How to instruct pixi exec not to reinstall even if the cache changes?

[kratsg]

./cc @chrisburr

When using ca-policy-lcg -- the files can get out of date, but the conda-forge package provides a refresh_crls.sh script. If one doesn't use it out of the box, you have:

$ pixi exec --spec rucio-mcp voms-proxy-init -voms atlas
Enter GRID pass phrase:
Your identity: /DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=gstark/CN=756182/CN=Giordon Holtsberg Stark
Contacting voms-atlas-auth.cern.ch:443 [/DC=ch/DC=cern/OU=computers/CN=atlas-auth.cern.ch] "atlas"... Done

Created proxy in /tmp/x509up_u501.

Your proxy is valid until Wed May  6 23:42:42 2026 PDT

Error: Certificate verification failed.
sslutils.c:1911:error:40000405:lib(128)::outdated CRL found, revoking all certs till you get new CRL
sslutils.c:2106:error:40000411:lib(128)::certificate validation error: CRL has expired [subject=/DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=gstark/CN=756182/CN=Giordon Holtsberg Stark,issuer=/DC=ch/DC=cern/CN=CERN Grid Certification Authority]

which is the CRLs being expired. So then one should run

Lord Stark:~$ pixi exec --spec rucio-mcp sh -c '$X509_CERT_DIR/refresh_crls.sh'
/Users/kratsg/Library/Caches/rattler/cache/cached-envs-v0/sh-6cdfe0691bee48f8/etc/grid-security/certificates/ANSPGridCA2.pem
dcaa370f
/Users/kratsg/Library/Caches/rattler/cache/cached-envs-v0/sh-6cdfe0691bee48f8/etc/grid-security/certificates/ANSPGridCA2.crl_url
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
...

which updates the CRLs in that environment associated with the rucio-mcp spec. However, when running the pixi exec --spec rucio-mcp ... again, the environment is remade given the local changes -- how do I instruct pixi to not clear it out?

[kratsg]

For further debugging with -v:

$ pixi exec -v --spec rucio-mcp sh -c '$X509_CERT_DIR/refresh_crls.sh'
 INFO pixi_cli::exec: creating environment in /Users/kratsg/Library/Caches/rattler/cache/cached-envs-v0/sh-6cdfe0691bee48f8
/Users/kratsg/Library/Caches/rattler/cache/cached-envs-v0/sh-6cdfe0691bee48f8/etc/grid-security/certificates/ANSPGridCA2.pem
dcaa370f
/Users/kratsg/Library/Caches/rattler/cache/cached-envs-v0/sh-6cdfe0691bee48f8/etc/grid-security/certificates/ANSPGridCA2.crl_url
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2420  100  2420    0     0   6055      0 --:--:-- --:--:-- --:--:--  6065
...

cache is created at $PIXI_CACHE/cached-envs-v0/sh-6cdfe0691bee48f8. If I use voms-proxy-init, I see

$ pixi exec -v --spec rucio-mcp voms-proxy-init -voms atlas
 INFO pixi_cli::exec: creating environment in /Users/kratsg/Library/Caches/rattler/cache/cached-envs-v0/voms-proxy-init-d11addacc7c44169
Enter GRID pass phrase:
Your identity: /DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=gstark/CN=756182/CN=Giordon Holtsberg Stark
Contacting voms-atlas-auth.cern.ch:443 [/DC=ch/DC=cern/OU=computers/CN=atlas-auth.cern.ch] "atlas"... Done

Created proxy in /tmp/x509up_u501.

Your proxy is valid until Wed May  6 23:48:49 2026 PDT

Error: Certificate verification failed.
sslutils.c:1911:error:40000405:lib(128)::outdated CRL found, revoking all certs till you get new CRL
sslutils.c:2106:error:40000411:lib(128)::certificate validation error: CRL has expired [subject=/DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=gstark/CN=756182/CN=Giordon Holtsberg Stark,issuer=/DC=ch/DC=cern/CN=CERN Grid Certification Authority]

a slightly different cache.. ok, so it uses the command and caches based on the command, interesting. Meanwhile

$ pixi exec -v --spec rucio-mcp sh -c 'voms-proxy-init -voms atlas'
 INFO pixi_cli::exec: creating environment in /Users/kratsg/Library/Caches/rattler/cache/cached-envs-v0/sh-6cdfe0691bee48f8
Enter GRID pass phrase:
Your identity: /DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=gstark/CN=756182/CN=Giordon Holtsberg Stark
Contacting voms-atlas-auth.cern.ch:443 [/DC=ch/DC=cern/OU=computers/CN=atlas-auth.cern.ch] "atlas"... Done

Created proxy in /tmp/x509up_u501.

Your proxy is valid until Wed May  6 23:49:00 2026 PDT

works, so I have a workaround, but this is a bit unexpected?

[baszalmstra]

I agree that's odd. Fix incoming.

[baszalmstra]

#6035