ubuntu-24.04: install AWS CLI v2

Dockerfiles/ubuntu-24.04.dockerfile

@@ -56,6 +56,28 @@ RUN python3 -m pip install --upgrade pip setuptools wheel \
  && python3 -m pip install gnureadline boto3 pyyaml pytz minio requests clingo \
  && rm -rf ~/.cache
 
+# Install AWS CLI v2 (used improve performance of `spack buildcache update-index`).
+
+# AWS CLI Team public key, used to verify the installer signature.
+# Source: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
+# Fingerprint: FB5D B77F D5C1 18B8 0511  ADA8 A631 0ACC 4672 475C (expires 2027-07-01)
+COPY keys/aws-cli.asc /usr/share/keyrings/aws-cli.asc
+
+# The signature must be valid AND made by the expected key: gpg's status output
+# is checked for a VALIDSIG line whose primary-key fingerprint matches.
+RUN AWSCLI_ZIP="awscli-exe-linux-$(uname -m).zip" \
+  && AWSCLI_KEY_FPR=FB5DB77FD5C118B80511ADA8A6310ACC4672475C \
+  && curl -sSfL --retry 5 --retry-connrefused "https://awscli.amazonaws.com/${AWSCLI_ZIP}" -o /tmp/awscliv2.zip \
+  && curl -sSfL --retry 5 --retry-connrefused "https://awscli.amazonaws.com/${AWSCLI_ZIP}.sig" -o /tmp/awscliv2.zip.sig \
+  && export GNUPGHOME="$(mktemp -d)" \
+  && gpg --batch --quiet --import /usr/share/keyrings/aws-cli.asc \
+  && gpg --batch --status-fd 3 --verify /tmp/awscliv2.zip.sig /tmp/awscliv2.zip 3>"$GNUPGHOME/status" \
+  && grep -Eq "^\[GNUPG:\] VALIDSIG .* ${AWSCLI_KEY_FPR}\$" "$GNUPGHOME/status" \
+  && unzip -q /tmp/awscliv2.zip -d /tmp \
+  && /tmp/aws/install \
+  && rm -rf /tmp/awscliv2.zip /tmp/awscliv2.zip.sig /tmp/aws "$GNUPGHOME" \
+  && aws --version
+
 CMD ["/bin/bash"]
 
 ENV NVIDIA_VISIBLE_DEVICES=all \

keys/aws-cli.asc

@@ -0,0 +1,29 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBF2Cr7UBEADJZHcgusOJl7ENSyumXh85z0TRV0xJorM2B/JL0kHOyigQluUG
+ZMLhENaG0bYatdrKP+3H91lvK050pXwnO/R7fB/FSTouki4ciIx5OuLlnJZIxSzx
+PqGl0mkxImLNbGWoi6Lto0LYxqHN2iQtzlwTVmq9733zd3XfcXrZ3+LblHAgEt5G
+TfNxEKJ8soPLyWmwDH6HWCnjZ/aIQRBTIQ05uVeEoYxSh6wOai7ss/KveoSNBbYz
+gbdzoqI2Y8cgH2nbfgp3DSasaLZEdCSsIsK1u05CinE7k2qZ7KgKAUIcT/cR/grk
+C6VwsnDU0OUCideXcQ8WeHutqvgZH1JgKDbznoIzeQHJD238GEu+eKhRHcz8/jeG
+94zkcgJOz3KbZGYMiTh277Fvj9zzvZsbMBCedV1BTg3TqgvdX4bdkhf5cH+7NtWO
+lrFj6UwAsGukBTAOxC0l/dnSmZhJ7Z1KmEWilro/gOrjtOxqRQutlIqG22TaqoPG
+fYVN+en3Zwbt97kcgZDwqbuykNt64oZWc4XKCa3mprEGC3IbJTBFqglXmZ7l9ywG
+EEUJYOlb2XrSuPWml39beWdKM8kzr1OjnlOm6+lpTRCBfo0wa9F8YZRhHPAkwKkX
+XDeOGpWRj4ohOx0d2GWkyV5xyN14p2tQOCdOODmz80yUTgRpPVQUtOEhXQARAQAB
+tCFBV1MgQ0xJIFRlYW0gPGF3cy1jbGlAYW1hem9uLmNvbT6JAlQEEwEIAD4CGwMF
+CwkIBwIGFQoJCAsCBBYCAwECHgECF4AWIQT7Xbd/1cEYuAURraimMQrMRnJHXAUC
+akV0ygUJDqP4lQAKCRCmMQrMRnJHXFHjD/9eyZLYcKuQOlLvtqSDtUBiEZf6ZZjM
+i3ygYH8rJNtuToUH+HvSpe819urJCquXhDrlK6N+aqW0hCLtNABJG/vsafIgvIYJ
+hSGgpgtNnQyMV1jViRWqPjbouw8OkYKBThUfT1i2Y+wn58ifs6ODBCmTexWtXspA
+Si+Gt49xDOW0APmbOPnI+a4HJW6tVEo6MWS0WjzpiBayR3d1A4pt4YrPfSdDgpLo
+h2SLQqlRqvvVZJaWBjhkErNFpfsBA06sDcPEOb0G8LBUbR4WOcdvhe5LubJbZuxC
+AG9kNPCVeQP1ixwjgjXKysaxeQ6rv0VzIQgRp6tLVLWhy6AKDNvLjFSsmXZ1Wl08
+Y/RlOHXlzLuQMRE6sR1wOdRxc9TsrNWTGiBK65cvSWOy03JeBkQQ8pesqltiyxI9
+U21kkgiXtTSKNGfKK8pO27D81YANhRqPK7iTp6kuFiY2WtOg90KTMNlIT+Ff85Y2
+b1rHj6Z0SrCkJujhWk3IBPic/wJgz01LEc/OAdUPlby90RJZcIBhSlWhT7mXnXIO
+c0HWlNQrns2s3CTyYwZSiSlYe9ApeLwhjDo8NhbFuCAy61l6O5UsR4AfZxx/rGKv
+2wFb1/RN/P4gNe6vmxZAPjR0AQcwD3tc2McimOLr/22kmPz8IH3I0X7WoSFr0Biz
+E91G7bb0hOb/cA==
+=knv7
+-----END PGP PUBLIC KEY BLOCK-----