debuggable installations in eic/containers: wire --debug-source and --debug-symbols into the dbg environment

[SebastianPaucar]

This PR adds the framework related to the following design discussion for debuggable installations in spack packages:

• PR 52768 (spack/spack): DWARF-referenced source hook and symbol splitting plus GDB init for debuggable installations.
• PR 19 (spack/compiler-wrapper): -ffile-prefix-map=<staging>=. and --build-id injection in compiler-wrapper.
• PR 5353 (spack/spack-packages): set SPACK_DEBUG_PREFIX_MAP for -ffile-prefix-map=<stage>=. injection at compiler-wrapper level.
• Spack Debuggable Installations Demo
  (SebastianPaucar/spack): --debug-source and --debug-symbols PoC container demo (verified end-to-end).

In summary, this PR adds --debug-source and --debug-symbols to spack install when ENV=dbg, via a new conditional in scripts/build-eic.sh that appends to SPACK_INSTALL_FLAGS.

[wdconinc]

@SebastianPaucar In master (#393) we added a mirror for the source that has the ssl certificate errors in CI here.

[SebastianPaucar]

@SebastianPaucar In master (#393) we added a mirror for the source that has the ssl certificate errors in CI here.

Branch updated with #393. Also implemented OCI push/autopush (per mirrors.yaml.in) and fetch of debug info (sources and symbols) into/from GHCR and eicweb mirrors (verified locally with my GHCR), according to this commit in my Spack branch feature/debuggable-installations-v1.2.2 #a5874e8. Working in the documentation.

[SebastianPaucar]

@SebastianPaucar In master (#393) we added a mirror for the source that has the ssl certificate errors in CI here.

Noticed some of the newer cherry-picks in spack-packages.sh were missing. Added.

[wdconinc]

It seems this PR has created a whole new spack build cache at https://eicweb.phy.anl.gov/containers/eic_container/container_registry/154 because we reuse the branch name as container registry name ;-)

[github-actions]

Capybara summary for PR 388

• rec_dis_10x100_minQ2=1000_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• rec_dis_10x100_minQ2=1_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• rec_dis_18x275_minQ2=1000_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• rec_dis_18x275_minQ2=1_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• rec_dis_5x41_minQ2=1_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• rec_dis_5x41_minQ2=1_epic_craterlake_amd64_vs_arm64 (Δ: 4219)
• rec_dis_5x41_minQ2=1_epic_craterlake_arm64 (Δ: 1) (new artifact) (ref artifact)
• rec_e_1GeV_20GeV_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• rec_e_1GeV_20GeV_epic_craterlake_amd64_vs_arm64 (Δ: 3506)
• rec_e_1GeV_20GeV_epic_craterlake_arm64 (Δ: 1) (new artifact) (ref artifact)
• rec_pi_1GeV_20GeV_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• rec_pi_1GeV_20GeV_epic_craterlake_amd64_vs_arm64 (Δ: 3456)
• rec_pi_1GeV_20GeV_epic_craterlake_arm64 (Δ: 3382) (new artifact) (ref artifact)
• sim_dis_10x100_minQ2=1000_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• sim_dis_10x100_minQ2=1_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• sim_dis_18x275_minQ2=1000_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• sim_dis_18x275_minQ2=1_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• sim_dis_5x41_minQ2=1_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• sim_dis_5x41_minQ2=1_epic_craterlake_amd64_vs_arm64 (Δ: 395)
• sim_dis_5x41_minQ2=1_epic_craterlake_arm64 (Δ: 1) (new artifact) (ref artifact)
• sim_e_1GeV_20GeV_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• sim_e_1GeV_20GeV_epic_craterlake_amd64_vs_arm64 (Δ: 359)
• sim_e_1GeV_20GeV_epic_craterlake_arm64 (Δ: 1) (new artifact) (ref artifact)
• sim_pi_1GeV_20GeV_epic_craterlake_amd64 (Δ: 1) (new artifact) (ref artifact)
• sim_pi_1GeV_20GeV_epic_craterlake_amd64_vs_arm64 (Δ: 346)
• sim_pi_1GeV_20GeV_epic_craterlake_arm64 (Δ: 1) (new artifact) (ref artifact)
  ^{_{Last updated 2026-09-03T21:34-04:00 676d717}}

[SebastianPaucar]

Hi @wdconinc, 84 checks have now successfully passed. Can you please rerun the remaining failing check (eicweb/eic_container)?

On another note, I figured out the root cause of the previous SSL issues. dawncut has buildcache coverage, while dawn does not, and their host URL (http://geant4.kek.jp/~tanaka/src/) is broken, as stated in eic-spack/spack_repo/eic/packages/dawncut/package.py. These are not related to our debuggable framework. I dropped both from xl/spack.yaml and just opened a dedicated PR if useful here #407.