Spack

ID

spack

Home page

https://spack.io

Upstream stars

⭐ 5,108

Last commit

2026-08-17

Version requirement

>= 1

Platforms

🐧 Linux · 🍎 macOS

Operations

installed · search · install · remove · sync · cleanup

purl types

pkg:spack

CLI name

spack

Every call

spack --no-env <command>

Issues and PRs

📦 manager: spack

Source

meta_package_manager/managers/spack.py

Spack, the package manager built for supercomputers and HPC clusters.

A package is a spec: a package name carrying a version, a compiler, a target architecture and a set of build options, each combination installed into a prefix of its own. mpm keys a package on its id alone, so the spec is reduced to the name every verb accepts back.

Note

Holding several builds of one package at once is Spack’s whole purpose, so the inventory repeats a name as many times as the host has builds of it. That reduction to one entry per id is what makes this a class rather than a bundled definition, the same case luarocks and vagrant answer.

Reducing on the version alone is a deliberate loss: two builds of the same version differing only in compiler or build options collapse into one entry, which mpm has no way to tell apart and no verb to address separately.

Caution

--no-env is load-bearing, and silently so. Spack scopes every command to the active environment, which the user activates with spack env activate or by exporting SPACK_ENV, and an environment is a project, not the machine. With one active, spack find reports that environment’s contents: a host holding four installed packages reports none at all, an empty answer indistinguishable from an empty machine. Worse, an SPACK_ENV left pointing at a deleted environment makes the command fail outright with Error: no environment in ....

The flag is a global one, placed before the subcommand, which is why it is declared as pre_args rather than repeated per operation. Note that -E is not a portable shorthand for it: spack gc binds its own -E to --except-any-environment, so the long form is the only spelling that means the same thing everywhere. The version probe skips pre_args entirely and so runs bare.

haxelib forces --global and luarocks --no-project against the same hazard.

Note

The inventory is a projection rather than the default display. spack find normally groups its output under -- darwin-tahoe-m1 / %c=apple-clang@21.0.0 banners whose text depends on the host’s architecture and compilers, while --format prints the requested fields alone. gcloud reaches for the same escape.

Note

Every spec Spack’s database holds is reported, which is broader than what Spack built. Packages pulled in as build dependencies appear, matching the raco reading that an inventory hiding what was installed on the user’s behalf is the wrong answer, and so do externals: the system compiler Spack registers on first use is listed as apple-clang, since Spack tracks it as installed and its own garbage collector removes it. No flag separates them out.

Warning

Spack has no outdated and no upgrade verb, and neither is faked. Installing a package that is already present adds a second build rather than replacing the first, which is the point of the tool, so wiring upgrade to install would leave the old build in place while reporting success. Reclaiming the superseded build is what cleanup --orphans does.

Warning

A read bootstraps the host on first use. Since Spack 1.0 the package recipes live in spack/spack-packages rather than in Spack itself, and upstream states Spack “clones the package repository automatically when you first run”, so an inventory or a search on a fresh install fetches some twenty thousand objects into ~/.spack before answering. ollama starting a daemon from a listing is the same shape, smaller.

Documentation: Spack documentation.

What mpm adds to spack

Through mpm, spack gains --exact search, to narrow results to exact names.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover spack alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your spack commands, in mpm

You already know spack: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With spack	With mpm
List what’s installed	spack find --format <name>@<version>	mpm --spack installed
Search for a package	spack list --format version_json zlib-ng	mpm --spack search zlib-ng
Install a package	spack install zlib@1.3.1	mpm install pkg:spack/zlib@1.3.1
Remove a package	spack uninstall --yes-to-all --all zlib	mpm remove pkg:spack/zlib
Clear caches	spack clean --downloads --misc-cache --python-cache --stage	mpm --spack cleanup --cache

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✓
outdated
orphans
search	✓	exact search backfilled by mpm
install	✓
upgrade
upgrade_all
remove	✓
sync	✓
cleanup	✓	--orphans runs the system-wide orphan sweep
doctor

Selecting and configuring spack

Deselect spack for a single run with --no-spack, or persist the choice in your configuration:

[mpm]
spack = false

The arguments and environment variables listed in the box atop this page are forced on every spack call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.spack]
timeout = 900

mpm config-template spack prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around spack, one mpm command each:

• Snapshot and clone a machine: mpm --spack dump spack.toml, then mpm restore spack.toml on the next one.

• Export a compliance SBOM: mpm --spack sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

State of Spack’s release-age gating, from the cooldown support table:

Status: ❌ None (builds from source)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: Source-based recipe trees

• Retraction: Index revert of the recipe tree

• Publish date: ❌ a recipe carries no publication date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Version probe

The version is extracted from the output of spack --version with:

r"(?P<version>\S+)"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Spack well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ spack --no-env find --format {name}@{version}
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --spack installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Upstream project

Metrics	spack/spack
Activity
Popularity
Metadata

Changelog

• 8.0.0.dev0 (unreleased)

  • Add Spack package manager, with installed, search, install, remove, sync and cleanup support. Every call forces --no-env, without which an activated environment answers for a project instead of the machine. Holding several builds of one package at once being the point of Spack, the inventory is reduced to one entry per name. No outdated and no upgrade: installing over a package adds a second build rather than replacing the first.