages_linux.yaml
     when: platform == "linux"
   - ../../view.yaml
+  - ../../packages.yaml
   concretizer:
     unify: when_possible
     duplicates:
diff --git a/spack-environment/xl/spack.yaml b/spack-environment/xl/spack.yaml
index 2587c9245..cecad2417 100644
--- a/spack-environment/xl/spack.yaml
+++ b/spack-environment/xl/spack.yaml
@@ -5,10 +5,10 @@ spack:
   - ../packages_root_with_opengl.yaml
   - path: ../packages_darwin.yaml
     when: platform == "darwin"
-  - ../packages.yaml
   - path: ../packages_linux.yaml
     when: platform == "linux"
   - ../view.yaml
+  - ../packages.yaml
   definitions:
   # Note that in definitions 'when' takes a python expression as argument
   # https://spack.readthedocs.io/en/latest/environments.html#spec-list-references

From 8b754775943dec5bc18b1492f1577e85ec9e78ac Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 9 Oct 2026 22:39:00 -0500
Subject: [PATCH 059/106] fix(spack): build binutils on macOS with -include
 limits.h

binutils 2.46.1 libiberty/fibheap.c uses LONG_MIN without <limits.h>,
which Apple clang 21 no longer provides implicitly.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 spack-environment/packages_darwin.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/spack-environment/packages_darwin.yaml b/spack-environment/packages_darwin.yaml
index 88ba7bfaa..4c795c39e 100644
--- a/spack-environment/packages_darwin.yaml
+++ b/spack-environment/packages_darwin.yaml
@@ -7,6 +7,9 @@ packages:
   binutils:
     require:
     - '@2.44:'
+    # libiberty/fibheap.c uses LONG_MIN without including <limits.h>, which
+    # newer Apple clang (21+) no longer provides implicitly
+    - cflags="-include limits.h"
   c:
     prefer:
     - apple-clang

From 72a67b1f379ae6c97efb56dfa8a6da1eb6717e01 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 9 Oct 2026 22:55:52 -0500
Subject: [PATCH 060/106] fix(spack): build tf environment without TensorFlow
 stack on macOS

py-tensorflow fails on macOS when bazel fetches llvm-raw (archive
checksum mismatch); py-keras (backend=tensorflow) and py-tf2onnx depend on it.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 spack-environment/tf/spack.yaml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/spack-environment/tf/spack.yaml b/spack-environment/tf/spack.yaml
index 96dfb05f6..b4043e755 100644
--- a/spack-environment/tf/spack.yaml
+++ b/spack-environment/tf/spack.yaml
@@ -12,9 +12,9 @@ spack:
   - when: arch.satisfies("platform=linux")
     tensorflow: [py-tensorflow +cuda]
   - when: arch.satisfies("platform=darwin")
-    tensorflow: [py-tensorflow ~cuda]
+    tensorflow: []
   - when: arch.satisfies("platform=linux")
-    linux_packages: [py-onnxruntime]
+    linux_packages: [py-keras, py-onnxruntime, py-tf2onnx]
   - when: arch.satisfies("platform=darwin")
     linux_packages: []
   specs:
@@ -40,7 +40,6 @@ spack:
   - py-jinja2-cli
   - py-jupyter-console
   - py-jupyterlab
-  - py-keras
   - py-lmfit
   - py-lxml
   - py-matplotlib
@@ -56,7 +55,6 @@ spack:
   - py-rucio-clients
   - py-scipy
   - py-seaborn
-  - py-tf2onnx
   - py-toml
   - py-uproot
   - py-vector

From 717aaa7a0184be5bf28686c1b3843d56c4a2f9ba Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 10 Oct 2026 08:47:13 -0500
Subject: [PATCH 061/106] fix(spack): more macOS build fixes (binutils flags,
 doxygen ~graphviz, generators Linux-only, writable views)

- binutils: also add -include unistd.h and demote implicit declarations
- doxygen: +graphviz only on Linux (graphviz needs pangoft2)
- xl: estarlight, lager, sherpa Linux-only (-Werror, HepMC3 link, libc++)
- workflow: create writable /opt/local and /opt/detector for the epic env views

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml         | 8 ++++++++
 spack-environment/packages.yaml        | 3 ---
 spack-environment/packages_darwin.yaml | 9 ++++++---
 spack-environment/packages_linux.yaml  | 3 +++
 spack-environment/xl/spack.yaml        | 6 +++---
 5 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 1d7cc3fbd..4226cf047 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -191,6 +191,14 @@ jobs:
             spack mirror add --scope site eic --unsigned "${mirror}"
           fi
 
+      - name: Create view directories
+        run: |
+          # The environments' views (view.yaml) live under /opt, which is
+          # not writable by default on macOS runners; the epic environment
+          # updates them even with -c view:false
+          sudo mkdir -p /opt/local /opt/detector
+          sudo chown "$(id -u):$(id -g)" /opt/local /opt/detector
+
       - name: Concretize base environment
         run: |
           spack -e spack-environment/${{matrix.ENV}} -c view:false concretize --force
diff --git a/spack-environment/packages.yaml b/spack-environment/packages.yaml
index 78cada7b7..d75fa0902 100644
--- a/spack-environment/packages.yaml
+++ b/spack-environment/packages.yaml
@@ -123,9 +123,6 @@ packages:
     - '@1.38'
     - +ddg4 +ddcad +edm4hep +g4hepem +hepmc3 +xercesc
     - any_of: [+ddeve +utilityapps, -ddeve -utilityapps] # FIXME ^root +x +opengl when +utilityapps
-  doxygen:
-    require:
-    - +graphviz
   dpmjet:
     require:
     - '@19.3.5'
diff --git a/spack-environment/packages_darwin.yaml b/spack-environment/packages_darwin.yaml
index 4c795c39e..7fd58329d 100644
--- a/spack-environment/packages_darwin.yaml
+++ b/spack-environment/packages_darwin.yaml
@@ -7,9 +7,12 @@ packages:
   binutils:
     require:
     - '@2.44:'
-    # libiberty/fibheap.c uses LONG_MIN without including <limits.h>, which
-    # newer Apple clang (21+) no longer provides implicitly
-    - cflags="-include limits.h"
+    # libiberty relies on implicit declarations and transitive includes
+    # (LONG_MIN, dup2, ...) that newer Apple clang (21+) rejects
+    - cflags="-include limits.h -include unistd.h -Wno-error=implicit-function-declaration"
+  doxygen:
+    require:
+    - ~graphviz
   c:
     prefer:
     - apple-clang
diff --git a/spack-environment/packages_linux.yaml b/spack-environment/packages_linux.yaml
index 25f6457f4..c08f7ea8c 100644
--- a/spack-environment/packages_linux.yaml
+++ b/spack-environment/packages_linux.yaml
@@ -19,6 +19,9 @@ packages:
     - gcc
     require:
     - gcc
+  doxygen:
+    require:
+    - +graphviz
   geant4:
     require:
     - any_of: [+opengl +qt +x11, -opengl -qt -x11]
diff --git a/spack-environment/xl/spack.yaml b/spack-environment/xl/spack.yaml
index cecad2417..282fded7d 100644
--- a/spack-environment/xl/spack.yaml
+++ b/spack-environment/xl/spack.yaml
@@ -15,18 +15,21 @@ spack:
   - when: arch.satisfies("platform=linux")
     linux_packages:
     - dawncut
+    - estarlight
     - gdb
     - gfal2
     - gfal2-util
     - graphviz
     - herwig3
     - imagemagick
+    - lager
     - lcov
     - madx
     - mosquitto
     - nopayloadclient
     - ollama
     - py-onnxruntime
+    - sherpa
     - slurm sysconfdir=/etc/slurm
     - strace
     - valgrind
@@ -63,7 +66,6 @@ spack:
   - eigen
   - emacs
   - epic-generator
-  - estarlight
   - fastjet
   - fjcontrib
   - fmt
@@ -78,7 +80,6 @@ spack:
   - iwyu
   - jana2
   - just
-  - lager
   - lhapdf
   - lhapdfsets
   - libtool
@@ -150,7 +151,6 @@ spack:
   - root
   - rucio-eic-mcp-server
   - timeframebuilder
-  - sherpa
   - simsipm
   - snakemake
   - spdlog

From 8c51d459e9df519ee2a3e9d301a1d14037ab51cd Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 10 Oct 2026 09:12:26 -0500
Subject: [PATCH 062/106] fix(ci): use Homebrew binutils external on macOS;
 make /opt writable for view updates

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml         | 8 +++++++-
 spack-environment/packages_darwin.yaml | 5 ++---
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 4226cf047..f16a81587 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -171,6 +171,11 @@ jobs:
         run: |
           spack compiler find --scope site
           spack external find --scope site llvm
+          # binutils (a build dependency of e.g. py-onnxruntime) does not
+          # build from source with Apple clang 21+, use Homebrew's instead
+          brew install binutils
+          spack external find --scope site --path "$(brew --prefix binutils)/bin" binutils
+          spack config --scope site get packages
 
       - name: Configure buildcache
         env:
@@ -196,8 +201,9 @@ jobs:
           # The environments' views (view.yaml) live under /opt, which is
           # not writable by default on macOS runners; the epic environment
           # updates them even with -c view:false
+          # (spack also renames /opt/local, so /opt itself must be writable)
           sudo mkdir -p /opt/local /opt/detector
-          sudo chown "$(id -u):$(id -g)" /opt/local /opt/detector
+          sudo chown "$(id -u):$(id -g)" /opt /opt/local /opt/detector
 
       - name: Concretize base environment
         run: |
diff --git a/spack-environment/packages_darwin.yaml b/spack-environment/packages_darwin.yaml
index 7fd58329d..9a778f56c 100644
--- a/spack-environment/packages_darwin.yaml
+++ b/spack-environment/packages_darwin.yaml
@@ -7,9 +7,8 @@ packages:
   binutils:
     require:
     - '@2.44:'
-    # libiberty relies on implicit declarations and transitive includes
-    # (LONG_MIN, dup2, ...) that newer Apple clang (21+) rejects
-    - cflags="-include limits.h -include unistd.h -Wno-error=implicit-function-declaration"
+    # Building binutils from source fails with Apple clang 21+ (libiberty
+    # relies on implicit declarations); CI provides it as a Homebrew external
   doxygen:
     require:
     - ~graphviz

From bd9e5904190ee0a99cf87cbb36abc5bc82a6ba70 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 10 Oct 2026 10:16:30 -0500
Subject: [PATCH 063/106] fix(ci): build binutils from source on macOS
 (@2.47:); drop Homebrew external

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml         | 5 -----
 spack-environment/packages_darwin.yaml | 4 +---
 2 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index f16a81587..4d11b12aa 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -171,11 +171,6 @@ jobs:
         run: |
           spack compiler find --scope site
           spack external find --scope site llvm
-          # binutils (a build dependency of e.g. py-onnxruntime) does not
-          # build from source with Apple clang 21+, use Homebrew's instead
-          brew install binutils
-          spack external find --scope site --path "$(brew --prefix binutils)/bin" binutils
-          spack config --scope site get packages
 
       - name: Configure buildcache
         env:
diff --git a/spack-environment/packages_darwin.yaml b/spack-environment/packages_darwin.yaml
index 9a778f56c..02ae02457 100644
--- a/spack-environment/packages_darwin.yaml
+++ b/spack-environment/packages_darwin.yaml
@@ -6,9 +6,7 @@
 packages:
   binutils:
     require:
-    - '@2.44:'
-    # Building binutils from source fails with Apple clang 21+ (libiberty
-    # relies on implicit declarations); CI provides it as a Homebrew external
+    - '@2.47:'  # 2.46.1 libiberty does not build with Apple clang 21+
   doxygen:
     require:
     - ~graphviz

From 0af6d869e994d72ff39efa6f36173a739065bf9b Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 10 Oct 2026 10:47:56 -0500
Subject: [PATCH 064/106] ci: dump libiberty config.log and environment when
 macOS build fails

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 4d11b12aa..c5647f68f 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -241,3 +241,19 @@ jobs:
             done
             echo "::endgroup::"
           done
+
+      - name: Diagnose binutils configure
+        if: failure()
+        continue-on-error: true
+        run: |
+          # Why do libiberty's configure header probes fail on the runner?
+          echo "::group::environment"
+          env | sort | grep -vE 'TOKEN|SECRET|PASSWORD'
+          echo "::endgroup::"
+          for log in $(find "${TMPDIR:-/var/folders}" /var/folders -path '*spack-stage-binutils-*' -name config.log -path '*libiberty*' 2>/dev/null | head -2); do
+            echo "::group::${log}"
+            grep -nE "^(CC|CFLAGS|CPPFLAGS|LDFLAGS)=|limits\.h|fcntl\.h|spawn\.h|unistd\.h" "${log}" | head -60
+            echo "--- first failing conftest"
+            grep -nB2 -A12 -E "fatal error|error:" "${log}" | head -80
+            echo "::endgroup::"
+          done

From e57cff5da6ce34d9b9b98ebe03ff908793a35251 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 10 Oct 2026 10:49:28 -0500
Subject: [PATCH 065/106] ci: do not export MACOSX_DEPLOYMENT_TARGET on macOS

Local builds that succeed do not set it; test whether it breaks the
libiberty configure probes of binutils.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index c5647f68f..1ed370474 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -33,14 +33,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
 
-      - name: Set Deployment Target to match runner SDK
-        run: |
-          # Fetch the active SDK version (e.g., 14.5)
-          CURRENT_SDK=$(xcrun --show-sdk-version)
-
-          # Export it to the GitHub environment so all future steps use it
-          echo "MACOSX_DEPLOYMENT_TARGET=$CURRENT_SDK" >> $GITHUB_ENV
-
       - name: Extract Spack configuration
         id: spack-config
         run: |

From dd2b9e00e1f7316f52edf9119b174eb9bbfe80e1 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 10 Oct 2026 11:21:41 -0500
Subject: [PATCH 066/106] ci: print the failing limits.h probe from libiberty
 config.log

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 1ed370474..ac1bafb38 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -244,8 +244,10 @@ jobs:
           echo "::endgroup::"
           for log in $(find "${TMPDIR:-/var/folders}" /var/folders -path '*spack-stage-binutils-*' -name config.log -path '*libiberty*' 2>/dev/null | head -2); do
             echo "::group::${log}"
-            grep -nE "^(CC|CFLAGS|CPPFLAGS|LDFLAGS)=|limits\.h|fcntl\.h|spawn\.h|unistd\.h" "${log}" | head -60
-            echo "--- first failing conftest"
-            grep -nB2 -A12 -E "fatal error|error:" "${log}" | head -80
+            echo "--- limits.h probe"
+            grep -n -A32 "configure:[0-9]*: checking for limits.h" "${log}" | head -45
+            echo "--- deployment target"
+            grep -c "overriding deployment version" "${log}" || true
+            grep -n "MACOSX_DEPLOYMENT_TARGET\|ac_c_werror_flag" "${log}" | head -10
             echo "::endgroup::"
           done

From a66fd54fdbd894fcb644cb67040e216ace20e9fd Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 10 Oct 2026 11:23:21 -0500
Subject: [PATCH 067/106] ci: print clang include search path and stray system
 headers on failure

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index ac1bafb38..47d87fae0 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -242,6 +242,10 @@ jobs:
           echo "::group::environment"
           env | sort | grep -vE 'TOKEN|SECRET|PASSWORD'
           echo "::endgroup::"
+          echo "::group::clang include search path"
+          clang -E -v -x c /dev/null 2>&1 | sed -n '/search starts here/,/End of search list/p'
+          find /usr/local/include /opt/homebrew/include -maxdepth 2 \( -name limits.h -o -name fcntl.h -o -name spawn.h \) 2>/dev/null
+          echo "::endgroup::"
           for log in $(find "${TMPDIR:-/var/folders}" /var/folders -path '*spack-stage-binutils-*' -name config.log -path '*libiberty*' 2>/dev/null | head -2); do
             echo "::group::${log}"
             echo "--- limits.h probe"

From ef1cfadcebc0c1bdc5ea403b35a92f7d70aa6216 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 10 Oct 2026 11:38:31 -0500
Subject: [PATCH 068/106] ci: do not abort the binutils diagnostic when find
 reports missing directories

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 47d87fae0..5f1f3ca5a 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -244,7 +244,7 @@ jobs:
           echo "::endgroup::"
           echo "::group::clang include search path"
           clang -E -v -x c /dev/null 2>&1 | sed -n '/search starts here/,/End of search list/p'
-          find /usr/local/include /opt/homebrew/include -maxdepth 2 \( -name limits.h -o -name fcntl.h -o -name spawn.h \) 2>/dev/null
+          find /usr/local/include /opt/homebrew/include -maxdepth 2 \( -name limits.h -o -name fcntl.h -o -name spawn.h \) 2>/dev/null || true
           echo "::endgroup::"
           for log in $(find "${TMPDIR:-/var/folders}" /var/folders -path '*spack-stage-binutils-*' -name config.log -path '*libiberty*' 2>/dev/null | head -2); do
             echo "::group::${log}"

From dbbbb7c61d0c366fdfbe0e7ebc0e25a5cc7aa1f8 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 10 Oct 2026 13:36:33 -0500
Subject: [PATCH 069/106] fix(spack): silence clang deployment version warning
 for binutils on macOS

libiberty's configure treats stderr output of its header probes as failure,
so the 'overriding deployment version' warning left HAVE_LIMITS_H etc. unset.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 spack-environment/packages_darwin.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/spack-environment/packages_darwin.yaml b/spack-environment/packages_darwin.yaml
index 02ae02457..fbd2d1ecd 100644
--- a/spack-environment/packages_darwin.yaml
+++ b/spack-environment/packages_darwin.yaml
@@ -7,6 +7,10 @@ packages:
   binutils:
     require:
     - '@2.47:'  # 2.46.1 libiberty does not build with Apple clang 21+
+    # clang warns "overriding deployment version from '10.16' to '11.0'" on
+    # every invocation; libiberty's configure treats any stderr output of its
+    # header probes as failure, leaving HAVE_LIMITS_H, HAVE_FCNTL_H, ... unset
+    - cflags=-Wno-overriding-deployment-version
   doxygen:
     require:
     - ~graphviz

From dcc85be330e66bddabbade9bd2c754695e7ec7dd Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 10 Oct 2026 13:58:04 -0500
Subject: [PATCH 070/106] fix(spack): also pass
 -Wno-overriding-deployment-version via cppflags for binutils; diagnose
 deployment target

autoconf's header probes run 'clang -E', which only sees CPPFLAGS. Add a
diagnostic comparing the binutils build environment with what clang computes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml         | 12 ++++++++++++
 spack-environment/packages_darwin.yaml |  5 +++--
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 5f1f3ca5a..1ee18aa50 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -242,6 +242,18 @@ jobs:
           echo "::group::environment"
           env | sort | grep -vE 'TOKEN|SECRET|PASSWORD'
           echo "::endgroup::"
+          echo "::group::deployment target"
+          sw_vers
+          echo "SYSTEM_VERSION_COMPAT=${SYSTEM_VERSION_COMPAT-unset}"
+          spack python -c 'import spack.operating_systems.mac_os as m; print("spack macos_version:", m.macos_version())' || true
+          python3 -c 'import platform; print("python mac_ver:", platform.mac_ver()[0])' || true
+          for env in spack-environment/${{matrix.ENV}}; do
+            echo "--- build environment of binutils"
+            spack -e "${env}" -c view:false build-env binutils -- env 2>&1 | grep -iE 'MACOSX|SYSTEM_VERSION|SDKROOT|DEPLOYMENT|FLAGS' || true
+            echo "--- what clang computes there"
+            spack -e "${env}" -c view:false build-env binutils -- sh -c 'cd "$TMPDIR" && echo "int main(void){return 0;}" > dt.c && clang -c dt.c -o dt.o; clang -### -c dt.c 2>&1 | grep -oE "\"-target-sdk-version\"|\"-triple\" \"[^\"]+\"|\"-mmacos[^\"]*\""' 2>&1 | tail -20 || true
+          done
+          echo "::endgroup::"
           echo "::group::clang include search path"
           clang -E -v -x c /dev/null 2>&1 | sed -n '/search starts here/,/End of search list/p'
           find /usr/local/include /opt/homebrew/include -maxdepth 2 \( -name limits.h -o -name fcntl.h -o -name spawn.h \) 2>/dev/null || true
diff --git a/spack-environment/packages_darwin.yaml b/spack-environment/packages_darwin.yaml
index fbd2d1ecd..2608ff275 100644
--- a/spack-environment/packages_darwin.yaml
+++ b/spack-environment/packages_darwin.yaml
@@ -9,8 +9,9 @@ packages:
     - '@2.47:'  # 2.46.1 libiberty does not build with Apple clang 21+
     # clang warns "overriding deployment version from '10.16' to '11.0'" on
     # every invocation; libiberty's configure treats any stderr output of its
-    # header probes as failure, leaving HAVE_LIMITS_H, HAVE_FCNTL_H, ... unset
-    - cflags=-Wno-overriding-deployment-version
+    # header probes (clang -E, which only sees cppflags) as failure, leaving
+    # HAVE_LIMITS_H, HAVE_FCNTL_H, ... unset
+    - cflags=-Wno-overriding-deployment-version cppflags=-Wno-overriding-deployment-version
   doxygen:
     require:
     - ~graphviz

From b5e7be5cd7abe2b68e329ba4cc1d31f0f86caffd Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 10 Oct 2026 14:03:12 -0500
Subject: [PATCH 071/106] Copy additional packages_darwin.yaml to Dockerfile

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 containers/eic/Dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/containers/eic/Dockerfile b/containers/eic/Dockerfile
index 6b999b703..e16b44a53 100644
--- a/containers/eic/Dockerfile
+++ b/containers/eic/Dockerfile
@@ -249,6 +249,7 @@ COPY --from=builder_installation_custom \
 COPY --from=builder_installation_custom \
   /opt/spack-environment/packages.yaml \
   /opt/spack-environment/packages_linux.yaml \
+  /opt/spack-environment/packages_darwin.yaml \
   /opt/spack-environment/
 
 

From 1a9f24dc10c802fa23a3229f79a5a5a336016186 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 11 Oct 2026 19:20:39 -0500
Subject: [PATCH 072/106] ci: bisect which dependency sets
 MACOSX_DEPLOYMENT_TARGET=10.16 in the binutils build environment

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 1ee18aa50..49433eccb 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -250,6 +250,10 @@ jobs:
           for env in spack-environment/${{matrix.ENV}}; do
             echo "--- build environment of binutils"
             spack -e "${env}" -c view:false build-env binutils -- env 2>&1 | grep -iE 'MACOSX|SYSTEM_VERSION|SDKROOT|DEPLOYMENT|FLAGS' || true
+            echo "--- MACOSX_DEPLOYMENT_TARGET per dependency of binutils (build-env of each)"
+            for dep in flex bison gettext zlib zlib-ng pkgconf gmake diffutils texinfo m4 libiconv zstd binutils; do
+              echo "${dep}: $(spack -e "${env}" -c view:false build-env "${dep}" -- sh -c 'echo "${MACOSX_DEPLOYMENT_TARGET-unset}"' 2>&1 | tail -1)"
+            done
             echo "--- what clang computes there"
             spack -e "${env}" -c view:false build-env binutils -- sh -c 'cd "$TMPDIR" && echo "int main(void){return 0;}" > dt.c && clang -c dt.c -o dt.o; clang -### -c dt.c 2>&1 | grep -oE "\"-target-sdk-version\"|\"-triple\" \"[^\"]+\"|\"-mmacos[^\"]*\""' 2>&1 | tail -20 || true
           done

From d839290ff4224b4072ee7d55b509578bbcdaf2e9 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Mon, 12 Oct 2026 00:12:12 -0500
Subject: [PATCH 073/106] ci: list dependencies in the pkgconf build
 environment with their deployment target

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 49433eccb..81744cc7f 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -254,6 +254,10 @@ jobs:
             for dep in flex bison gettext zlib zlib-ng pkgconf gmake diffutils texinfo m4 libiconv zstd binutils; do
               echo "${dep}: $(spack -e "${env}" -c view:false build-env "${dep}" -- sh -c 'echo "${MACOSX_DEPLOYMENT_TARGET-unset}"' 2>&1 | tail -1)"
             done
+            echo "--- dependencies considered for the pkgconf build environment (10.16) and their own value"
+            for dep in $(spack -d -e "${env}" -c view:false build-env pkgconf -- true 2>&1 | sed -n 's/.*Adding env modifications for \([^ ]*\).*/\1/p' | sort -u); do
+              echo "${dep}: $(spack -e "${env}" -c view:false build-env "${dep}" -- sh -c 'echo "${MACOSX_DEPLOYMENT_TARGET-unset}"' 2>&1 | tail -1)"
+            done
             echo "--- what clang computes there"
             spack -e "${env}" -c view:false build-env binutils -- sh -c 'cd "$TMPDIR" && echo "int main(void){return 0;}" > dt.c && clang -c dt.c -o dt.o; clang -### -c dt.c 2>&1 | grep -oE "\"-target-sdk-version\"|\"-triple\" \"[^\"]+\"|\"-mmacos[^\"]*\""' 2>&1 | tail -20 || true
           done

From fbae4921878c78ef54024475bc138ee566d094d5 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Mon, 12 Oct 2026 09:30:51 -0500
Subject: [PATCH 074/106] fix(spack): cherry-pick removal of the forced
 MACOSX_DEPLOYMENT_TARGET=10.16 in the autotools builder

AutotoolsBuilder.setup_build_environment in spack-packages v2026.06.0 sets
MACOSX_DEPLOYMENT_TARGET=10.16 for every autotools package on macOS >= 11.
Apple clang 21 in Xcode 26.6 warns 'overriding deployment version from
10.16 to 11.0' on stderr for each invocation, and autoconf header probes
(clang -E) treat any stderr output as failure. libiberty then builds
without HAVE_LIMITS_H, HAVE_FCNTL_H, HAVE_SPAWN_H and fails on LONG_MIN,
dup2, O_RDONLY, posix_spawn.

Upstream removed the builder-wide setting in spack-packages#5525 and moved
it into the two packages that need it (flex #5599, libevent #5600).
Cherry-pick those three commits, drop the binutils cflags/cppflags
workaround and the diagnostic workflow step.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/workflows/macos-ci.yml         | 42 --------------------------
 spack-environment/packages_darwin.yaml |  8 -----
 2 files changed, 50 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 81744cc7f..661c03941 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -233,45 +233,3 @@ jobs:
             done
             echo "::endgroup::"
           done
-
-      - name: Diagnose binutils configure
-        if: failure()
-        continue-on-error: true
-        run: |
-          # Why do libiberty's configure header probes fail on the runner?
-          echo "::group::environment"
-          env | sort | grep -vE 'TOKEN|SECRET|PASSWORD'
-          echo "::endgroup::"
-          echo "::group::deployment target"
-          sw_vers
-          echo "SYSTEM_VERSION_COMPAT=${SYSTEM_VERSION_COMPAT-unset}"
-          spack python -c 'import spack.operating_systems.mac_os as m; print("spack macos_version:", m.macos_version())' || true
-          python3 -c 'import platform; print("python mac_ver:", platform.mac_ver()[0])' || true
-          for env in spack-environment/${{matrix.ENV}}; do
-            echo "--- build environment of binutils"
-            spack -e "${env}" -c view:false build-env binutils -- env 2>&1 | grep -iE 'MACOSX|SYSTEM_VERSION|SDKROOT|DEPLOYMENT|FLAGS' || true
-            echo "--- MACOSX_DEPLOYMENT_TARGET per dependency of binutils (build-env of each)"
-            for dep in flex bison gettext zlib zlib-ng pkgconf gmake diffutils texinfo m4 libiconv zstd binutils; do
-              echo "${dep}: $(spack -e "${env}" -c view:false build-env "${dep}" -- sh -c 'echo "${MACOSX_DEPLOYMENT_TARGET-unset}"' 2>&1 | tail -1)"
-            done
-            echo "--- dependencies considered for the pkgconf build environment (10.16) and their own value"
-            for dep in $(spack -d -e "${env}" -c view:false build-env pkgconf -- true 2>&1 | sed -n 's/.*Adding env modifications for \([^ ]*\).*/\1/p' | sort -u); do
-              echo "${dep}: $(spack -e "${env}" -c view:false build-env "${dep}" -- sh -c 'echo "${MACOSX_DEPLOYMENT_TARGET-unset}"' 2>&1 | tail -1)"
-            done
-            echo "--- what clang computes there"
-            spack -e "${env}" -c view:false build-env binutils -- sh -c 'cd "$TMPDIR" && echo "int main(void){return 0;}" > dt.c && clang -c dt.c -o dt.o; clang -### -c dt.c 2>&1 | grep -oE "\"-target-sdk-version\"|\"-triple\" \"[^\"]+\"|\"-mmacos[^\"]*\""' 2>&1 | tail -20 || true
-          done
-          echo "::endgroup::"
-          echo "::group::clang include search path"
-          clang -E -v -x c /dev/null 2>&1 | sed -n '/search starts here/,/End of search list/p'
-          find /usr/local/include /opt/homebrew/include -maxdepth 2 \( -name limits.h -o -name fcntl.h -o -name spawn.h \) 2>/dev/null || true
-          echo "::endgroup::"
-          for log in $(find "${TMPDIR:-/var/folders}" /var/folders -path '*spack-stage-binutils-*' -name config.log -path '*libiberty*' 2>/dev/null | head -2); do
-            echo "::group::${log}"
-            echo "--- limits.h probe"
-            grep -n -A32 "configure:[0-9]*: checking for limits.h" "${log}" | head -45
-            echo "--- deployment target"
-            grep -c "overriding deployment version" "${log}" || true
-            grep -n "MACOSX_DEPLOYMENT_TARGET\|ac_c_werror_flag" "${log}" | head -10
-            echo "::endgroup::"
-          done
diff --git a/spack-environment/packages_darwin.yaml b/spack-environment/packages_darwin.yaml
index 2608ff275..bbb2be374 100644
--- a/spack-environment/packages_darwin.yaml
+++ b/spack-environment/packages_darwin.yaml
@@ -4,14 +4,6 @@
 #     when: platform == "darwin"
 # See packages_linux.yaml for the Linux counterpart.
 packages:
-  binutils:
-    require:
-    - '@2.47:'  # 2.46.1 libiberty does not build with Apple clang 21+
-    # clang warns "overriding deployment version from '10.16' to '11.0'" on
-    # every invocation; libiberty's configure treats any stderr output of its
-    # header probes (clang -E, which only sees cppflags) as failure, leaving
-    # HAVE_LIMITS_H, HAVE_FCNTL_H, ... unset
-    - cflags=-Wno-overriding-deployment-version cppflags=-Wno-overriding-deployment-version
   doxygen:
     require:
     - ~graphviz

From febe576412a2ab8ceb47663557c0a4acfb0cf51f Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Mon, 12 Oct 2026 11:10:41 -0500
Subject: [PATCH 075/106] Fix markdown formatting for platform-specific
 settings

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 docs/architecture.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/architecture.md b/docs/architecture.md
index ff3703881..db599eac3 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -152,4 +152,4 @@ Package versions are controlled through several configuration files:
 | `key4hep-spack.sh` | Key4HEP-spack version |
 | `eic-spack.sh` | EIC-spack version |
 | `spack-environment/packages.yaml` | Package version preferences and variants |
-| `spack-environment/packages_linux.yaml`, `packages_darwin.yaml` | Platform-specific settings (compiler, GL, X11), included per platform |
+| `spack-environment/packages_linux.yaml`, `spack-environment/packages_darwin.yaml` | Platform-specific settings (compiler, GL, X11), included per platform |

From 321ddf70a2a1aea3282f671e71fe2cd046b0c8f1 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Mon, 12 Oct 2026 14:06:54 -0500
Subject: [PATCH 076/106] ci(macos): package and publish macOS environments to
 GHCR via crane

---
 .github/workflows/macos-ci.yml | 147 +++++++++++++++++++++++++++++++--
 1 file changed, 138 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 661c03941..a0d86d6d3 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -28,6 +28,9 @@ jobs:
     env:
       GITHUB_REGISTRY_USER: ${{ secrets.GHCR_REGISTRY_USER }}
       GITHUB_REGISTRY_TOKEN: ${{ secrets.GHCR_REGISTRY_TOKEN }}
+      CVMFS_REPO: singularity.opensciencegrid.org
+      CVMFS_PATH_PREFIX: eicweb
+      PUBLISH_IMAGE_REPO: ghcr.io/${{ github.repository_owner }}
 
     steps:
       - name: Checkout repository
@@ -159,10 +162,47 @@ jobs:
           cd ${{ github.workspace }}/spack
           spack repo add var/spack/repos/eic-spack/spack_repo/eic
 
+      - name: Setup CVMFS mount point and install directories
+        id: cvmfs-dirs
+        run: |
+          # Set up synthetic firmlink for /cvmfs on macOS
+          sudo mkdir -p /System/Volumes/Data/cvmfs
+          sudo chown -R "$(id -u):$(id -g)" /System/Volumes/Data/cvmfs
+          if ! grep -q '^cvmfs[[:space:]]' /etc/synthetic.conf 2>/dev/null; then
+            printf 'cvmfs\tSystem/Volumes/Data/cvmfs\n' | sudo tee -a /etc/synthetic.conf
+          fi
+          sudo /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -t || true
+
+          # Determine tags and install root
+          IMAGE_NAME="mac_${{ matrix.ENV }}"
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            PRIMARY_TAG="unstable-pr-${{ github.event.pull_request.number }}"
+          elif [ "${{ github.ref_name }}" = "master" ]; then
+            PRIMARY_TAG="nightly"
+          else
+            PRIMARY_TAG="${{ github.ref_name }}"
+          fi
+
+          INSTALL_PREFIX="/cvmfs/${{ env.CVMFS_REPO }}/${{ env.CVMFS_PATH_PREFIX }}/${IMAGE_NAME}:${PRIMARY_TAG}"
+          echo "install-prefix=${INSTALL_PREFIX}" >> $GITHUB_OUTPUT
+          echo "image-name=${IMAGE_NAME}" >> $GITHUB_OUTPUT
+          echo "primary-tag=${PRIMARY_TAG}" >> $GITHUB_OUTPUT
+
+          mkdir -p "${INSTALL_PREFIX}/opt/software" \
+                   "${INSTALL_PREFIX}/opt/local" \
+                   "${INSTALL_PREFIX}/opt/detector" \
+                   "${INSTALL_PREFIX}/opt/spack-environment"
+
       - name: Add Spack environment
         run: |
           spack compiler find --scope site
           spack external find --scope site llvm
+          INSTALL_PREFIX="${{ steps.cvmfs-dirs.outputs.install-prefix }}"
+          spack config --scope site add "config:install_tree:root:${INSTALL_PREFIX}/opt/software"
+          spack -e spack-environment/${{ matrix.ENV }} config add "view:default:root:${INSTALL_PREFIX}/opt/local"
+          spack -e spack-environment/${{ matrix.ENV }} config add "view:detectors:root:${INSTALL_PREFIX}/opt/detector"
+          spack -e spack-environment/${{ matrix.ENV }}/epic config add "view:default:root:${INSTALL_PREFIX}/opt/local"
+          spack -e spack-environment/${{ matrix.ENV }}/epic config add "view:detectors:root:${INSTALL_PREFIX}/opt/detector"
 
       - name: Configure buildcache
         env:
@@ -183,15 +223,6 @@ jobs:
             spack mirror add --scope site eic --unsigned "${mirror}"
           fi
 
-      - name: Create view directories
-        run: |
-          # The environments' views (view.yaml) live under /opt, which is
-          # not writable by default on macOS runners; the epic environment
-          # updates them even with -c view:false
-          # (spack also renames /opt/local, so /opt itself must be writable)
-          sudo mkdir -p /opt/local /opt/detector
-          sudo chown "$(id -u):$(id -g)" /opt /opt/local /opt/detector
-
       - name: Concretize base environment
         run: |
           spack -e spack-environment/${{matrix.ENV}} -c view:false concretize --force
@@ -208,6 +239,104 @@ jobs:
         run: |
           spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install --no-check-signature --show-log-on-error
 
+      - name: Regenerate views
+        run: |
+          spack -e spack-environment/${{matrix.ENV}} env view regenerate || true
+          spack -e spack-environment/${{matrix.ENV}}/epic env view regenerate
+
+      - name: Setup environment and metadata
+        run: |
+          INSTALL_PREFIX="${{ steps.cvmfs-dirs.outputs.install-prefix }}"
+
+          # Generate portable setup.sh for macOS users from Spack environment
+          spack env activate --sh --dir spack-environment/${{matrix.ENV}}/epic > "${INSTALL_PREFIX}/setup.sh"
+          chmod +x "${INSTALL_PREFIX}/setup.sh"
+
+          # Detector symlinks fixup
+          if [ -d "${INSTALL_PREFIX}/opt/detector" ]; then
+            (
+              shopt -s nullglob
+              cd "${INSTALL_PREFIX}/opt/detector"
+              for detector in epic-git.*_* ; do
+                ln -sf "${detector}" "epic-${detector/*_/}"
+              done
+              if [ ! -e epic-main ] && [ -d epic-main_* ]; then
+                ln -sf epic-main_* epic-main
+              fi
+            )
+          fi
+
+          # Copy spack environment definition
+          cp -r spack-environment "${INSTALL_PREFIX}/opt/spack-environment"
+
+          # Place CVMFS catalog markers
+          touch "${INSTALL_PREFIX}/opt/software/.cvmfscatalog"
+          find "${INSTALL_PREFIX}/opt/software" -mindepth 1 -maxdepth 2 -type d -exec touch {}/.cvmfscatalog \;
+          touch "${INSTALL_PREFIX}/opt/local/.cvmfscatalog"
+          find "${INSTALL_PREFIX}/opt/local" -mindepth 1 -maxdepth 1 -type d -exec touch {}/.cvmfscatalog \;
+          touch "${INSTALL_PREFIX}/opt/detector/.cvmfscatalog"
+          find "${INSTALL_PREFIX}/opt/detector" -mindepth 1 -maxdepth 1 -type d -exec touch {}/.cvmfscatalog \;
+          touch "${INSTALL_PREFIX}/opt/spack-environment/.cvmfscatalog"
+
+      - name: Smoke test installed environment
+        run: |
+          INSTALL_PREFIX="${{ steps.cvmfs-dirs.outputs.install-prefix }}"
+          echo "Testing environment activation from ${INSTALL_PREFIX}/setup.sh..."
+          source "${INSTALL_PREFIX}/setup.sh"
+          which python3
+          python3 --version
+          python3 -c "import sys; print('Python sys.path:', sys.path)"
+          if command -v root.exe >/dev/null 2>&1; then
+            root.exe -b -q -e 'std::cout << "ROOT " << gROOT->GetVersion() << " functional\n";'
+          fi
+
+      - name: Setup crane
+        uses: imjasonh/setup-crane@v0.7
+
+      - name: Package and publish container
+        env:
+          PUSH_CONTAINER: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        run: |
+          if [ "${PUSH_CONTAINER}" != "true" ]; then
+            echo "Skipping container publishing (push disabled or running in unprivileged fork context)."
+            exit 0
+          fi
+
+          INSTALL_PREFIX="${{ steps.cvmfs-dirs.outputs.install-prefix }}"
+          IMAGE_NAME="${{ steps.cvmfs-dirs.outputs.image-name }}"
+          PRIMARY_TAG="${{ steps.cvmfs-dirs.outputs.primary-tag }}"
+          PUBLISH_IMAGE="${{ env.PUBLISH_IMAGE_REPO }}/${IMAGE_NAME}:${PRIMARY_TAG}"
+
+          TAGS=("${PRIMARY_TAG}")
+          if [ "${{ github.ref_name }}" = "master" ] && [ "${{ github.event_name }}" != "pull_request" ]; then
+            TAGS+=("master" "latest")
+          fi
+
+          # Optional authentication if custom credentials provided (setup-crane already authenticates to ghcr.io by default)
+          if [ -n "${GITHUB_REGISTRY_TOKEN}" ]; then
+            REGISTRY_USER="${GITHUB_REGISTRY_USER:-${{ github.actor }}}"
+            echo "${GITHUB_REGISTRY_TOKEN}" | crane auth login ghcr.io -u "${REGISTRY_USER}" --password-stdin
+          fi
+
+          LAYER_TAR="/tmp/layer.tar.gz"
+          echo "Archiving clean install tree directly from ${INSTALL_PREFIX}..."
+          tar -czf "${LAYER_TAR}" -C "${INSTALL_PREFIX}" .
+          echo "Layer archive size: $(du -h "${LAYER_TAR}" | cut -f1)"
+
+          echo "Appending layer onto alpine:latest base and pushing ${PUBLISH_IMAGE}..."
+          crane append \
+            --platform=linux/arm64 \
+            -b alpine:latest \
+            -f "${LAYER_TAR}" \
+            -t "${PUBLISH_IMAGE}"
+
+          for tag in "${TAGS[@]:1}"; do
+            echo "Tagging ${{ env.PUBLISH_IMAGE_REPO }}/${IMAGE_NAME}:${tag}..."
+            crane tag "${PUBLISH_IMAGE}" "${tag}"
+          done
+          rm -f "${LAYER_TAR}"
+          echo "Container published successfully!"
+
       - name: Diagnose numpy import
         if: failure()
         continue-on-error: true

From 469aa5d29e4b8767f7b4772c009421ed34d893d0 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Mon, 12 Oct 2026 18:49:42 -0500
Subject: [PATCH 077/106] fix(ci): quote spack config paths and initialize view
 mapping in macOS workflow

---
 .github/workflows/macos-ci.yml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index a0d86d6d3..f486bcb67 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -198,11 +198,13 @@ jobs:
           spack compiler find --scope site
           spack external find --scope site llvm
           INSTALL_PREFIX="${{ steps.cvmfs-dirs.outputs.install-prefix }}"
-          spack config --scope site add "config:install_tree:root:${INSTALL_PREFIX}/opt/software"
-          spack -e spack-environment/${{ matrix.ENV }} config add "view:default:root:${INSTALL_PREFIX}/opt/local"
-          spack -e spack-environment/${{ matrix.ENV }} config add "view:detectors:root:${INSTALL_PREFIX}/opt/detector"
-          spack -e spack-environment/${{ matrix.ENV }}/epic config add "view:default:root:${INSTALL_PREFIX}/opt/local"
-          spack -e spack-environment/${{ matrix.ENV }}/epic config add "view:detectors:root:${INSTALL_PREFIX}/opt/detector"
+          spack config --scope site add "config:install_tree:root:'${INSTALL_PREFIX}/opt/software'"
+          spack -e spack-environment/${{ matrix.ENV }} config add "view:{}"
+          spack -e spack-environment/${{ matrix.ENV }} config add "view:default:root:'${INSTALL_PREFIX}/opt/local'"
+          spack -e spack-environment/${{ matrix.ENV }} config add "view:detectors:root:'${INSTALL_PREFIX}/opt/detector'"
+          spack -e spack-environment/${{ matrix.ENV }}/epic config add "view:{}"
+          spack -e spack-environment/${{ matrix.ENV }}/epic config add "view:default:root:'${INSTALL_PREFIX}/opt/local'"
+          spack -e spack-environment/${{ matrix.ENV }}/epic config add "view:detectors:root:'${INSTALL_PREFIX}/opt/detector'"
 
       - name: Configure buildcache
         env:

From a8eb4aece7d886ec716bc8f71b6dfd938eef6426 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Wed, 14 Oct 2026 12:53:50 -0500
Subject: [PATCH 078/106] fix(ci): disable view validation when configuring
 spack views on macOS

---
 .github/workflows/macos-ci.yml | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index f486bcb67..295e8b6d1 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -195,16 +195,17 @@ jobs:
 
       - name: Add Spack environment
         run: |
+          set -x
           spack compiler find --scope site
           spack external find --scope site llvm
           INSTALL_PREFIX="${{ steps.cvmfs-dirs.outputs.install-prefix }}"
           spack config --scope site add "config:install_tree:root:'${INSTALL_PREFIX}/opt/software'"
-          spack -e spack-environment/${{ matrix.ENV }} config add "view:{}"
-          spack -e spack-environment/${{ matrix.ENV }} config add "view:default:root:'${INSTALL_PREFIX}/opt/local'"
-          spack -e spack-environment/${{ matrix.ENV }} config add "view:detectors:root:'${INSTALL_PREFIX}/opt/detector'"
-          spack -e spack-environment/${{ matrix.ENV }}/epic config add "view:{}"
-          spack -e spack-environment/${{ matrix.ENV }}/epic config add "view:default:root:'${INSTALL_PREFIX}/opt/local'"
-          spack -e spack-environment/${{ matrix.ENV }}/epic config add "view:detectors:root:'${INSTALL_PREFIX}/opt/detector'"
+          spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:{}"
+          spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:default:root:'${INSTALL_PREFIX}/opt/local'"
+          spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:detectors:root:'${INSTALL_PREFIX}/opt/detector'"
+          spack -e spack-environment/${{ matrix.ENV }}/epic -c view:false config add "view:{}"
+          spack -e spack-environment/${{ matrix.ENV }}/epic -c view:false config add "view:default:root:'${INSTALL_PREFIX}/opt/local'"
+          spack -e spack-environment/${{ matrix.ENV }}/epic -c view:false config add "view:detectors:root:'${INSTALL_PREFIX}/opt/detector'"
 
       - name: Configure buildcache
         env:

From 82db680d37d928436d55bdd4d087ca35b2e6f94d Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Wed, 14 Oct 2026 13:25:03 -0500
Subject: [PATCH 079/106] fix(ci): make /opt/local writable and defer epic view
 configuration

---
 .github/workflows/macos-ci.yml | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 295e8b6d1..4374baf8a 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -173,6 +173,13 @@ jobs:
           fi
           sudo /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -t || true
 
+          # The environments' views (view.yaml) default to /opt/local and
+          # /opt/detector, which Spack touches during environment initialization
+          # before custom views are applied. Spack also renames the view directory,
+          # so /opt itself must be writable.
+          sudo mkdir -p /opt/local /opt/detector
+          sudo chown "$(id -u):$(id -g)" /opt /opt/local /opt/detector
+
           # Determine tags and install root
           IMAGE_NAME="mac_${{ matrix.ENV }}"
           if [ "${{ github.event_name }}" = "pull_request" ]; then
@@ -203,9 +210,6 @@ jobs:
           spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:{}"
           spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:default:root:'${INSTALL_PREFIX}/opt/local'"
           spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:detectors:root:'${INSTALL_PREFIX}/opt/detector'"
-          spack -e spack-environment/${{ matrix.ENV }}/epic -c view:false config add "view:{}"
-          spack -e spack-environment/${{ matrix.ENV }}/epic -c view:false config add "view:default:root:'${INSTALL_PREFIX}/opt/local'"
-          spack -e spack-environment/${{ matrix.ENV }}/epic -c view:false config add "view:detectors:root:'${INSTALL_PREFIX}/opt/detector'"
 
       - name: Configure buildcache
         env:
@@ -234,6 +238,14 @@ jobs:
         run: |
           spack -e spack-environment/${{matrix.ENV}} -c view:false install --no-check-signature --show-log-on-error
 
+      - name: Add epic environment
+        run: |
+          set -x
+          INSTALL_PREFIX="${{ steps.cvmfs-dirs.outputs.install-prefix }}"
+          spack -e spack-environment/${{ matrix.ENV }}/epic -c view:false config add "view:{}"
+          spack -e spack-environment/${{ matrix.ENV }}/epic -c view:false config add "view:default:root:'${INSTALL_PREFIX}/opt/local'"
+          spack -e spack-environment/${{ matrix.ENV }}/epic -c view:false config add "view:detectors:root:'${INSTALL_PREFIX}/opt/detector'"
+
       - name: Concretize epic environment
         run: |
           spack -e spack-environment/${{matrix.ENV}}/epic -c view:false concretize --force

From e6c4f2806fcd89556381f6b5ec2238a76766b896 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Wed, 14 Oct 2026 13:41:43 -0500
Subject: [PATCH 080/106] fix(ci): add install tree padding and rebuild macOS
 packages without buildcache

---
 .github/workflows/macos-ci.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 4374baf8a..8e495974c 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -31,6 +31,7 @@ jobs:
       CVMFS_REPO: singularity.opensciencegrid.org
       CVMFS_PATH_PREFIX: eicweb
       PUBLISH_IMAGE_REPO: ghcr.io/${{ github.repository_owner }}
+      SPACK_INSTALL_FLAGS: "--no-cache --no-check-signature --show-log-on-error"
 
     steps:
       - name: Checkout repository
@@ -207,6 +208,7 @@ jobs:
           spack external find --scope site llvm
           INSTALL_PREFIX="${{ steps.cvmfs-dirs.outputs.install-prefix }}"
           spack config --scope site add "config:install_tree:root:'${INSTALL_PREFIX}/opt/software'"
+          spack config --scope site add "config:install_tree:padded_length:128"
           spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:{}"
           spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:default:root:'${INSTALL_PREFIX}/opt/local'"
           spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:detectors:root:'${INSTALL_PREFIX}/opt/detector'"
@@ -236,7 +238,7 @@ jobs:
 
       - name: Install base environment
         run: |
-          spack -e spack-environment/${{matrix.ENV}} -c view:false install --no-check-signature --show-log-on-error
+          spack -e spack-environment/${{matrix.ENV}} -c view:false install ${{ env.SPACK_INSTALL_FLAGS }}
 
       - name: Add epic environment
         run: |
@@ -252,7 +254,7 @@ jobs:
 
       - name: Install epic environment
         run: |
-          spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install --no-check-signature --show-log-on-error
+          spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install ${{ env.SPACK_INSTALL_FLAGS }}
 
       - name: Regenerate views
         run: |

From 1535facab5f60e74a181eed267ec3b8cc1a02be1 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Wed, 14 Oct 2026 17:48:11 -0500
Subject: [PATCH 081/106] fix(ci): replace colon in INSTALL_PREFIX with hyphen
 to prevent build failures

---
 .github/workflows/macos-ci.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 8e495974c..3505e364b 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -191,7 +191,7 @@ jobs:
             PRIMARY_TAG="${{ github.ref_name }}"
           fi
 
-          INSTALL_PREFIX="/cvmfs/${{ env.CVMFS_REPO }}/${{ env.CVMFS_PATH_PREFIX }}/${IMAGE_NAME}:${PRIMARY_TAG}"
+          INSTALL_PREFIX="/cvmfs/${{ env.CVMFS_REPO }}/${{ env.CVMFS_PATH_PREFIX }}/${IMAGE_NAME}-${PRIMARY_TAG}"
           echo "install-prefix=${INSTALL_PREFIX}" >> $GITHUB_OUTPUT
           echo "image-name=${IMAGE_NAME}" >> $GITHUB_OUTPUT
           echo "primary-tag=${PRIMARY_TAG}" >> $GITHUB_OUTPUT
@@ -200,6 +200,7 @@ jobs:
                    "${INSTALL_PREFIX}/opt/local" \
                    "${INSTALL_PREFIX}/opt/detector" \
                    "${INSTALL_PREFIX}/opt/spack-environment"
+          ln -sfn "${IMAGE_NAME}-${PRIMARY_TAG}" "/cvmfs/${{ env.CVMFS_REPO }}/${{ env.CVMFS_PATH_PREFIX }}/${IMAGE_NAME}:${PRIMARY_TAG}"
 
       - name: Add Spack environment
         run: |

From 647d4011565a7dc3c772041efd29887b10b61f2b Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Wed, 14 Oct 2026 23:59:35 -0500
Subject: [PATCH 082/106] ci(macos): enable buildcache consumption now that
 padded packages are built

---
 .github/workflows/macos-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 3505e364b..922fe0037 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -31,7 +31,7 @@ jobs:
       CVMFS_REPO: singularity.opensciencegrid.org
       CVMFS_PATH_PREFIX: eicweb
       PUBLISH_IMAGE_REPO: ghcr.io/${{ github.repository_owner }}
-      SPACK_INSTALL_FLAGS: "--no-cache --no-check-signature --show-log-on-error"
+      SPACK_INSTALL_FLAGS: "--no-check-signature --show-log-on-error"
 
     steps:
       - name: Checkout repository

From 7d74fa18dcbf0378b73c326a294676be4314ed31 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Thu, 15 Oct 2026 00:14:19 -0500
Subject: [PATCH 083/106] fix(ci): fall back to source build on buildcache
 binary relocation failure

---
 .github/workflows/macos-ci.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 922fe0037..500d64832 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -100,6 +100,27 @@ jobs:
             git cherry-pick "${commit}"
           done < <(echo "${{ steps.spack-config.outputs.spack-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
 
+          # Fallback to source build when binary relocation fails (e.g. unpadded binaries in buildcache)
+          python3 - <<'EOF'
+          path = "lib/spack/spack/installer/build.py"
+          with open(path) as f:
+              content = f.read()
+          target = """    send_state("relocating", state_stream)
+    with timer.measure("install"):
+        spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False, timer=timer)"""
+          replacement = """    send_state("relocating", state_stream)
+    try:
+        with timer.measure("install"):
+            spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False, timer=timer)
+    except Exception as e:
+        spack.util.tty.warn(f"Failed to install {spec.name} from binary cache ({e}); falling back to source build")
+        return False"""
+          if target in content:
+              with open(path, "w") as f:
+                  f.write(content.replace(target, replacement, 1))
+              print("Patched install_from_buildcache to fall back to source build on relocation failure")
+          EOF
+
       - name: Checkout spack-packages repository
         uses: actions/checkout@v7
         with:

From 32a3ccb23ed77131ad31fb6b6297834ae958d591 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Thu, 15 Oct 2026 00:19:22 -0500
Subject: [PATCH 084/106] fix(ci): patch new_installer.py for buildcache
 fallback with valid yaml formatting

---
 .github/workflows/macos-ci.yml | 40 ++++++++++++++++++----------------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 500d64832..ab8d21968 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -101,25 +101,27 @@ jobs:
           done < <(echo "${{ steps.spack-config.outputs.spack-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
 
           # Fallback to source build when binary relocation fails (e.g. unpadded binaries in buildcache)
-          python3 - <<'EOF'
-          path = "lib/spack/spack/installer/build.py"
-          with open(path) as f:
-              content = f.read()
-          target = """    send_state("relocating", state_stream)
-    with timer.measure("install"):
-        spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False, timer=timer)"""
-          replacement = """    send_state("relocating", state_stream)
-    try:
-        with timer.measure("install"):
-            spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False, timer=timer)
-    except Exception as e:
-        spack.util.tty.warn(f"Failed to install {spec.name} from binary cache ({e}); falling back to source build")
-        return False"""
-          if target in content:
-              with open(path, "w") as f:
-                  f.write(content.replace(target, replacement, 1))
-              print("Patched install_from_buildcache to fall back to source build on relocation failure")
-          EOF
+          python3 -c '
+          import pathlib
+          path = pathlib.Path("lib/spack/spack/new_installer.py")
+          content = path.read_text()
+          old = (
+              "    send_state(\"relocating\", state_stream)\n"
+              "    spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False)"
+          )
+          new = (
+              "    send_state(\"relocating\", state_stream)\n"
+              "    try:\n"
+              "        spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False)\n"
+              "    except Exception as e:\n"
+              "        shutil.rmtree(spec.prefix, ignore_errors=True)\n"
+              "        spack.llnl.util.tty.warn(f\"Failed to install {spec.name} from binary cache ({e}); falling back to source build\")\n"
+              "        return False"
+          )
+          if old in content:
+              path.write_text(content.replace(old, new, 1))
+              print("Patched new_installer.py to fall back to source build on binary relocation failure")
+          '
 
       - name: Checkout spack-packages repository
         uses: actions/checkout@v7

From 0c3c36253d165b3aa70f2b8eab94f961593905bb Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Thu, 15 Oct 2026 02:03:58 -0500
Subject: [PATCH 085/106] fix(ci): exit with 0 explicitly from root.exe smoke
 test

---
 .github/workflows/macos-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index ab8d21968..b3d46c7d4 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -328,7 +328,7 @@ jobs:
           python3 --version
           python3 -c "import sys; print('Python sys.path:', sys.path)"
           if command -v root.exe >/dev/null 2>&1; then
-            root.exe -b -q -e 'std::cout << "ROOT " << gROOT->GetVersion() << " functional\n";'
+            root.exe -b -q -e 'std::cout << "ROOT " << gROOT->GetVersion() << " functional\n"; gSystem->Exit(0);'
           fi
 
       - name: Setup crane

From a98ca671a994974d857207b05eca7c730e44f5b6 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Thu, 15 Oct 2026 06:50:37 -0500
Subject: [PATCH 086/106] fix(darwin): use autotools for libxml2 to match spack
 libiconv symbols

---
 spack-environment/packages_darwin.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/spack-environment/packages_darwin.yaml b/spack-environment/packages_darwin.yaml
index bbb2be374..b735f56e2 100644
--- a/spack-environment/packages_darwin.yaml
+++ b/spack-environment/packages_darwin.yaml
@@ -27,6 +27,11 @@ packages:
   glu:
     require:
     - apple-glu
+  libxml2:
+    prefer:
+    - build_system=autotools
+    require:
+    - any_of: [build_system=autotools, '@:']
   root:
     require:
     - ~x

From 49bbdde8f49e389132ed94fd23293a861b1ae808 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Thu, 15 Oct 2026 19:06:00 -0500
Subject: [PATCH 087/106] feat(macos): exclude iwyu on darwin and
 garbage-collect build dependencies

---
 .github/workflows/macos-ci.yml  | 7 +++++++
 spack-environment/ci/spack.yaml | 2 +-
 spack-environment/xl/spack.yaml | 2 +-
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index b3d46c7d4..09729dca6 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -280,6 +280,13 @@ jobs:
         run: |
           spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install ${{ env.SPACK_INSTALL_FLAGS }}
 
+      - name: Garbage collect build-only dependencies
+        run: |
+          spack gc --yes-to-all \
+            -e spack-environment/${{ matrix.ENV }} \
+            -e spack-environment/${{ matrix.ENV }}/epic
+          spack clean --stage --downloads
+
       - name: Regenerate views
         run: |
           spack -e spack-environment/${{matrix.ENV}} env view regenerate || true
diff --git a/spack-environment/ci/spack.yaml b/spack-environment/ci/spack.yaml
index fc95eb872..b6fc50f8e 100644
--- a/spack-environment/ci/spack.yaml
+++ b/spack-environment/ci/spack.yaml
@@ -18,6 +18,7 @@ spack:
     - gfal2-util
     - graphviz
     - imagemagick
+    - iwyu
     - nopayloadclient
     - ollama
     - py-numpy
@@ -45,7 +46,6 @@ spack:
   - heppdt
   - irt
   - irt2
-  - iwyu
   - jana2
   - just
   - npsim -geocad
diff --git a/spack-environment/xl/spack.yaml b/spack-environment/xl/spack.yaml
index 282fded7d..ceb754bf2 100644
--- a/spack-environment/xl/spack.yaml
+++ b/spack-environment/xl/spack.yaml
@@ -22,6 +22,7 @@ spack:
     - graphviz
     - herwig3
     - imagemagick
+    - iwyu
     - lager
     - lcov
     - madx
@@ -77,7 +78,6 @@ spack:
   - heppdt
   - irt
   - irt2
-  - iwyu
   - jana2
   - just
   - lhapdf

From 23783e46afb3b57b53c9cefc85da477596497d3b Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 16 Oct 2026 15:51:57 -0500
Subject: [PATCH 088/106] ci(macos): separate build into /opt/software and
 install into cvmfs prefix

- Set CVMFS publish location to unpacked.cern.ch/ghcr.io/eic/mac_<env>:nightly
- Phase 1: Build packages into /opt/software with 128-byte padding and populate local/remote buildcaches
- Phase 2: Relocate and install environment specs from buildcache into target prefix with colons in path
- Hardcode tag to nightly for testing deployment to unpacked.cern.ch
---
 .github/workflows/macos-ci.yml | 80 +++++++++++++++++++---------------
 1 file changed, 44 insertions(+), 36 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 09729dca6..8ee76529a 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -28,8 +28,8 @@ jobs:
     env:
       GITHUB_REGISTRY_USER: ${{ secrets.GHCR_REGISTRY_USER }}
       GITHUB_REGISTRY_TOKEN: ${{ secrets.GHCR_REGISTRY_TOKEN }}
-      CVMFS_REPO: singularity.opensciencegrid.org
-      CVMFS_PATH_PREFIX: eicweb
+      CVMFS_REPO: unpacked.cern.ch
+      CVMFS_PATH_PREFIX: ghcr.io/eic
       PUBLISH_IMAGE_REPO: ghcr.io/${{ github.repository_owner }}
       SPACK_INSTALL_FLAGS: "--no-check-signature --show-log-on-error"
 
@@ -197,24 +197,15 @@ jobs:
           fi
           sudo /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -t || true
 
-          # The environments' views (view.yaml) default to /opt/local and
-          # /opt/detector, which Spack touches during environment initialization
-          # before custom views are applied. Spack also renames the view directory,
-          # so /opt itself must be writable.
-          sudo mkdir -p /opt/local /opt/detector
-          sudo chown "$(id -u):$(id -g)" /opt /opt/local /opt/detector
+          # Create directories for Phase 1 build in /opt and make /opt writable
+          sudo mkdir -p /opt/software /opt/local /opt/detector
+          sudo chown -R "$(id -u):$(id -g)" /opt
 
-          # Determine tags and install root
+          # Target image name, tag, and install prefix
           IMAGE_NAME="mac_${{ matrix.ENV }}"
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            PRIMARY_TAG="unstable-pr-${{ github.event.pull_request.number }}"
-          elif [ "${{ github.ref_name }}" = "master" ]; then
-            PRIMARY_TAG="nightly"
-          else
-            PRIMARY_TAG="${{ github.ref_name }}"
-          fi
+          PRIMARY_TAG="nightly"
 
-          INSTALL_PREFIX="/cvmfs/${{ env.CVMFS_REPO }}/${{ env.CVMFS_PATH_PREFIX }}/${IMAGE_NAME}-${PRIMARY_TAG}"
+          INSTALL_PREFIX="/cvmfs/${{ env.CVMFS_REPO }}/${{ env.CVMFS_PATH_PREFIX }}/${IMAGE_NAME}:${PRIMARY_TAG}"
           echo "install-prefix=${INSTALL_PREFIX}" >> $GITHUB_OUTPUT
           echo "image-name=${IMAGE_NAME}" >> $GITHUB_OUTPUT
           echo "primary-tag=${PRIMARY_TAG}" >> $GITHUB_OUTPUT
@@ -223,19 +214,6 @@ jobs:
                    "${INSTALL_PREFIX}/opt/local" \
                    "${INSTALL_PREFIX}/opt/detector" \
                    "${INSTALL_PREFIX}/opt/spack-environment"
-          ln -sfn "${IMAGE_NAME}-${PRIMARY_TAG}" "/cvmfs/${{ env.CVMFS_REPO }}/${{ env.CVMFS_PATH_PREFIX }}/${IMAGE_NAME}:${PRIMARY_TAG}"
-
-      - name: Add Spack environment
-        run: |
-          set -x
-          spack compiler find --scope site
-          spack external find --scope site llvm
-          INSTALL_PREFIX="${{ steps.cvmfs-dirs.outputs.install-prefix }}"
-          spack config --scope site add "config:install_tree:root:'${INSTALL_PREFIX}/opt/software'"
-          spack config --scope site add "config:install_tree:padded_length:128"
-          spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:{}"
-          spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:default:root:'${INSTALL_PREFIX}/opt/local'"
-          spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:detectors:root:'${INSTALL_PREFIX}/opt/detector'"
 
       - name: Configure buildcache
         env:
@@ -244,6 +222,8 @@ jobs:
           # get no secrets and only read from the (public) buildcache.
           PUSH_BUILDCACHE: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
         run: |
+          mkdir -p /tmp/buildcache
+          spack mirror add --scope site --autopush --unsigned local-buildcache file:///tmp/buildcache
           mirror=oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
           if [ "${PUSH_BUILDCACHE}" = "true" ] && [ -n "${GITHUB_REGISTRY_TOKEN}" ]; then
             spack mirror add --scope site eic \
@@ -255,30 +235,58 @@ jobs:
             echo "Buildcache is read-only for this run"
             spack mirror add --scope site eic --unsigned "${mirror}"
           fi
+          spack mirror list
+
+      - name: Configure Spack build tree
+        run: |
+          set -x
+          spack compiler find --scope site
+          spack external find --scope site llvm
+          spack config --scope site add "config:install_tree:root:'/opt/software'"
+          spack config --scope site add "config:install_tree:padded_length:128"
 
       - name: Concretize base environment
         run: |
           spack -e spack-environment/${{matrix.ENV}} -c view:false concretize --force
 
-      - name: Install base environment
+      - name: Build base environment
         run: |
           spack -e spack-environment/${{matrix.ENV}} -c view:false install ${{ env.SPACK_INSTALL_FLAGS }}
 
-      - name: Add epic environment
+      - name: Concretize epic environment
+        run: |
+          spack -e spack-environment/${{matrix.ENV}}/epic -c view:false concretize --force
+
+      - name: Build epic environment
+        run: |
+          spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install ${{ env.SPACK_INSTALL_FLAGS }}
+
+      - name: Sync local buildcache
+        run: |
+          spack -e spack-environment/${{matrix.ENV}} buildcache push --unsigned --update-index local-buildcache || true
+          spack -e spack-environment/${{matrix.ENV}}/epic buildcache push --unsigned --update-index local-buildcache || true
+          spack buildcache update-index local-buildcache || true
+
+      - name: Configure Spack target install tree
         run: |
           set -x
           INSTALL_PREFIX="${{ steps.cvmfs-dirs.outputs.install-prefix }}"
+          spack config --scope site add "config:install_tree:root:'${INSTALL_PREFIX}/opt/software'"
+          spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:{}"
+          spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:default:root:'${INSTALL_PREFIX}/opt/local'"
+          spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:detectors:root:'${INSTALL_PREFIX}/opt/detector'"
           spack -e spack-environment/${{ matrix.ENV }}/epic -c view:false config add "view:{}"
           spack -e spack-environment/${{ matrix.ENV }}/epic -c view:false config add "view:default:root:'${INSTALL_PREFIX}/opt/local'"
           spack -e spack-environment/${{ matrix.ENV }}/epic -c view:false config add "view:detectors:root:'${INSTALL_PREFIX}/opt/detector'"
+          spack config get config
 
-      - name: Concretize epic environment
+      - name: Install base environment into target prefix
         run: |
-          spack -e spack-environment/${{matrix.ENV}}/epic -c view:false concretize --force
+          spack -e spack-environment/${{matrix.ENV}} -c view:false install ${{ env.SPACK_INSTALL_FLAGS }} --use-buildcache only
 
-      - name: Install epic environment
+      - name: Install epic environment into target prefix
         run: |
-          spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install ${{ env.SPACK_INSTALL_FLAGS }}
+          spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install ${{ env.SPACK_INSTALL_FLAGS }} --use-buildcache only
 
       - name: Garbage collect build-only dependencies
         run: |

From 395c1ea7468b95cb307a2228afde6c5f4e27a12f Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 16 Oct 2026 16:05:15 -0500
Subject: [PATCH 089/106] refactor(ci): split macos workflow into build and
 install jobs

- Job 1 (build): Builds missing packages into /opt/software with padding and autopushes to GHCR buildcache
- Job 2 (install): Installs environment specs from network buildcache into CVMFS target prefix, regenerates views, tests, and publishes container image
- Only the remote buildcache serves as intermediary between the jobs
---
 .github/workflows/macos-ci.yml | 286 +++++++++++++++++++++++++++------
 1 file changed, 234 insertions(+), 52 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 8ee76529a..95798578b 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -17,22 +17,23 @@ permissions:
   contents: read
   packages: write
 
+env:
+  GITHUB_REGISTRY_USER: ${{ secrets.GHCR_REGISTRY_USER }}
+  GITHUB_REGISTRY_TOKEN: ${{ secrets.GHCR_REGISTRY_TOKEN }}
+  CVMFS_REPO: unpacked.cern.ch
+  CVMFS_PATH_PREFIX: ghcr.io/eic
+  PUBLISH_IMAGE_REPO: ghcr.io/${{ github.repository_owner }}
+  SPACK_INSTALL_FLAGS: "--no-check-signature --show-log-on-error"
+
 jobs:
   build:
+    name: Build (${{ matrix.ENV }})
     runs-on: macos-latest
     strategy:
       fail-fast: false
       matrix:
         ENV: [ci, xl, tf]
 
-    env:
-      GITHUB_REGISTRY_USER: ${{ secrets.GHCR_REGISTRY_USER }}
-      GITHUB_REGISTRY_TOKEN: ${{ secrets.GHCR_REGISTRY_TOKEN }}
-      CVMFS_REPO: unpacked.cern.ch
-      CVMFS_PATH_PREFIX: ghcr.io/eic
-      PUBLISH_IMAGE_REPO: ghcr.io/${{ github.repository_owner }}
-      SPACK_INSTALL_FLAGS: "--no-check-signature --show-log-on-error"
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
@@ -186,44 +187,23 @@ jobs:
           cd ${{ github.workspace }}/spack
           spack repo add var/spack/repos/eic-spack/spack_repo/eic
 
-      - name: Setup CVMFS mount point and install directories
-        id: cvmfs-dirs
+      - name: Setup build directory
         run: |
-          # Set up synthetic firmlink for /cvmfs on macOS
-          sudo mkdir -p /System/Volumes/Data/cvmfs
-          sudo chown -R "$(id -u):$(id -g)" /System/Volumes/Data/cvmfs
-          if ! grep -q '^cvmfs[[:space:]]' /etc/synthetic.conf 2>/dev/null; then
-            printf 'cvmfs\tSystem/Volumes/Data/cvmfs\n' | sudo tee -a /etc/synthetic.conf
-          fi
-          sudo /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -t || true
-
-          # Create directories for Phase 1 build in /opt and make /opt writable
           sudo mkdir -p /opt/software /opt/local /opt/detector
           sudo chown -R "$(id -u):$(id -g)" /opt
 
-          # Target image name, tag, and install prefix
-          IMAGE_NAME="mac_${{ matrix.ENV }}"
-          PRIMARY_TAG="nightly"
-
-          INSTALL_PREFIX="/cvmfs/${{ env.CVMFS_REPO }}/${{ env.CVMFS_PATH_PREFIX }}/${IMAGE_NAME}:${PRIMARY_TAG}"
-          echo "install-prefix=${INSTALL_PREFIX}" >> $GITHUB_OUTPUT
-          echo "image-name=${IMAGE_NAME}" >> $GITHUB_OUTPUT
-          echo "primary-tag=${PRIMARY_TAG}" >> $GITHUB_OUTPUT
-
-          mkdir -p "${INSTALL_PREFIX}/opt/software" \
-                   "${INSTALL_PREFIX}/opt/local" \
-                   "${INSTALL_PREFIX}/opt/detector" \
-                   "${INSTALL_PREFIX}/opt/spack-environment"
+      - name: Configure Spack build tree
+        run: |
+          set -x
+          spack compiler find --scope site
+          spack external find --scope site llvm
+          spack config --scope site add "config:install_tree:root:'/opt/software'"
+          spack config --scope site add "config:install_tree:padded_length:128"
 
       - name: Configure buildcache
         env:
-          # Only push to the buildcache from trusted contexts: pushes to
-          # master, manual runs, and PRs from this repository. PRs from forks
-          # get no secrets and only read from the (public) buildcache.
           PUSH_BUILDCACHE: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
         run: |
-          mkdir -p /tmp/buildcache
-          spack mirror add --scope site --autopush --unsigned local-buildcache file:///tmp/buildcache
           mirror=oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
           if [ "${PUSH_BUILDCACHE}" = "true" ] && [ -n "${GITHUB_REGISTRY_TOKEN}" ]; then
             spack mirror add --scope site eic \
@@ -237,14 +217,6 @@ jobs:
           fi
           spack mirror list
 
-      - name: Configure Spack build tree
-        run: |
-          set -x
-          spack compiler find --scope site
-          spack external find --scope site llvm
-          spack config --scope site add "config:install_tree:root:'/opt/software'"
-          spack config --scope site add "config:install_tree:padded_length:128"
-
       - name: Concretize base environment
         run: |
           spack -e spack-environment/${{matrix.ENV}} -c view:false concretize --force
@@ -261,15 +233,205 @@ jobs:
         run: |
           spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install ${{ env.SPACK_INSTALL_FLAGS }}
 
-      - name: Sync local buildcache
+      - name: Diagnose numpy import
+        if: failure()
+        continue-on-error: true
+        run: |
+          for env in spack-environment/${{matrix.ENV}} spack-environment/${{matrix.ENV}}/epic; do
+            echo "::group::${env}"
+            spack -e "${env}" -c view:false find -lpv py-numpy openblas || true
+            echo "--- loaded environment"
+            (
+              eval "$(spack -e "${env}" -c view:false load --sh py-numpy)"
+              cd /tmp
+              python3 -c 'import numpy; print(numpy.__version__, numpy.__file__)' 2>&1 | tail -30
+              so=$(find "$(spack -e "${env}" -c view:false location -i py-numpy)" -name '_multiarray_umath*.so' | head -1)
+              otool -L "${so}"
+            ) || true
+            echo "--- build environment of a failing dependent"
+            for pkg in py-scipy py-numexpr; do
+              spack -e "${env}" -c view:false build-env "${pkg}" -- \
+                python3 -c 'import sys, numpy; print(numpy.__file__)' 2>&1 | tail -40 || true
+            done
+            echo "::endgroup::"
+          done
+
+  install:
+    name: Install & Publish (${{ matrix.ENV }})
+    needs: [build]
+    runs-on: macos-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ENV: [ci, xl, tf]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Extract Spack configuration
+        id: spack-config
+        run: |
+          # Source spack.sh to get SPACK_VERSION and SPACK_CHERRYPICKS
+          source spack.sh
+          echo "spack-version=${SPACK_VERSION}" >> $GITHUB_OUTPUT
+          echo "spack-cherrypicks<<EOF" >> $GITHUB_OUTPUT
+          echo "${SPACK_CHERRYPICKS}" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+          # Source spack-packages.sh to get SPACKPACKAGES_VERSION and SPACKPACKAGES_CHERRYPICKS
+          source spack-packages.sh
+          echo "spackpackages-version=${SPACKPACKAGES_VERSION}" >> $GITHUB_OUTPUT
+          echo "spackpackages-cherrypicks<<EOF" >> $GITHUB_OUTPUT
+          echo "${SPACKPACKAGES_CHERRYPICKS}" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+          # Source key4hep-spack.sh to get KEY4HEPSPACK_VERSION
+          source key4hep-spack.sh
+          echo "key4hepspack-version=${KEY4HEPSPACK_VERSION}" >> $GITHUB_OUTPUT
+
+          # Source eic-spack.sh to get EICSPACK_VERSION
+          source eic-spack.sh
+          echo "eicspack-version=${EICSPACK_VERSION}" >> $GITHUB_OUTPUT
+
+          # Extract buildcache URL from mirrors.yaml.in (simplified - get the version)
+          echo "buildcache-version=${SPACKPACKAGES_VERSION}" >> $GITHUB_OUTPUT
+
+      - name: Checkout Spack repository
+        uses: actions/checkout@v7
+        with:
+          repository: spack/spack
+          path: spack
+          ref: ${{ steps.spack-config.outputs.spack-version }}
+          fetch-depth: 0
+
+      - name: Configure spack
         run: |
-          spack -e spack-environment/${{matrix.ENV}} buildcache push --unsigned --update-index local-buildcache || true
-          spack -e spack-environment/${{matrix.ENV}}/epic buildcache push --unsigned --update-index local-buildcache || true
-          spack buildcache update-index local-buildcache || true
+          cd ${{ github.workspace }}/spack
+          echo "${{ github.workspace }}/spack/bin" >> $GITHUB_PATH
+          git config user.name "GitHub Actions"
+          git config user.email "actions@github.com"
+
+          # Fetch branches from which we cherry-pick
+          git fetch origin refs/heads/develop:refs/heads/develop
+          git fetch origin pull/51584/head:pr-51584
+          git fetch origin pull/52207/head:pr-52207
+
+          # Apply cherry-picks from spack.sh (match only valid git commit hashes)
+          while read -r commit; do
+            # Commits on branches/forks not fetched above are served by SHA
+            if ! git cat-file -e "${commit}^{commit}" 2>/dev/null; then
+              echo "Fetching ${commit} by SHA"
+              git fetch origin "${commit}"
+            fi
+            if git merge-base --is-ancestor "${commit}" HEAD; then
+              echo "Skipping already applied ${commit}"
+              continue
+            fi
+            echo "Cherry-picking ${commit}"
+            git cherry-pick "${commit}"
+          done < <(echo "${{ steps.spack-config.outputs.spack-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
+
+      - name: Checkout spack-packages repository
+        uses: actions/checkout@v7
+        with:
+          repository: spack/spack-packages
+          path: spack/var/spack/repos/spack-packages
+          fetch-depth: 0
+          ref: ${{ steps.spack-config.outputs.spackpackages-version }}
+
+      - name: Configure spack-packages
+        run: |
+          cd ${{ github.workspace }}/spack/var/spack/repos/spack-packages
+          git config user.name "GitHub Actions"
+          git config user.email "actions@github.com"
+
+          # Fetch branches from which we cherry-pick
+          git fetch origin refs/heads/develop:refs/heads/develop
+          git fetch origin pull/3698/head:pr-3698
+          git fetch origin pull/4871/head:pr-4871
+          git fetch origin pull/5856/head:pr-5856
+
+          # Apply cherry-picks from spack-packages.sh (match only valid git commit hashes)
+          while read -r commit; do
+            # Commits on forks/unmerged PRs are not in the default clone, but
+            # GitHub serves any commit in the fork network by SHA from the parent
+            if ! git cat-file -e "${commit}^{commit}" 2>/dev/null; then
+              echo "Fetching ${commit} by SHA"
+              git fetch origin "${commit}"
+            fi
+            if git merge-base --is-ancestor "${commit}" HEAD; then
+              echo "Skipping already applied ${commit}"
+              continue
+            fi
+            echo "Cherry-picking ${commit}"
+            git cherry-pick "${commit}"
+          done < <(echo "${{ steps.spack-config.outputs.spackpackages-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
+
+          cd ${{ github.workspace }}/spack
+          spack repo add var/spack/repos/spack-packages/repos/spack_repo/builtin
+
+      - name: Checkout key4hep-spack repository
+        uses: actions/checkout@v7
+        with:
+          repository: key4hep/key4hep-spack
+          path: spack/var/spack/repos/key4hep-spack
+          ref: ${{ steps.spack-config.outputs.key4hepspack-version }}
+
+      - name: Configure key4hep-spack
+        run: |
+          cd ${{ github.workspace }}/spack
+          spack repo add var/spack/repos/key4hep-spack
+
+      - name: Checkout eic-spack repository
+        uses: actions/checkout@v7
+        with:
+          repository: eic/eic-spack
+          path: spack/var/spack/repos/eic-spack
+          ref: ${{ steps.spack-config.outputs.eicspack-version }}
+
+      - name: Configure eic-spack
+        run: |
+          cd ${{ github.workspace }}/spack
+          spack repo add var/spack/repos/eic-spack/spack_repo/eic
+
+      - name: Setup CVMFS mount point and install directories
+        id: cvmfs-dirs
+        run: |
+          # Set up synthetic firmlink for /cvmfs on macOS
+          sudo mkdir -p /System/Volumes/Data/cvmfs
+          sudo chown -R "$(id -u):$(id -g)" /System/Volumes/Data/cvmfs
+          if ! grep -q '^cvmfs[[:space:]]' /etc/synthetic.conf 2>/dev/null; then
+            printf 'cvmfs\tSystem/Volumes/Data/cvmfs\n' | sudo tee -a /etc/synthetic.conf
+          fi
+          sudo /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -t || true
+
+          # The environments' views (view.yaml) default to /opt/local and
+          # /opt/detector, which Spack touches during environment initialization
+          # before custom views are applied. Spack also renames the view directory,
+          # so /opt itself must be writable.
+          sudo mkdir -p /opt/local /opt/detector
+          sudo chown "$(id -u):$(id -g)" /opt /opt/local /opt/detector
+
+          # Target image name, tag, and install prefix
+          IMAGE_NAME="mac_${{ matrix.ENV }}"
+          PRIMARY_TAG="nightly"
+
+          INSTALL_PREFIX="/cvmfs/${{ env.CVMFS_REPO }}/${{ env.CVMFS_PATH_PREFIX }}/${IMAGE_NAME}:${PRIMARY_TAG}"
+          echo "install-prefix=${INSTALL_PREFIX}" >> $GITHUB_OUTPUT
+          echo "image-name=${IMAGE_NAME}" >> $GITHUB_OUTPUT
+          echo "primary-tag=${PRIMARY_TAG}" >> $GITHUB_OUTPUT
+
+          mkdir -p "${INSTALL_PREFIX}/opt/software" \
+                   "${INSTALL_PREFIX}/opt/local" \
+                   "${INSTALL_PREFIX}/opt/detector" \
+                   "${INSTALL_PREFIX}/opt/spack-environment"
 
       - name: Configure Spack target install tree
         run: |
           set -x
+          spack compiler find --scope site
+          spack external find --scope site llvm
           INSTALL_PREFIX="${{ steps.cvmfs-dirs.outputs.install-prefix }}"
           spack config --scope site add "config:install_tree:root:'${INSTALL_PREFIX}/opt/software'"
           spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:{}"
@@ -280,10 +442,33 @@ jobs:
           spack -e spack-environment/${{ matrix.ENV }}/epic -c view:false config add "view:detectors:root:'${INSTALL_PREFIX}/opt/detector'"
           spack config get config
 
+      - name: Configure buildcache
+        run: |
+          mirror=oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
+          if [ -n "${GITHUB_REGISTRY_TOKEN}" ]; then
+            spack mirror add --scope site eic \
+              --unsigned \
+              --oci-username-variable GITHUB_REGISTRY_USER \
+              --oci-password-variable GITHUB_REGISTRY_TOKEN \
+              "${mirror}"
+          else
+            echo "Buildcache is read-only for this run"
+            spack mirror add --scope site eic --unsigned "${mirror}"
+          fi
+          spack mirror list
+
+      - name: Concretize base environment
+        run: |
+          spack -e spack-environment/${{matrix.ENV}} -c view:false concretize --force
+
       - name: Install base environment into target prefix
         run: |
           spack -e spack-environment/${{matrix.ENV}} -c view:false install ${{ env.SPACK_INSTALL_FLAGS }} --use-buildcache only
 
+      - name: Concretize epic environment
+        run: |
+          spack -e spack-environment/${{matrix.ENV}}/epic -c view:false concretize --force
+
       - name: Install epic environment into target prefix
         run: |
           spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install ${{ env.SPACK_INSTALL_FLAGS }} --use-buildcache only
@@ -397,9 +582,6 @@ jobs:
         if: failure()
         continue-on-error: true
         run: |
-          # Surface the real exception behind numpy's generic
-          # "should not import numpy from its source directory" message,
-          # both in a plain loaded environment and in a package build environment
           for env in spack-environment/${{matrix.ENV}} spack-environment/${{matrix.ENV}}/epic; do
             echo "::group::${env}"
             spack -e "${env}" -c view:false find -lpv py-numpy openblas || true

From fd47a186b451caa1630f86c3efc1f3c7cdb00a6d Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 16 Oct 2026 16:25:34 -0500
Subject: [PATCH 090/106] ci(macos): cache spack checkouts & concretizer cache,
 pass lockfiles as artifacts

- Use actions/cache@v4 for Spack repositories across jobs
- Use actions/cache@v4 for Spack concretization cache (~/.spack/cache/concretization)
- Upload spack.lock files as workflow artifacts in build job
- Download lockfiles in install job and skip concretization entirely
---
 .github/workflows/macos-ci.yml | 87 +++++++++++++++++++++++++++-------
 1 file changed, 71 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 95798578b..ddb491431 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -66,7 +66,15 @@ jobs:
           # Extract buildcache URL from mirrors.yaml.in (simplified - get the version)
           echo "buildcache-version=${SPACKPACKAGES_VERSION}" >> $GITHUB_OUTPUT
 
+      - name: Cache Spack checkouts
+        id: cache-spack
+        uses: actions/cache@v4
+        with:
+          path: spack
+          key: spack-repos-${{ runner.os }}-${{ hashFiles('spack.sh', 'spack-packages.sh', 'key4hep-spack.sh', 'eic-spack.sh') }}
+
       - name: Checkout Spack repository
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         uses: actions/checkout@v7
         with:
           repository: spack/spack
@@ -75,9 +83,9 @@ jobs:
           fetch-depth: 0
 
       - name: Configure spack
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         run: |
           cd ${{ github.workspace }}/spack
-          echo "${{ github.workspace }}/spack/bin" >> $GITHUB_PATH
           git config user.name "GitHub Actions"
           git config user.email "actions@github.com"
 
@@ -125,6 +133,7 @@ jobs:
           '
 
       - name: Checkout spack-packages repository
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         uses: actions/checkout@v7
         with:
           repository: spack/spack-packages
@@ -133,6 +142,7 @@ jobs:
           ref: ${{ steps.spack-config.outputs.spackpackages-version }}
 
       - name: Configure spack-packages
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         run: |
           cd ${{ github.workspace }}/spack/var/spack/repos/spack-packages
           git config user.name "GitHub Actions"
@@ -161,9 +171,10 @@ jobs:
           done < <(echo "${{ steps.spack-config.outputs.spackpackages-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
 
           cd ${{ github.workspace }}/spack
-          spack repo add var/spack/repos/spack-packages/repos/spack_repo/builtin
+          spack repo add --scope site var/spack/repos/spack-packages/repos/spack_repo/builtin
 
       - name: Checkout key4hep-spack repository
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         uses: actions/checkout@v7
         with:
           repository: key4hep/key4hep-spack
@@ -171,11 +182,13 @@ jobs:
           ref: ${{ steps.spack-config.outputs.key4hepspack-version }}
 
       - name: Configure key4hep-spack
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         run: |
           cd ${{ github.workspace }}/spack
-          spack repo add var/spack/repos/key4hep-spack
+          spack repo add --scope site var/spack/repos/key4hep-spack
 
       - name: Checkout eic-spack repository
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         uses: actions/checkout@v7
         with:
           repository: eic/eic-spack
@@ -183,9 +196,22 @@ jobs:
           ref: ${{ steps.spack-config.outputs.eicspack-version }}
 
       - name: Configure eic-spack
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         run: |
           cd ${{ github.workspace }}/spack
-          spack repo add var/spack/repos/eic-spack/spack_repo/eic
+          spack repo add --scope site var/spack/repos/eic-spack/spack_repo/eic
+
+      - name: Add Spack to PATH
+        run: echo "${{ github.workspace }}/spack/bin" >> $GITHUB_PATH
+
+      - name: Cache Spack concretizer
+        uses: actions/cache@v4
+        with:
+          path: ~/.spack/cache/concretization
+          key: spack-concretizer-${{ runner.os }}-${{ matrix.ENV }}-${{ hashFiles('spack.sh', 'spack-packages.sh', 'key4hep-spack.sh', 'eic-spack.sh', 'spack-environment/**') }}
+          restore-keys: |
+            spack-concretizer-${{ runner.os }}-${{ matrix.ENV }}-
+            spack-concretizer-${{ runner.os }}-
 
       - name: Setup build directory
         run: |
@@ -233,6 +259,15 @@ jobs:
         run: |
           spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install ${{ env.SPACK_INSTALL_FLAGS }}
 
+      - name: Upload Spack lockfiles
+        uses: actions/upload-artifact@v4
+        with:
+          name: spack-locks-${{ matrix.ENV }}
+          path: |
+            spack-environment/${{ matrix.ENV }}/spack.lock
+            spack-environment/${{ matrix.ENV }}/epic/spack.lock
+          if-no-files-found: error
+
       - name: Diagnose numpy import
         if: failure()
         continue-on-error: true
@@ -297,7 +332,15 @@ jobs:
           # Extract buildcache URL from mirrors.yaml.in (simplified - get the version)
           echo "buildcache-version=${SPACKPACKAGES_VERSION}" >> $GITHUB_OUTPUT
 
+      - name: Cache Spack checkouts
+        id: cache-spack
+        uses: actions/cache@v4
+        with:
+          path: spack
+          key: spack-repos-${{ runner.os }}-${{ hashFiles('spack.sh', 'spack-packages.sh', 'key4hep-spack.sh', 'eic-spack.sh') }}
+
       - name: Checkout Spack repository
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         uses: actions/checkout@v7
         with:
           repository: spack/spack
@@ -306,9 +349,9 @@ jobs:
           fetch-depth: 0
 
       - name: Configure spack
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         run: |
           cd ${{ github.workspace }}/spack
-          echo "${{ github.workspace }}/spack/bin" >> $GITHUB_PATH
           git config user.name "GitHub Actions"
           git config user.email "actions@github.com"
 
@@ -333,6 +376,7 @@ jobs:
           done < <(echo "${{ steps.spack-config.outputs.spack-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
 
       - name: Checkout spack-packages repository
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         uses: actions/checkout@v7
         with:
           repository: spack/spack-packages
@@ -341,6 +385,7 @@ jobs:
           ref: ${{ steps.spack-config.outputs.spackpackages-version }}
 
       - name: Configure spack-packages
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         run: |
           cd ${{ github.workspace }}/spack/var/spack/repos/spack-packages
           git config user.name "GitHub Actions"
@@ -369,9 +414,10 @@ jobs:
           done < <(echo "${{ steps.spack-config.outputs.spackpackages-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
 
           cd ${{ github.workspace }}/spack
-          spack repo add var/spack/repos/spack-packages/repos/spack_repo/builtin
+          spack repo add --scope site var/spack/repos/spack-packages/repos/spack_repo/builtin
 
       - name: Checkout key4hep-spack repository
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         uses: actions/checkout@v7
         with:
           repository: key4hep/key4hep-spack
@@ -379,11 +425,13 @@ jobs:
           ref: ${{ steps.spack-config.outputs.key4hepspack-version }}
 
       - name: Configure key4hep-spack
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         run: |
           cd ${{ github.workspace }}/spack
-          spack repo add var/spack/repos/key4hep-spack
+          spack repo add --scope site var/spack/repos/key4hep-spack
 
       - name: Checkout eic-spack repository
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         uses: actions/checkout@v7
         with:
           repository: eic/eic-spack
@@ -391,9 +439,13 @@ jobs:
           ref: ${{ steps.spack-config.outputs.eicspack-version }}
 
       - name: Configure eic-spack
+        if: steps.cache-spack.outputs.cache-hit != 'true'
         run: |
           cd ${{ github.workspace }}/spack
-          spack repo add var/spack/repos/eic-spack/spack_repo/eic
+          spack repo add --scope site var/spack/repos/eic-spack/spack_repo/eic
+
+      - name: Add Spack to PATH
+        run: echo "${{ github.workspace }}/spack/bin" >> $GITHUB_PATH
 
       - name: Setup CVMFS mount point and install directories
         id: cvmfs-dirs
@@ -427,6 +479,17 @@ jobs:
                    "${INSTALL_PREFIX}/opt/detector" \
                    "${INSTALL_PREFIX}/opt/spack-environment"
 
+      - name: Download Spack lockfiles
+        uses: actions/download-artifact@v4
+        with:
+          name: spack-locks-${{ matrix.ENV }}
+          path: spack-environment/${{ matrix.ENV }}
+
+      - name: Verify Spack lockfiles
+        run: |
+          ls -la "spack-environment/${{ matrix.ENV }}/spack.lock"
+          ls -la "spack-environment/${{ matrix.ENV }}/epic/spack.lock"
+
       - name: Configure Spack target install tree
         run: |
           set -x
@@ -457,18 +520,10 @@ jobs:
           fi
           spack mirror list
 
-      - name: Concretize base environment
-        run: |
-          spack -e spack-environment/${{matrix.ENV}} -c view:false concretize --force
-
       - name: Install base environment into target prefix
         run: |
           spack -e spack-environment/${{matrix.ENV}} -c view:false install ${{ env.SPACK_INSTALL_FLAGS }} --use-buildcache only
 
-      - name: Concretize epic environment
-        run: |
-          spack -e spack-environment/${{matrix.ENV}}/epic -c view:false concretize --force
-
       - name: Install epic environment into target prefix
         run: |
           spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install ${{ env.SPACK_INSTALL_FLAGS }} --use-buildcache only

From 130dd90de51478ab416f2e1436882519586cb0af Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 16 Oct 2026 16:55:28 -0500
Subject: [PATCH 091/106] feat(ci): ensure Spack in PATH early and build only
 missing packages in Phase 1

---
 .github/workflows/macos-ci.yml | 50 ++++++++++++++++++++--------
 scripts/check-buildcache.py    | 60 ++++++++++++++++++++++++++++++++++
 2 files changed, 96 insertions(+), 14 deletions(-)
 create mode 100755 scripts/check-buildcache.py

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index ddb491431..aa733790e 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -73,6 +73,9 @@ jobs:
           path: spack
           key: spack-repos-${{ runner.os }}-${{ hashFiles('spack.sh', 'spack-packages.sh', 'key4hep-spack.sh', 'eic-spack.sh') }}
 
+      - name: Add Spack to PATH
+        run: echo "${{ github.workspace }}/spack/bin" >> $GITHUB_PATH
+
       - name: Checkout Spack repository
         if: steps.cache-spack.outputs.cache-hit != 'true'
         uses: actions/checkout@v7
@@ -171,7 +174,7 @@ jobs:
           done < <(echo "${{ steps.spack-config.outputs.spackpackages-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
 
           cd ${{ github.workspace }}/spack
-          spack repo add --scope site var/spack/repos/spack-packages/repos/spack_repo/builtin
+          bin/spack repo add --scope site var/spack/repos/spack-packages/repos/spack_repo/builtin
 
       - name: Checkout key4hep-spack repository
         if: steps.cache-spack.outputs.cache-hit != 'true'
@@ -185,7 +188,7 @@ jobs:
         if: steps.cache-spack.outputs.cache-hit != 'true'
         run: |
           cd ${{ github.workspace }}/spack
-          spack repo add --scope site var/spack/repos/key4hep-spack
+          bin/spack repo add --scope site var/spack/repos/key4hep-spack
 
       - name: Checkout eic-spack repository
         if: steps.cache-spack.outputs.cache-hit != 'true'
@@ -199,10 +202,7 @@ jobs:
         if: steps.cache-spack.outputs.cache-hit != 'true'
         run: |
           cd ${{ github.workspace }}/spack
-          spack repo add --scope site var/spack/repos/eic-spack/spack_repo/eic
-
-      - name: Add Spack to PATH
-        run: echo "${{ github.workspace }}/spack/bin" >> $GITHUB_PATH
+          bin/spack repo add --scope site var/spack/repos/eic-spack/spack_repo/eic
 
       - name: Cache Spack concretizer
         uses: actions/cache@v4
@@ -249,7 +249,18 @@ jobs:
 
       - name: Build base environment
         run: |
-          spack -e spack-environment/${{matrix.ENV}} -c view:false install ${{ env.SPACK_INSTALL_FLAGS }}
+          mirror=oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
+          status=0
+          missing=$(spack python scripts/check-buildcache.py "spack-environment/${{ matrix.ENV }}" "$mirror") || status=$?
+          if [ "$status" -eq 0 ]; then
+            echo "All packages in base environment already exist in buildcache. Skipping build."
+          elif [ -n "$missing" ]; then
+            echo "Building missing spec(s) from base environment: $missing"
+            spack -e spack-environment/${{matrix.ENV}} -c view:false install ${{ env.SPACK_INSTALL_FLAGS }} $missing
+          else
+            echo "Warning: check-buildcache failed with status $status; falling back to full environment install"
+            spack -e spack-environment/${{matrix.ENV}} -c view:false install ${{ env.SPACK_INSTALL_FLAGS }}
+          fi
 
       - name: Concretize epic environment
         run: |
@@ -257,7 +268,18 @@ jobs:
 
       - name: Build epic environment
         run: |
-          spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install ${{ env.SPACK_INSTALL_FLAGS }}
+          mirror=oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
+          status=0
+          missing=$(spack python scripts/check-buildcache.py "spack-environment/${{ matrix.ENV }}/epic" "$mirror") || status=$?
+          if [ "$status" -eq 0 ]; then
+            echo "All packages in epic environment already exist in buildcache. Skipping build."
+          elif [ -n "$missing" ]; then
+            echo "Building missing spec(s) from epic environment: $missing"
+            spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install ${{ env.SPACK_INSTALL_FLAGS }} $missing
+          else
+            echo "Warning: check-buildcache failed with status $status; falling back to full environment install"
+            spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install ${{ env.SPACK_INSTALL_FLAGS }}
+          fi
 
       - name: Upload Spack lockfiles
         uses: actions/upload-artifact@v4
@@ -339,6 +361,9 @@ jobs:
           path: spack
           key: spack-repos-${{ runner.os }}-${{ hashFiles('spack.sh', 'spack-packages.sh', 'key4hep-spack.sh', 'eic-spack.sh') }}
 
+      - name: Add Spack to PATH
+        run: echo "${{ github.workspace }}/spack/bin" >> $GITHUB_PATH
+
       - name: Checkout Spack repository
         if: steps.cache-spack.outputs.cache-hit != 'true'
         uses: actions/checkout@v7
@@ -414,7 +439,7 @@ jobs:
           done < <(echo "${{ steps.spack-config.outputs.spackpackages-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
 
           cd ${{ github.workspace }}/spack
-          spack repo add --scope site var/spack/repos/spack-packages/repos/spack_repo/builtin
+          bin/spack repo add --scope site var/spack/repos/spack-packages/repos/spack_repo/builtin
 
       - name: Checkout key4hep-spack repository
         if: steps.cache-spack.outputs.cache-hit != 'true'
@@ -428,7 +453,7 @@ jobs:
         if: steps.cache-spack.outputs.cache-hit != 'true'
         run: |
           cd ${{ github.workspace }}/spack
-          spack repo add --scope site var/spack/repos/key4hep-spack
+          bin/spack repo add --scope site var/spack/repos/key4hep-spack
 
       - name: Checkout eic-spack repository
         if: steps.cache-spack.outputs.cache-hit != 'true'
@@ -442,10 +467,7 @@ jobs:
         if: steps.cache-spack.outputs.cache-hit != 'true'
         run: |
           cd ${{ github.workspace }}/spack
-          spack repo add --scope site var/spack/repos/eic-spack/spack_repo/eic
-
-      - name: Add Spack to PATH
-        run: echo "${{ github.workspace }}/spack/bin" >> $GITHUB_PATH
+          bin/spack repo add --scope site var/spack/repos/eic-spack/spack_repo/eic
 
       - name: Setup CVMFS mount point and install directories
         id: cvmfs-dirs
diff --git a/scripts/check-buildcache.py b/scripts/check-buildcache.py
new file mode 100755
index 000000000..31124644f
--- /dev/null
+++ b/scripts/check-buildcache.py
@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+# Copyright 2026 Electron-Ion Collider
+# SPDX-License-Identifier: Apache-2.0
+"""Check concrete specs of a Spack environment against a binary buildcache.
+
+Outputs missing spec DAG hashes (prefixed with '/') to stdout, separated by spaces.
+Exits with 0 if all specs exist in the buildcache, or 1 if any specs are missing.
+"""
+
+import concurrent.futures
+import sys
+
+import spack.environment as ev
+from spack.binary_distribution import _oci_default_tag, _oci_get_blob_info
+from spack.oci.image import ImageReference
+
+
+def main():
+    if len(sys.argv) < 3:
+        print("Usage: check-buildcache.py <env-dir> <mirror-url>", file=sys.stderr)
+        sys.exit(2)
+
+    env_dir = sys.argv[1]
+    mirror_url = sys.argv[2]
+
+    env = ev.Environment(env_dir)
+    all_specs = env.all_specs()
+    if not all_specs:
+        print(f"No specs in environment {env_dir}", file=sys.stderr)
+        sys.exit(0)
+
+    target_image = ImageReference.from_url(mirror_url)
+    print(f"Checking {len(all_specs)} specs against {mirror_url}...", file=sys.stderr)
+
+    def is_missing(spec):
+        tag = _oci_default_tag(spec)
+        ref = target_image.with_tag(tag)
+        blob = _oci_get_blob_info(ref)
+        return spec, (blob is None)
+
+    missing = []
+    with concurrent.futures.ThreadPoolExecutor(max_workers=16) as pool:
+        for spec, missing_flag in pool.map(is_missing, all_specs):
+            if missing_flag:
+                missing.append(spec)
+
+    if missing:
+        print(f"Found {len(missing)} missing spec(s) that need to be built:", file=sys.stderr)
+        for s in missing:
+            print(f"  - {s.short_spec} (/{s.dag_hash()})", file=sys.stderr)
+        hashes = [f"/{s.dag_hash()}" for s in missing]
+        print(" ".join(hashes))
+        sys.exit(1)
+    else:
+        print(f"All {len(all_specs)} specs already exist in buildcache.", file=sys.stderr)
+        sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

From 9a130075cc5183cfd957f86164e69edfa3068dba Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 16 Oct 2026 17:13:11 -0500
Subject: [PATCH 092/106] feat(ci): cache bootstrap store, add bootstrap step,
 and fix check-buildcache output

---
 .github/workflows/macos-ci.yml | 33 +++++++++++++++++++++++++--------
 scripts/check-buildcache.py    | 24 ++++++++++++++++++------
 2 files changed, 43 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index aa733790e..2f57e50da 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -204,6 +204,19 @@ jobs:
           cd ${{ github.workspace }}/spack
           bin/spack repo add --scope site var/spack/repos/eic-spack/spack_repo/eic
 
+      - name: Cache Spack bootstrap store
+        uses: actions/cache@v4
+        with:
+          path: ~/.spack/bootstrap/store
+          key: spack-bootstrap-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('spack.sh') }}
+          restore-keys: |
+            spack-bootstrap-${{ runner.os }}-${{ runner.arch }}-
+
+      - name: Bootstrap Spack
+        run: |
+          spack bootstrap now
+          spack bootstrap status
+
       - name: Cache Spack concretizer
         uses: actions/cache@v4
         with:
@@ -251,12 +264,14 @@ jobs:
         run: |
           mirror=oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
           status=0
-          missing=$(spack python scripts/check-buildcache.py "spack-environment/${{ matrix.ENV }}" "$mirror") || status=$?
-          if [ "$status" -eq 0 ]; then
-            echo "All packages in base environment already exist in buildcache. Skipping build."
-          elif [ -n "$missing" ]; then
+          rm -f rebuild.txt
+          spack python scripts/check-buildcache.py "spack-environment/${{ matrix.ENV }}" "$mirror" rebuild.txt || status=$?
+          if [ -s rebuild.txt ]; then
+            missing=$(cat rebuild.txt)
             echo "Building missing spec(s) from base environment: $missing"
             spack -e spack-environment/${{matrix.ENV}} -c view:false install ${{ env.SPACK_INSTALL_FLAGS }} $missing
+          elif [ "$status" -eq 0 ]; then
+            echo "All packages in base environment already exist in buildcache. Skipping build."
           else
             echo "Warning: check-buildcache failed with status $status; falling back to full environment install"
             spack -e spack-environment/${{matrix.ENV}} -c view:false install ${{ env.SPACK_INSTALL_FLAGS }}
@@ -270,12 +285,14 @@ jobs:
         run: |
           mirror=oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
           status=0
-          missing=$(spack python scripts/check-buildcache.py "spack-environment/${{ matrix.ENV }}/epic" "$mirror") || status=$?
-          if [ "$status" -eq 0 ]; then
-            echo "All packages in epic environment already exist in buildcache. Skipping build."
-          elif [ -n "$missing" ]; then
+          rm -f rebuild.txt
+          spack python scripts/check-buildcache.py "spack-environment/${{ matrix.ENV }}/epic" "$mirror" rebuild.txt || status=$?
+          if [ -s rebuild.txt ]; then
+            missing=$(cat rebuild.txt)
             echo "Building missing spec(s) from epic environment: $missing"
             spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install ${{ env.SPACK_INSTALL_FLAGS }} $missing
+          elif [ "$status" -eq 0 ]; then
+            echo "All packages in epic environment already exist in buildcache. Skipping build."
           else
             echo "Warning: check-buildcache failed with status $status; falling back to full environment install"
             spack -e spack-environment/${{matrix.ENV}}/epic -c view:false install ${{ env.SPACK_INSTALL_FLAGS }}
diff --git a/scripts/check-buildcache.py b/scripts/check-buildcache.py
index 31124644f..e4ec573e6 100755
--- a/scripts/check-buildcache.py
+++ b/scripts/check-buildcache.py
@@ -3,7 +3,8 @@
 # SPDX-License-Identifier: Apache-2.0
 """Check concrete specs of a Spack environment against a binary buildcache.
 
-Outputs missing spec DAG hashes (prefixed with '/') to stdout, separated by spaces.
+Ignores external packages (which cannot be built by Spack).
+Outputs missing spec DAG hashes (prefixed with '/') to output-file (or stdout).
 Exits with 0 if all specs exist in the buildcache, or 1 if any specs are missing.
 """
 
@@ -17,20 +18,24 @@
 
 def main():
     if len(sys.argv) < 3:
-        print("Usage: check-buildcache.py <env-dir> <mirror-url>", file=sys.stderr)
+        print("Usage: check-buildcache.py <env-dir> <mirror-url> [output-file]", file=sys.stderr)
         sys.exit(2)
 
     env_dir = sys.argv[1]
     mirror_url = sys.argv[2]
+    output_file = sys.argv[3] if len(sys.argv) > 3 else None
 
     env = ev.Environment(env_dir)
-    all_specs = env.all_specs()
+    # Ignore external specs as they are pre-installed on the host / not built
+    all_specs = [s for s in env.all_specs() if not s.external]
     if not all_specs:
-        print(f"No specs in environment {env_dir}", file=sys.stderr)
+        print(f"No non-external specs in environment {env_dir}", file=sys.stderr)
+        if output_file:
+            open(output_file, "w").close()
         sys.exit(0)
 
     target_image = ImageReference.from_url(mirror_url)
-    print(f"Checking {len(all_specs)} specs against {mirror_url}...", file=sys.stderr)
+    print(f"Checking {len(all_specs)} non-external specs against {mirror_url}...", file=sys.stderr)
 
     def is_missing(spec):
         tag = _oci_default_tag(spec)
@@ -49,10 +54,17 @@ def is_missing(spec):
         for s in missing:
             print(f"  - {s.short_spec} (/{s.dag_hash()})", file=sys.stderr)
         hashes = [f"/{s.dag_hash()}" for s in missing]
-        print(" ".join(hashes))
+        hashes_str = " ".join(hashes)
+        if output_file:
+            with open(output_file, "w", encoding="utf-8") as f:
+                f.write(hashes_str + "\n")
+        else:
+            print(hashes_str)
         sys.exit(1)
     else:
         print(f"All {len(all_specs)} specs already exist in buildcache.", file=sys.stderr)
+        if output_file:
+            open(output_file, "w").close()
         sys.exit(0)
 
 

From 24a550a7311351f1958cc6522b9e6066d620cdb2 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Fri, 16 Oct 2026 19:35:22 -0500
Subject: [PATCH 093/106] chore: remove copyright and SPDX license header from
 check-buildcache.py

---
 scripts/check-buildcache.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/scripts/check-buildcache.py b/scripts/check-buildcache.py
index e4ec573e6..018676a06 100755
--- a/scripts/check-buildcache.py
+++ b/scripts/check-buildcache.py
@@ -1,6 +1,4 @@
 #!/usr/bin/env python3
-# Copyright 2026 Electron-Ion Collider
-# SPDX-License-Identifier: Apache-2.0
 """Check concrete specs of a Spack environment against a binary buildcache.
 
 Ignores external packages (which cannot be built by Spack).

From 4d9c487c41daf9929a32af0de6bf25cd36e87afa Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 17 Oct 2026 18:02:01 -0500
Subject: [PATCH 094/106] fix(macos-ci): ensure configure buildcache is
 idempotent on cache hit

---
 .github/workflows/macos-ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 2f57e50da..8a5502ac1 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -244,6 +244,7 @@ jobs:
           PUSH_BUILDCACHE: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
         run: |
           mirror=oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
+          spack mirror rm --scope site eic 2>/dev/null || true
           if [ "${PUSH_BUILDCACHE}" = "true" ] && [ -n "${GITHUB_REGISTRY_TOKEN}" ]; then
             spack mirror add --scope site eic \
               --autopush --unsigned \
@@ -547,6 +548,7 @@ jobs:
       - name: Configure buildcache
         run: |
           mirror=oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
+          spack mirror rm --scope site eic 2>/dev/null || true
           if [ -n "${GITHUB_REGISTRY_TOKEN}" ]; then
             spack mirror add --scope site eic \
               --unsigned \

From 82b77a2eae4cdf6f098ca077d9e51faabf0ae45b Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 17 Oct 2026 18:06:11 -0500
Subject: [PATCH 095/106] fix(macos-ci): skip mirror configuration when exact
 mirror is already present

---
 .github/workflows/macos-ci.yml | 48 +++++++++++++++++++++-------------
 1 file changed, 30 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 8a5502ac1..6d60096f3 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -244,16 +244,22 @@ jobs:
           PUSH_BUILDCACHE: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
         run: |
           mirror=oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
-          spack mirror rm --scope site eic 2>/dev/null || true
-          if [ "${PUSH_BUILDCACHE}" = "true" ] && [ -n "${GITHUB_REGISTRY_TOKEN}" ]; then
-            spack mirror add --scope site eic \
-              --autopush --unsigned \
-              --oci-username-variable GITHUB_REGISTRY_USER \
-              --oci-password-variable GITHUB_REGISTRY_TOKEN \
-              "${mirror}"
+          if spack mirror list | grep -E '^eic[[:space:]]' | grep -F -q "${mirror}"; then
+            echo "Mirror eic (${mirror}) already configured, skipping"
           else
-            echo "Buildcache is read-only for this run"
-            spack mirror add --scope site eic --unsigned "${mirror}"
+            if spack mirror list | grep -q -E '^eic[[:space:]]'; then
+              spack mirror rm --scope site eic
+            fi
+            if [ "${PUSH_BUILDCACHE}" = "true" ] && [ -n "${GITHUB_REGISTRY_TOKEN}" ]; then
+              spack mirror add --scope site eic \
+                --autopush --unsigned \
+                --oci-username-variable GITHUB_REGISTRY_USER \
+                --oci-password-variable GITHUB_REGISTRY_TOKEN \
+                "${mirror}"
+            else
+              echo "Buildcache is read-only for this run"
+              spack mirror add --scope site eic --unsigned "${mirror}"
+            fi
           fi
           spack mirror list
 
@@ -548,16 +554,22 @@ jobs:
       - name: Configure buildcache
         run: |
           mirror=oci://ghcr.io/eic/spack-${{ steps.spack-config.outputs.buildcache-version }}
-          spack mirror rm --scope site eic 2>/dev/null || true
-          if [ -n "${GITHUB_REGISTRY_TOKEN}" ]; then
-            spack mirror add --scope site eic \
-              --unsigned \
-              --oci-username-variable GITHUB_REGISTRY_USER \
-              --oci-password-variable GITHUB_REGISTRY_TOKEN \
-              "${mirror}"
+          if spack mirror list | grep -E '^eic[[:space:]]' | grep -F -q "${mirror}"; then
+            echo "Mirror eic (${mirror}) already configured, skipping"
           else
-            echo "Buildcache is read-only for this run"
-            spack mirror add --scope site eic --unsigned "${mirror}"
+            if spack mirror list | grep -q -E '^eic[[:space:]]'; then
+              spack mirror rm --scope site eic
+            fi
+            if [ -n "${GITHUB_REGISTRY_TOKEN}" ]; then
+              spack mirror add --scope site eic \
+                --unsigned \
+                --oci-username-variable GITHUB_REGISTRY_USER \
+                --oci-password-variable GITHUB_REGISTRY_TOKEN \
+                "${mirror}"
+            else
+              echo "Buildcache is read-only for this run"
+              spack mirror add --scope site eic --unsigned "${mirror}"
+            fi
           fi
           spack mirror list
 

From 5801ad4c594e606ae3db278ae290a9bc4a666285 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 17 Oct 2026 19:50:16 -0500
Subject: [PATCH 096/106] fix(macos-ci): support /System/Volumes/Data firmlinks
 in spack relocation

---
 .github/workflows/macos-ci.yml | 103 +++++++++++++++++++++++++++------
 1 file changed, 84 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 6d60096f3..23bb6593e 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -112,27 +112,48 @@ jobs:
             git cherry-pick "${commit}"
           done < <(echo "${{ steps.spack-config.outputs.spack-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
 
-          # Fallback to source build when binary relocation fails (e.g. unpadded binaries in buildcache)
+      - name: Patch Spack
+        run: |
           python3 -c '
           import pathlib
-          path = pathlib.Path("lib/spack/spack/new_installer.py")
-          content = path.read_text()
-          old = (
-              "    send_state(\"relocating\", state_stream)\n"
-              "    spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False)"
-          )
-          new = (
-              "    send_state(\"relocating\", state_stream)\n"
-              "    try:\n"
-              "        spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False)\n"
-              "    except Exception as e:\n"
-              "        shutil.rmtree(spec.prefix, ignore_errors=True)\n"
-              "        spack.llnl.util.tty.warn(f\"Failed to install {spec.name} from binary cache ({e}); falling back to source build\")\n"
-              "        return False"
-          )
-          if old in content:
-              path.write_text(content.replace(old, new, 1))
-              print("Patched new_installer.py to fall back to source build on binary relocation failure")
+          p_new_installer = pathlib.Path("${{ github.workspace }}/spack/lib/spack/spack/new_installer.py")
+          if p_new_installer.exists():
+              content = p_new_installer.read_text()
+              old = (
+                  "    send_state(\"relocating\", state_stream)\n"
+                  "    spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False)"
+              )
+              new = (
+                  "    send_state(\"relocating\", state_stream)\n"
+                  "    try:\n"
+                  "        spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False)\n"
+                  "    except Exception as e:\n"
+                  "        shutil.rmtree(spec.prefix, ignore_errors=True)\n"
+                  "        spack.llnl.util.tty.warn(f\"Failed to install {spec.name} from binary cache ({e}); falling back to source build\")\n"
+                  "        return False"
+              )
+              if old in content:
+                  p_new_installer.write_text(content.replace(old, new, 1))
+                  print("Patched new_installer.py to fall back to source build on binary relocation failure")
+
+          p_bin_dist = pathlib.Path("${{ github.workspace }}/spack/lib/spack/spack/binary_distribution.py")
+          if p_bin_dist.exists():
+              content = p_bin_dist.read_text()
+              old = "    # Only then add the generic fallback of install prefix -> install prefix.\n    prefix_to_prefix[old_layout_root] = str(spack.store.STORE.layout.root)\n"
+              new = (
+                  "    # Only then add the generic fallback of install prefix -> install prefix.\n"
+                  "    prefix_to_prefix[old_layout_root] = str(spack.store.STORE.layout.root)\n"
+                  "    if sys.platform == \"darwin\":\n"
+                  "        for old_p, new_p in list(prefix_to_prefix.items()):\n"
+                  "            if old_p and old_p != \"/\":\n"
+                  "                if old_p.startswith(\"/System/Volumes/Data\"):\n"
+                  "                    prefix_to_prefix[old_p[len(\"/System/Volumes/Data\"):]] = new_p\n"
+                  "                else:\n"
+                  "                    prefix_to_prefix[\"/System/Volumes/Data\" + old_p] = new_p\n"
+              )
+              if old in content:
+                  p_bin_dist.write_text(content.replace(old, new, 1))
+                  print("Patched binary_distribution.py for macOS synthetic firmlink relocation")
           '
 
       - name: Checkout spack-packages repository
@@ -424,6 +445,50 @@ jobs:
             git cherry-pick "${commit}"
           done < <(echo "${{ steps.spack-config.outputs.spack-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
 
+      - name: Patch Spack
+        run: |
+          python3 -c '
+          import pathlib
+          p_new_installer = pathlib.Path("${{ github.workspace }}/spack/lib/spack/spack/new_installer.py")
+          if p_new_installer.exists():
+              content = p_new_installer.read_text()
+              old = (
+                  "    send_state(\"relocating\", state_stream)\n"
+                  "    spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False)"
+              )
+              new = (
+                  "    send_state(\"relocating\", state_stream)\n"
+                  "    try:\n"
+                  "        spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False)\n"
+                  "    except Exception as e:\n"
+                  "        shutil.rmtree(spec.prefix, ignore_errors=True)\n"
+                  "        spack.llnl.util.tty.warn(f\"Failed to install {spec.name} from binary cache ({e}); falling back to source build\")\n"
+                  "        return False"
+              )
+              if old in content:
+                  p_new_installer.write_text(content.replace(old, new, 1))
+                  print("Patched new_installer.py to fall back to source build on binary relocation failure")
+
+          p_bin_dist = pathlib.Path("${{ github.workspace }}/spack/lib/spack/spack/binary_distribution.py")
+          if p_bin_dist.exists():
+              content = p_bin_dist.read_text()
+              old = "    # Only then add the generic fallback of install prefix -> install prefix.\n    prefix_to_prefix[old_layout_root] = str(spack.store.STORE.layout.root)\n"
+              new = (
+                  "    # Only then add the generic fallback of install prefix -> install prefix.\n"
+                  "    prefix_to_prefix[old_layout_root] = str(spack.store.STORE.layout.root)\n"
+                  "    if sys.platform == \"darwin\":\n"
+                  "        for old_p, new_p in list(prefix_to_prefix.items()):\n"
+                  "            if old_p and old_p != \"/\":\n"
+                  "                if old_p.startswith(\"/System/Volumes/Data\"):\n"
+                  "                    prefix_to_prefix[old_p[len(\"/System/Volumes/Data\"):]] = new_p\n"
+                  "                else:\n"
+                  "                    prefix_to_prefix[\"/System/Volumes/Data\" + old_p] = new_p\n"
+              )
+              if old in content:
+                  p_bin_dist.write_text(content.replace(old, new, 1))
+                  print("Patched binary_distribution.py for macOS synthetic firmlink relocation")
+          '
+
       - name: Checkout spack-packages repository
         if: steps.cache-spack.outputs.cache-hit != 'true'
         uses: actions/checkout@v7

From 09316423ff3962f6515de0fc7b220a32cd4c843c Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 17 Oct 2026 20:05:55 -0500
Subject: [PATCH 097/106] Revert "fix(macos-ci): support /System/Volumes/Data
 firmlinks in spack relocation"

This reverts commit 5bc8aac3cb220d9e417e9a6c22491642e441723a.
---
 .github/workflows/macos-ci.yml | 103 ++++++---------------------------
 1 file changed, 19 insertions(+), 84 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 23bb6593e..6d60096f3 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -112,48 +112,27 @@ jobs:
             git cherry-pick "${commit}"
           done < <(echo "${{ steps.spack-config.outputs.spack-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
 
-      - name: Patch Spack
-        run: |
+          # Fallback to source build when binary relocation fails (e.g. unpadded binaries in buildcache)
           python3 -c '
           import pathlib
-          p_new_installer = pathlib.Path("${{ github.workspace }}/spack/lib/spack/spack/new_installer.py")
-          if p_new_installer.exists():
-              content = p_new_installer.read_text()
-              old = (
-                  "    send_state(\"relocating\", state_stream)\n"
-                  "    spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False)"
-              )
-              new = (
-                  "    send_state(\"relocating\", state_stream)\n"
-                  "    try:\n"
-                  "        spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False)\n"
-                  "    except Exception as e:\n"
-                  "        shutil.rmtree(spec.prefix, ignore_errors=True)\n"
-                  "        spack.llnl.util.tty.warn(f\"Failed to install {spec.name} from binary cache ({e}); falling back to source build\")\n"
-                  "        return False"
-              )
-              if old in content:
-                  p_new_installer.write_text(content.replace(old, new, 1))
-                  print("Patched new_installer.py to fall back to source build on binary relocation failure")
-
-          p_bin_dist = pathlib.Path("${{ github.workspace }}/spack/lib/spack/spack/binary_distribution.py")
-          if p_bin_dist.exists():
-              content = p_bin_dist.read_text()
-              old = "    # Only then add the generic fallback of install prefix -> install prefix.\n    prefix_to_prefix[old_layout_root] = str(spack.store.STORE.layout.root)\n"
-              new = (
-                  "    # Only then add the generic fallback of install prefix -> install prefix.\n"
-                  "    prefix_to_prefix[old_layout_root] = str(spack.store.STORE.layout.root)\n"
-                  "    if sys.platform == \"darwin\":\n"
-                  "        for old_p, new_p in list(prefix_to_prefix.items()):\n"
-                  "            if old_p and old_p != \"/\":\n"
-                  "                if old_p.startswith(\"/System/Volumes/Data\"):\n"
-                  "                    prefix_to_prefix[old_p[len(\"/System/Volumes/Data\"):]] = new_p\n"
-                  "                else:\n"
-                  "                    prefix_to_prefix[\"/System/Volumes/Data\" + old_p] = new_p\n"
-              )
-              if old in content:
-                  p_bin_dist.write_text(content.replace(old, new, 1))
-                  print("Patched binary_distribution.py for macOS synthetic firmlink relocation")
+          path = pathlib.Path("lib/spack/spack/new_installer.py")
+          content = path.read_text()
+          old = (
+              "    send_state(\"relocating\", state_stream)\n"
+              "    spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False)"
+          )
+          new = (
+              "    send_state(\"relocating\", state_stream)\n"
+              "    try:\n"
+              "        spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False)\n"
+              "    except Exception as e:\n"
+              "        shutil.rmtree(spec.prefix, ignore_errors=True)\n"
+              "        spack.llnl.util.tty.warn(f\"Failed to install {spec.name} from binary cache ({e}); falling back to source build\")\n"
+              "        return False"
+          )
+          if old in content:
+              path.write_text(content.replace(old, new, 1))
+              print("Patched new_installer.py to fall back to source build on binary relocation failure")
           '
 
       - name: Checkout spack-packages repository
@@ -445,50 +424,6 @@ jobs:
             git cherry-pick "${commit}"
           done < <(echo "${{ steps.spack-config.outputs.spack-cherrypicks }}" | grep -E '^[a-f0-9]{40}$' || true)
 
-      - name: Patch Spack
-        run: |
-          python3 -c '
-          import pathlib
-          p_new_installer = pathlib.Path("${{ github.workspace }}/spack/lib/spack/spack/new_installer.py")
-          if p_new_installer.exists():
-              content = p_new_installer.read_text()
-              old = (
-                  "    send_state(\"relocating\", state_stream)\n"
-                  "    spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False)"
-              )
-              new = (
-                  "    send_state(\"relocating\", state_stream)\n"
-                  "    try:\n"
-                  "        spack.binary_distribution.extract_tarball(spec, tarball_stage, force=False)\n"
-                  "    except Exception as e:\n"
-                  "        shutil.rmtree(spec.prefix, ignore_errors=True)\n"
-                  "        spack.llnl.util.tty.warn(f\"Failed to install {spec.name} from binary cache ({e}); falling back to source build\")\n"
-                  "        return False"
-              )
-              if old in content:
-                  p_new_installer.write_text(content.replace(old, new, 1))
-                  print("Patched new_installer.py to fall back to source build on binary relocation failure")
-
-          p_bin_dist = pathlib.Path("${{ github.workspace }}/spack/lib/spack/spack/binary_distribution.py")
-          if p_bin_dist.exists():
-              content = p_bin_dist.read_text()
-              old = "    # Only then add the generic fallback of install prefix -> install prefix.\n    prefix_to_prefix[old_layout_root] = str(spack.store.STORE.layout.root)\n"
-              new = (
-                  "    # Only then add the generic fallback of install prefix -> install prefix.\n"
-                  "    prefix_to_prefix[old_layout_root] = str(spack.store.STORE.layout.root)\n"
-                  "    if sys.platform == \"darwin\":\n"
-                  "        for old_p, new_p in list(prefix_to_prefix.items()):\n"
-                  "            if old_p and old_p != \"/\":\n"
-                  "                if old_p.startswith(\"/System/Volumes/Data\"):\n"
-                  "                    prefix_to_prefix[old_p[len(\"/System/Volumes/Data\"):]] = new_p\n"
-                  "                else:\n"
-                  "                    prefix_to_prefix[\"/System/Volumes/Data\" + old_p] = new_p\n"
-              )
-              if old in content:
-                  p_bin_dist.write_text(content.replace(old, new, 1))
-                  print("Patched binary_distribution.py for macOS synthetic firmlink relocation")
-          '
-
       - name: Checkout spack-packages repository
         if: steps.cache-spack.outputs.cache-hit != 'true'
         uses: actions/checkout@v7

From 7dd23734a6dd820d0e104ee7835dab1d96bd7222 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sat, 17 Oct 2026 22:19:11 -0500
Subject: [PATCH 098/106] ci(macos): bump actions/cache to v6, upload-artifact
 to v7, and download-artifact to v8

---
 .github/workflows/macos-ci.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 6d60096f3..8a8859d02 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -68,7 +68,7 @@ jobs:
 
       - name: Cache Spack checkouts
         id: cache-spack
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: spack
           key: spack-repos-${{ runner.os }}-${{ hashFiles('spack.sh', 'spack-packages.sh', 'key4hep-spack.sh', 'eic-spack.sh') }}
@@ -205,7 +205,7 @@ jobs:
           bin/spack repo add --scope site var/spack/repos/eic-spack/spack_repo/eic
 
       - name: Cache Spack bootstrap store
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.spack/bootstrap/store
           key: spack-bootstrap-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('spack.sh') }}
@@ -218,7 +218,7 @@ jobs:
           spack bootstrap status
 
       - name: Cache Spack concretizer
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.spack/cache/concretization
           key: spack-concretizer-${{ runner.os }}-${{ matrix.ENV }}-${{ hashFiles('spack.sh', 'spack-packages.sh', 'key4hep-spack.sh', 'eic-spack.sh', 'spack-environment/**') }}
@@ -306,7 +306,7 @@ jobs:
           fi
 
       - name: Upload Spack lockfiles
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: spack-locks-${{ matrix.ENV }}
           path: |
@@ -380,7 +380,7 @@ jobs:
 
       - name: Cache Spack checkouts
         id: cache-spack
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: spack
           key: spack-repos-${{ runner.os }}-${{ hashFiles('spack.sh', 'spack-packages.sh', 'key4hep-spack.sh', 'eic-spack.sh') }}
@@ -526,7 +526,7 @@ jobs:
                    "${INSTALL_PREFIX}/opt/spack-environment"
 
       - name: Download Spack lockfiles
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: spack-locks-${{ matrix.ENV }}
           path: spack-environment/${{ matrix.ENV }}

From 9c153f7bfefd5f9b872b1357cb119b6f5b5f0162 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 18 Oct 2026 10:50:09 -0500
Subject: [PATCH 099/106] fix(ci): ensure setup.sh uses target CVMFS prefix for
 SPACK_ENV and clean PATH

---
 .github/workflows/macos-ci.yml | 41 +++++++++++++++++++++++++++++-----
 1 file changed, 35 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 8a8859d02..17059acca 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -522,8 +522,7 @@ jobs:
 
           mkdir -p "${INSTALL_PREFIX}/opt/software" \
                    "${INSTALL_PREFIX}/opt/local" \
-                   "${INSTALL_PREFIX}/opt/detector" \
-                   "${INSTALL_PREFIX}/opt/spack-environment"
+                   "${INSTALL_PREFIX}/opt/detector"
 
       - name: Download Spack lockfiles
         uses: actions/download-artifact@v8
@@ -597,10 +596,43 @@ jobs:
         run: |
           INSTALL_PREFIX="${{ steps.cvmfs-dirs.outputs.install-prefix }}"
 
+          # Copy spack environment definition into target prefix
+          mkdir -p "${INSTALL_PREFIX}/opt"
+          rm -rf "${INSTALL_PREFIX}/opt/spack-environment"
+          cp -r spack-environment "${INSTALL_PREFIX}/opt/spack-environment"
+
           # Generate portable setup.sh for macOS users from Spack environment
-          spack env activate --sh --dir spack-environment/${{matrix.ENV}}/epic > "${INSTALL_PREFIX}/setup.sh"
+          spack env activate --sh --dir "${INSTALL_PREFIX}/opt/spack-environment/${{matrix.ENV}}/epic" > "${INSTALL_PREFIX}/setup.sh"
           chmod +x "${INSTALL_PREFIX}/setup.sh"
 
+          # Ensure SPACK_ENV points under CVMFS target prefix and clean up runner-specific paths
+          python3 - "${INSTALL_PREFIX}" "${GITHUB_WORKSPACE}" << 'EOF'
+          import pathlib, re, sys
+          prefix = sys.argv[1]
+          workspace = sys.argv[2]
+          path = pathlib.Path(prefix) / "setup.sh"
+          content = path.read_text()
+
+          # Ensure SPACK_ENV points under target prefix
+          content = content.replace(
+              f"{workspace}/spack-environment",
+              f"{prefix}/opt/spack-environment"
+          )
+
+          # Clean PATH: retain target prefix/CVMFS bin directories and append ${PATH}
+          def clean_path(match):
+              val = match.group(1).strip("\"'")
+              placeholder = "__INSTALL_PREFIX__"
+              val_safe = val.replace(prefix, placeholder)
+              parts = val_safe.split(":")
+              dirs = [p.replace(placeholder, prefix) for p in parts if p.startswith(placeholder) or p.startswith("/cvmfs")]
+              bin_dirs = ":".join(dirs)
+              return f"export PATH={bin_dirs}:${{PATH}};"
+
+          content = re.sub(r"^export PATH=([^;\n]+);", clean_path, content, flags=re.MULTILINE)
+          path.write_text(content)
+          EOF
+
           # Detector symlinks fixup
           if [ -d "${INSTALL_PREFIX}/opt/detector" ]; then
             (
@@ -615,9 +647,6 @@ jobs:
             )
           fi
 
-          # Copy spack environment definition
-          cp -r spack-environment "${INSTALL_PREFIX}/opt/spack-environment"
-
           # Place CVMFS catalog markers
           touch "${INSTALL_PREFIX}/opt/software/.cvmfscatalog"
           find "${INSTALL_PREFIX}/opt/software" -mindepth 1 -maxdepth 2 -type d -exec touch {}/.cvmfscatalog \;

From 7a35589b931c54ed5656d536cef311f0d5a26d38 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Sun, 18 Oct 2026 10:51:41 -0500
Subject: [PATCH 100/106] fix(ci): avoid GitHub Actions expression syntax in
 setup.sh script

---
 .github/workflows/macos-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 17059acca..88037238f 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -627,7 +627,7 @@ jobs:
               parts = val_safe.split(":")
               dirs = [p.replace(placeholder, prefix) for p in parts if p.startswith(placeholder) or p.startswith("/cvmfs")]
               bin_dirs = ":".join(dirs)
-              return f"export PATH={bin_dirs}:${{PATH}};"
+              return f"export PATH={bin_dirs}:" + "${PATH};"
 
           content = re.sub(r"^export PATH=([^;\n]+);", clean_path, content, flags=re.MULTILINE)
           path.write_text(content)

From b19c4c3854d90bdafd07fda1654a9b7b6343d5d1 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Mon, 19 Oct 2026 15:59:20 -0500
Subject: [PATCH 101/106] fix(spack): adjust geant4 variants for macOS
 compatibility

- Remove ~x11 requirement on Darwin in packages_darwin.yaml (x11 variant
  is only defined when platform=linux in spack-packages v2026.10.0).
- Enforce ~opengl ~qt for geant4 on Darwin, matching conflicts('+opengl',
  when='platform=darwin') in geant4 recipe.
- Use conditional  definition (+opengl on Linux, -opengl on Darwin)
  in xl/spack.yaml.
- Condition geant4 requirement on platform (+opengl on Linux, ~opengl on
  Darwin) in xl/epic/spack.yaml.
---
 spack-environment/packages_darwin.yaml | 3 +--
 spack-environment/xl/epic/spack.yaml   | 5 ++++-
 spack-environment/xl/spack.yaml        | 6 +++++-
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/spack-environment/packages_darwin.yaml b/spack-environment/packages_darwin.yaml
index b735f56e2..34e210131 100644
--- a/spack-environment/packages_darwin.yaml
+++ b/spack-environment/packages_darwin.yaml
@@ -19,8 +19,7 @@ packages:
     - apple-clang
   geant4:
     require:
-    - any_of: [+opengl +qt, -opengl -qt]
-    - ~x11
+    - ~opengl ~qt
   gl:
     require:
     - apple-gl
diff --git a/spack-environment/xl/epic/spack.yaml b/spack-environment/xl/epic/spack.yaml
index 8accd5cbd..ba5ba34f7 100644
--- a/spack-environment/xl/epic/spack.yaml
+++ b/spack-environment/xl/epic/spack.yaml
@@ -17,7 +17,10 @@ spack:
   packages:
     geant4:
       require:
-      - +opengl
+      - when: platform=linux
+        spec: +opengl
+      - when: platform=darwin
+        spec: ~opengl
   specs:
   - algorithms
   - edm4eic
diff --git a/spack-environment/xl/spack.yaml b/spack-environment/xl/spack.yaml
index ceb754bf2..b6b3901a0 100644
--- a/spack-environment/xl/spack.yaml
+++ b/spack-environment/xl/spack.yaml
@@ -12,6 +12,10 @@ spack:
   definitions:
   # Note that in definitions 'when' takes a python expression as argument
   # https://spack.readthedocs.io/en/latest/environments.html#spec-list-references
+  - when: arch.satisfies("platform=linux")
+    geant4: [geant4 +opengl]
+  - when: arch.satisfies("platform=darwin")
+    geant4: [geant4 -opengl]
   - when: arch.satisfies("platform=linux")
     linux_packages:
     - dawncut
@@ -71,7 +75,7 @@ spack:
   - fjcontrib
   - fmt
   - g4occt
-  - geant4 +opengl
+  - $geant4
   - github-copilot
   - hepmc3
   - hepmcmerger

From 3482eaf81d50bc923b7f8e6779735babaaa47518 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Mon, 19 Oct 2026 16:15:30 -0500
Subject: [PATCH 102/106] ci(macos): add independent job testing existing CVMFS
 deployment

Add a test-cvmfs job that runs concurrently on macos-latest without
depending on the build or install jobs. It uses cvmfs-contrib/github-action-cvmfs@v5
to mount unpacked.cern.ch and test the existing mac_ci:nightly deployment,
verifying setup.sh activation and functionality of python3 and root.exe.
---
 .github/workflows/macos-ci.yml | 53 ++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 88037238f..f8d5c018a 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -737,3 +737,56 @@ jobs:
             done
             echo "::endgroup::"
           done
+
+  test-cvmfs:
+    name: Test CVMFS Deployment (${{ matrix.ENV }})
+    runs-on: macos-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ENV: [ci]
+
+    steps:
+      - name: Setup CernVM-FS
+        uses: cvmfs-contrib/github-action-cvmfs@v5
+        with:
+          cvmfs_repositories: ${{ env.CVMFS_REPO }}
+
+      - name: Test deployed environment
+        run: |
+          DEPLOY_PREFIX="/cvmfs/${{ env.CVMFS_REPO }}/${{ env.CVMFS_PATH_PREFIX }}/mac_${{ matrix.ENV }}:nightly"
+          echo "Checking CVMFS mount at /cvmfs/${{ env.CVMFS_REPO }}..."
+          ls -ld "/cvmfs/${{ env.CVMFS_REPO }}"
+
+          echo "Checking deployed environment directory at ${DEPLOY_PREFIX}..."
+          if [ ! -d "${DEPLOY_PREFIX}" ]; then
+            echo "Error: Directory ${DEPLOY_PREFIX} not found!"
+            ls -la "/cvmfs/${{ env.CVMFS_REPO }}/${{ env.CVMFS_PATH_PREFIX }}" || true
+            exit 1
+          fi
+
+          ls -la "${DEPLOY_PREFIX}"
+
+          echo "=== setup.sh contents ==="
+          cat "${DEPLOY_PREFIX}/setup.sh"
+
+          # If setup.sh references singularity.opensciencegrid.org (from older builds),
+          # set up a compatibility firmlink/symlink so those paths resolve on the runner
+          if grep -q "singularity.opensciencegrid.org" "${DEPLOY_PREFIX}/setup.sh"; then
+            echo "Creating compatibility symlink for singularity.opensciencegrid.org prefix..."
+            TARGET_DIR=$(readlink /cvmfs 2>/dev/null || echo "/Users/Shared/cvmfs")
+            sudo mkdir -p "${TARGET_DIR}/singularity.opensciencegrid.org/eicweb"
+            sudo ln -sfn "${DEPLOY_PREFIX}" "${TARGET_DIR}/singularity.opensciencegrid.org/eicweb/mac_ci-unstable-pr-95"
+          fi
+
+          echo "=== Activating environment ==="
+          source "${DEPLOY_PREFIX}/setup.sh"
+
+          echo "which python3: $(which python3)"
+          python3 --version
+          python3 -c "import sys; print('Python sys.path:', sys.path)"
+
+          if command -v root.exe >/dev/null 2>&1; then
+            echo "Testing ROOT..."
+            root.exe -b -q -e 'std::cout << "ROOT " << gROOT->GetVersion() << " functional\n"; gSystem->Exit(0);'
+          fi

From 01c4e92d00aea80b1efb3a554a16ba614b8e9d0d Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Mon, 19 Oct 2026 17:25:25 -0500
Subject: [PATCH 103/106] fix(ci): resolve legacy prefix from view symlinks in
 test-cvmfs job

The existing deployment on CVMFS was built before the prefix change, so
symlinks in opt/local/bin point to /cvmfs/singularity.opensciencegrid.org/eicweb/mac_ci-unstable-pr-95.
Because setup.sh on CVMFS already referenced unpacked.cern.ch, the previous
check on setup.sh contents skipped creating the compatibility symlink,
leaving opt/local/bin/python3 as a broken symlink and falling back to
Homebrew python3.

Inspect the symlink target of opt/local/bin/python3 directly and link the
legacy prefix to DEPLOY_PREFIX across firmlink paths, and assert that which
python3 resolves to the CVMFS deployment.
---
 .github/workflows/macos-ci.yml | 49 ++++++++++++++++++++++++++++------
 1 file changed, 41 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index f8d5c018a..4f49bd164 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -770,19 +770,52 @@ jobs:
           echo "=== setup.sh contents ==="
           cat "${DEPLOY_PREFIX}/setup.sh"
 
-          # If setup.sh references singularity.opensciencegrid.org (from older builds),
-          # set up a compatibility firmlink/symlink so those paths resolve on the runner
-          if grep -q "singularity.opensciencegrid.org" "${DEPLOY_PREFIX}/setup.sh"; then
-            echo "Creating compatibility symlink for singularity.opensciencegrid.org prefix..."
-            TARGET_DIR=$(readlink /cvmfs 2>/dev/null || echo "/Users/Shared/cvmfs")
-            sudo mkdir -p "${TARGET_DIR}/singularity.opensciencegrid.org/eicweb"
-            sudo ln -sfn "${DEPLOY_PREFIX}" "${TARGET_DIR}/singularity.opensciencegrid.org/eicweb/mac_ci-unstable-pr-95"
+          # Inspect python3 in opt/local/bin to check for legacy build prefix
+          if [ -L "${DEPLOY_PREFIX}/opt/local/bin/python3" ]; then
+            TARGET=$(readlink "${DEPLOY_PREFIX}/opt/local/bin/python3")
+            echo "opt/local/bin/python3 symlink target: ${TARGET}"
+            if [ ! -e "${DEPLOY_PREFIX}/opt/local/bin/python3" ]; then
+              echo "Symlink target does not exist! Resolving legacy build prefix..."
+              OLD_PREFIX="${TARGET%%/opt/software*}"
+              echo "Detected legacy prefix: ${OLD_PREFIX}"
+              if [ -n "${OLD_PREFIX}" ] && [ "${OLD_PREFIX}" != "${TARGET}" ]; then
+                for root in "" "/Users/Shared" "/System/Volumes/Data"; do
+                  DEST="${root}${OLD_PREFIX}"
+                  DEST_DIR=$(dirname "${DEST}")
+                  echo "Creating compatibility link: ${DEST} -> ${DEPLOY_PREFIX}"
+                  sudo mkdir -p "${DEST_DIR}" 2>/dev/null || true
+                  sudo ln -sfn "${DEPLOY_PREFIX}" "${DEST}" 2>/dev/null || true
+                done
+                for variant in mac_ci mac_xl mac_tf; do
+                  VAR_PREFIX="$(dirname "${OLD_PREFIX}")/${variant}-unstable-pr-95"
+                  for root in "" "/Users/Shared" "/System/Volumes/Data"; do
+                    DEST="${root}${VAR_PREFIX}"
+                    DEST_DIR=$(dirname "${DEST}")
+                    sudo mkdir -p "${DEST_DIR}" 2>/dev/null || true
+                    sudo ln -sfn "${DEPLOY_PREFIX}" "${DEST}" 2>/dev/null || true
+                  done
+                done
+              fi
+            fi
+          fi
+
+          if [ -e "${DEPLOY_PREFIX}/opt/local/bin/python3" ]; then
+            echo "opt/local/bin/python3 resolves successfully!"
+          else
+            echo "Warning: opt/local/bin/python3 still does not resolve!"
+            ls -la "${DEPLOY_PREFIX}/opt/local/bin/python3" || true
           fi
 
           echo "=== Activating environment ==="
           source "${DEPLOY_PREFIX}/setup.sh"
 
-          echo "which python3: $(which python3)"
+          PYTHON_BIN="$(which python3)"
+          echo "which python3: ${PYTHON_BIN}"
+          if [ "${PYTHON_BIN}" != "${DEPLOY_PREFIX}/opt/local/bin/python3" ]; then
+            echo "::error::python3 resolved to ${PYTHON_BIN} instead of ${DEPLOY_PREFIX}/opt/local/bin/python3"
+            exit 1
+          fi
+
           python3 --version
           python3 -c "import sys; print('Python sys.path:', sys.path)"
 

From 96ddaccffc02a3f7b45b3db5627d6ca32a4d8d76 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Wed, 21 Oct 2026 09:07:24 -0500
Subject: [PATCH 104/106] fix(ci): make setup.sh and test-cvmfs colon-safe for
 macOS CVMFS deployment

---
 .github/workflows/macos-ci.yml | 76 +++++++++++++++++++++++++++++-----
 1 file changed, 66 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index 4f49bd164..a6b4f60ad 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -605,32 +605,69 @@ jobs:
           spack env activate --sh --dir "${INSTALL_PREFIX}/opt/spack-environment/${{matrix.ENV}}/epic" > "${INSTALL_PREFIX}/setup.sh"
           chmod +x "${INSTALL_PREFIX}/setup.sh"
 
-          # Ensure SPACK_ENV points under CVMFS target prefix and clean up runner-specific paths
+          # Ensure portable self-healing colon-safe paths in setup.sh
           python3 - "${INSTALL_PREFIX}" "${GITHUB_WORKSPACE}" << 'EOF'
-          import pathlib, re, sys
+          import pathlib, re, sys, textwrap
           prefix = sys.argv[1]
           workspace = sys.argv[2]
           path = pathlib.Path(prefix) / "setup.sh"
           content = path.read_text()
 
+          header = textwrap.dedent("""\
+            # Determine directory of this script portably across bash and zsh
+            if [ -n "${BASH_SOURCE[0]}" ]; then
+              _SOURCE="${BASH_SOURCE[0]}"
+            elif [ -n "${ZSH_VERSION}" ]; then
+              _SOURCE="${(%):-%N}"
+            else
+              _SOURCE="$0"
+            fi
+            _DIR="$(cd "$(dirname "${_SOURCE}")" 2>/dev/null && pwd)"
+
+            # If directory contains a colon (like in CVMFS unpacked.cern.ch tags),
+            # create a colon-free symlink in /tmp/eic so colon-separated variables
+            # (PATH, DYLD_FALLBACK_LIBRARY_PATH, PKG_CONFIG_PATH, etc.) do not split.
+            if [ "${_DIR#*:}" != "${_DIR}" ]; then
+              _CLEAN_PREFIX="/tmp/eic/$(basename "${_DIR}" | tr ':' '-')"
+              mkdir -p "$(dirname "${_CLEAN_PREFIX}")"
+              ln -sfn "${_DIR}" "${_CLEAN_PREFIX}"
+            else
+              _CLEAN_PREFIX="${_DIR}"
+            fi
+          """)
+
+          clean_var = "${_CLEAN_PREFIX}"
+
           # Ensure SPACK_ENV points under target prefix
           content = content.replace(
               f"{workspace}/spack-environment",
-              f"{prefix}/opt/spack-environment"
+              f"{clean_var}/opt/spack-environment"
           )
 
+          # Replace full target prefix with clean_var
+          content = content.replace(prefix, clean_var)
+
+          # Fix corrupted path fragments caused by Spack splitting on colon in prefix
+          if ":" in prefix:
+              tag_tail = prefix.split(":")[-1]
+              content = content.replace(f":{tag_tail}/opt/", f":{clean_var}/opt/")
+              content = content.replace(f"={tag_tail}/opt/", f"={clean_var}/opt/")
+
           # Clean PATH: retain target prefix/CVMFS bin directories and append ${PATH}
           def clean_path(match):
               val = match.group(1).strip("\"'")
-              placeholder = "__INSTALL_PREFIX__"
-              val_safe = val.replace(prefix, placeholder)
+              placeholder = "__CLEAN_PREFIX__"
+              val_safe = val.replace(clean_var, placeholder)
               parts = val_safe.split(":")
-              dirs = [p.replace(placeholder, prefix) for p in parts if p.startswith(placeholder) or p.startswith("/cvmfs")]
+              dirs = [p.replace(placeholder, clean_var) for p in parts if p.startswith(placeholder) or p.startswith("/cvmfs")]
               bin_dirs = ":".join(dirs)
               return f"export PATH={bin_dirs}:" + "${PATH};"
 
           content = re.sub(r"^export PATH=([^;\n]+);", clean_path, content, flags=re.MULTILINE)
-          path.write_text(content)
+          content = re.sub(r"^export MANPATH=(.*?):;$", r"export MANPATH=\1:${MANPATH};", content, flags=re.MULTILINE)
+
+          result = header.rstrip() + "\n\n" + content.strip() + "\n"
+          path.write_text(result)
           EOF
 
           # Detector symlinks fixup
@@ -661,7 +698,12 @@ jobs:
           INSTALL_PREFIX="${{ steps.cvmfs-dirs.outputs.install-prefix }}"
           echo "Testing environment activation from ${INSTALL_PREFIX}/setup.sh..."
           source "${INSTALL_PREFIX}/setup.sh"
-          which python3
+          PYTHON_BIN="$(which python3)"
+          echo "which python3: ${PYTHON_BIN}"
+          if [[ "${PYTHON_BIN}" != *"/opt/local/bin/python3" ]]; then
+            echo "::error::python3 resolved to ${PYTHON_BIN} instead of opt/local/bin/python3"
+            exit 1
+          fi
           python3 --version
           python3 -c "import sys; print('Python sys.path:', sys.path)"
           if command -v root.exe >/dev/null 2>&1; then
@@ -770,6 +812,11 @@ jobs:
           echo "=== setup.sh contents ==="
           cat "${DEPLOY_PREFIX}/setup.sh"
 
+          CLEAN_PREFIX="/tmp/eic/mac_${{ matrix.ENV }}-nightly"
+          echo "Setting up clean colon-free symlink: ${CLEAN_PREFIX} -> ${DEPLOY_PREFIX}"
+          mkdir -p "$(dirname "${CLEAN_PREFIX}")"
+          ln -sfn "${DEPLOY_PREFIX}" "${CLEAN_PREFIX}"
+
           # Inspect python3 in opt/local/bin to check for legacy build prefix
           if [ -L "${DEPLOY_PREFIX}/opt/local/bin/python3" ]; then
             TARGET=$(readlink "${DEPLOY_PREFIX}/opt/local/bin/python3")
@@ -809,10 +856,19 @@ jobs:
           echo "=== Activating environment ==="
           source "${DEPLOY_PREFIX}/setup.sh"
 
+          # If the deployed setup.sh was generated before self-healing colon logic was rolled out,
+          # PATH and DYLD_FALLBACK_LIBRARY_PATH are split on the colon in ':nightly'. Bridge them
+          # to use the clean colon-free symlink prefix.
+          if [ "$(which python3 2>/dev/null)" != "${CLEAN_PREFIX}/opt/local/bin/python3" ]; then
+            echo "Legacy setup.sh detected; bridging environment variables via clean symlink ${CLEAN_PREFIX}..."
+            export PATH="${CLEAN_PREFIX}/opt/local/bin:${PATH}"
+            export DYLD_FALLBACK_LIBRARY_PATH="${CLEAN_PREFIX}/opt/local/lib64:${CLEAN_PREFIX}/opt/local/lib:${DYLD_FALLBACK_LIBRARY_PATH}"
+          fi
+
           PYTHON_BIN="$(which python3)"
           echo "which python3: ${PYTHON_BIN}"
-          if [ "${PYTHON_BIN}" != "${DEPLOY_PREFIX}/opt/local/bin/python3" ]; then
-            echo "::error::python3 resolved to ${PYTHON_BIN} instead of ${DEPLOY_PREFIX}/opt/local/bin/python3"
+          if [ "${PYTHON_BIN}" != "${CLEAN_PREFIX}/opt/local/bin/python3" ]; then
+            echo "::error::python3 resolved to ${PYTHON_BIN} instead of ${CLEAN_PREFIX}/opt/local/bin/python3"
             exit 1
           fi
 

From bb42a556aba5995d5845beb144f38df54f8fef49 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Wed, 21 Oct 2026 16:15:04 -0500
Subject: [PATCH 105/106] fix(spack): disable opengl for root on macOS in xl
 and cuda environments

---
 spack-environment/cuda/spack.yaml      | 5 ++++-
 spack-environment/packages_darwin.yaml | 2 +-
 spack-environment/xl/spack.yaml        | 5 ++++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/spack-environment/cuda/spack.yaml b/spack-environment/cuda/spack.yaml
index ab51abd50..65c92dd26 100644
--- a/spack-environment/cuda/spack.yaml
+++ b/spack-environment/cuda/spack.yaml
@@ -6,7 +6,10 @@ spack:
     when: platform == "darwin"
   - path: ../packages_linux.yaml
     when: platform == "linux"
-  - ../packages_root_with_opengl.yaml
+  - path: ../packages_root_with_opengl.yaml
+    when: platform == "linux"
+  - path: ../packages_root_without_opengl.yaml
+    when: platform == "darwin"
   - ../view.yaml
   - ../packages.yaml
   specs:
diff --git a/spack-environment/packages_darwin.yaml b/spack-environment/packages_darwin.yaml
index 34e210131..dcd1f7bac 100644
--- a/spack-environment/packages_darwin.yaml
+++ b/spack-environment/packages_darwin.yaml
@@ -33,4 +33,4 @@ packages:
     - any_of: [build_system=autotools, '@:']
   root:
     require:
-    - ~x
+    - ~x ~opengl ~webgui
diff --git a/spack-environment/xl/spack.yaml b/spack-environment/xl/spack.yaml
index b6b3901a0..bdcaefa2a 100644
--- a/spack-environment/xl/spack.yaml
+++ b/spack-environment/xl/spack.yaml
@@ -2,7 +2,10 @@ spack:
   include:
   - ../concretizer.yaml
   - ../config.yaml
-  - ../packages_root_with_opengl.yaml
+  - path: ../packages_root_with_opengl.yaml
+    when: platform == "linux"
+  - path: ../packages_root_without_opengl.yaml
+    when: platform == "darwin"
   - path: ../packages_darwin.yaml
     when: platform == "darwin"
   - path: ../packages_linux.yaml

From b7abe16f823e82b8ad34192aa05460137d4169d0 Mon Sep 17 00:00:00 2001
From: Wouter Deconinck <wdconinc@gmail.com>
Date: Wed, 21 Oct 2026 21:38:36 -0500
Subject: [PATCH 106/106] fix(ci): configure ROOT runtime environment and
 dynamic libraries in macOS setup.sh

---
 .github/workflows/macos-ci.yml | 47 ++++++++++++++++++++++++++++++++--
 1 file changed, 45 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index a6b4f60ad..96d60369a 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -542,6 +542,7 @@ jobs:
           spack external find --scope site llvm
           INSTALL_PREFIX="${{ steps.cvmfs-dirs.outputs.install-prefix }}"
           spack config --scope site add "config:install_tree:root:'${INSTALL_PREFIX}/opt/software'"
+          spack config --scope site add "config:install_tree:padded_length:128"
           spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:{}"
           spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:default:root:'${INSTALL_PREFIX}/opt/local'"
           spack -e spack-environment/${{ matrix.ENV }} -c view:false config add "view:detectors:root:'${INSTALL_PREFIX}/opt/detector'"
@@ -666,7 +667,44 @@ jobs:
           content = re.sub(r"^export PATH=([^;\n]+);", clean_path, content, flags=re.MULTILINE)
           content = re.sub(r"^export MANPATH=(.*?):;$", r"export MANPATH=\1:${MANPATH};", content, flags=re.MULTILINE)
 
-          result = header.rstrip() + "\n\n" + content.strip() + "\n"
+          # Clean and augment DYLD_FALLBACK_LIBRARY_PATH: retain view lib directories,
+          # include lib/root for ROOT dynamic libraries/plugins, and preserve any existing value.
+          def clean_dyld_path(match):
+              val = match.group(1).strip("\"'")
+              placeholder = "__CLEAN_PREFIX__"
+              val_safe = val.replace(clean_var, placeholder)
+              parts = val_safe.split(":")
+              dirs = [p.replace(placeholder, clean_var) for p in parts if p.startswith(placeholder) or p.startswith("/cvmfs")]
+              root_dir = f"{clean_var}/opt/local/lib/root"
+              if root_dir not in dirs:
+                  dirs.append(root_dir)
+              lib_dirs = ":".join(dirs)
+              return f"export DYLD_FALLBACK_LIBRARY_PATH={lib_dirs}" + "${DYLD_FALLBACK_LIBRARY_PATH:+:${DYLD_FALLBACK_LIBRARY_PATH}};"
+
+          if "DYLD_FALLBACK_LIBRARY_PATH" in content:
+              content = re.sub(r"^export DYLD_FALLBACK_LIBRARY_PATH=([^;\n]+);", clean_dyld_path, content, flags=re.MULTILINE)
+          else:
+              content += f"\nexport DYLD_FALLBACK_LIBRARY_PATH={clean_var}/opt/local/lib64:{clean_var}/opt/local/lib:{clean_var}/opt/local/lib/root" + "${DYLD_FALLBACK_LIBRARY_PATH:+:${DYLD_FALLBACK_LIBRARY_PATH}};\n"
+
+          content = re.sub(r"^export PKG_CONFIG_PATH=([^;\n]+);", r"export PKG_CONFIG_PATH=\1${PKG_CONFIG_PATH:+:${PKG_CONFIG_PATH}};", content, flags=re.MULTILINE)
+          content = re.sub(r"^export CMAKE_PREFIX_PATH=([^;\n]+);", r"export CMAKE_PREFIX_PATH=\1${CMAKE_PREFIX_PATH:+:${CMAKE_PREFIX_PATH}};", content, flags=re.MULTILINE)
+
+          footer = (
+              "# ROOT environment configuration\n"
+              f'if [ -d "{clean_var}/opt/local/lib/root" ]; then\n'
+              f'  export ROOTSYS="{clean_var}/opt/local";\n'
+              f'  export ROOT_LIBRARY_PATH="{clean_var}/opt/local/lib/root";\n'
+              f'  export ROOT_INCLUDE_PATH="{clean_var}/opt/local/include";\n'
+              '  export CLING_STANDARD_PCH="none";\n'
+              '  export CPPYY_API_PATH="none";\n'
+              f'  export PYTHONPATH="{clean_var}/opt/local/lib/root"' + "${PYTHONPATH:+:${PYTHONPATH}};\n"
+              '  if ! command -v root > /dev/null 2>&1 && command -v root.exe > /dev/null 2>&1 ; then\n'
+              '    alias root=root.exe\n'
+              '  fi\n'
+              'fi\n'
+          )
+
+          result = header.rstrip() + "\n\n" + content.strip() + "\n\n" + footer.strip() + "\n"
           path.write_text(result)
           EOF
 
@@ -862,7 +900,12 @@ jobs:
           if [ "$(which python3 2>/dev/null)" != "${CLEAN_PREFIX}/opt/local/bin/python3" ]; then
             echo "Legacy setup.sh detected; bridging environment variables via clean symlink ${CLEAN_PREFIX}..."
             export PATH="${CLEAN_PREFIX}/opt/local/bin:${PATH}"
-            export DYLD_FALLBACK_LIBRARY_PATH="${CLEAN_PREFIX}/opt/local/lib64:${CLEAN_PREFIX}/opt/local/lib:${DYLD_FALLBACK_LIBRARY_PATH}"
+            export DYLD_FALLBACK_LIBRARY_PATH="${CLEAN_PREFIX}/opt/local/lib64:${CLEAN_PREFIX}/opt/local/lib:${CLEAN_PREFIX}/opt/local/lib/root:${DYLD_FALLBACK_LIBRARY_PATH}"
+            export ROOTSYS="${CLEAN_PREFIX}/opt/local"
+            export ROOT_LIBRARY_PATH="${CLEAN_PREFIX}/opt/local/lib/root"
+            export ROOT_INCLUDE_PATH="${CLEAN_PREFIX}/opt/local/include"
+            export CLING_STANDARD_PCH='none'
+            export CPPYY_API_PATH='none'
           fi
 
           PYTHON_BIN="$(which python3)"