Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

install-nix: Advancement of destination folder creation means #1555

Closed
wants to merge 3 commits into from

Conversation

Anton-Latukha
Copy link

@Anton-Latukha Anton-Latukha commented Sep 3, 2017

This commit concentrates on streamlining /nix folder creation.

As Nix installation can be launched from any user, on any distro, with sudo or not - here is universal code.

  1. At first it tries to create folder from current user. If it is root, or user can create directory - no need to use sudo or su or disturb user with additional messages.
  2. Detects does sudo installed. Before this we could not distinct when sudo access failed itself and when sudo is not installed. And now we can say that we looked and sudo is not installed, and it is understandable why we ask him root password itself.
  3. Looks does sudo access is passwordless, or not.
    3a. Passwordless: we can inform user that we used sudo.
    3b. With password: we explain to user why we need sudo access, and ask to enter password for that.
  4. If sudo fails, we mention that it also can be due to user has no sudoers access. Nowadays sudo pretends that password do not match, while in reality user has no sudoers access. The One sudo developer, - millert - made that change years ago to not inform hackers that user has no sudo access, but those reports is written to logs. But admins/users also can be puzzled by that, especially if passwords/infrastructure is complex.
  5. If folder still not created - use su.
    5a.And big volume of clean distributions (minimalist ones) doesn't have sudo supplied with a distro (Alpine, Arch, even Debian I think).
    5a. And we explain why installer asks for root password itself.
  6. Without informing user when root access closed - he doesn't sure how many operations was under root after he gave access, and what Nix beast will do with his system. We now inform user, in both sudo and su, when we closed root assess, that he kindly entrusted to us.
  7. Script errors only when all merits was used - only then. So user has less hassle, we are trying in his benefit.
  8. More vocal installation process overall. Which is important for smooth experience and good impression.
  9. Yes, I also changed:
if ! [ -e $dest ]; then # it can also be file or link to file.
# to
if ! [ -d $dest ]; then # it can be only directory/link to directory

And, yes; solves #539. Now script not falls because sudo is not present, - it uses root, user rights or su.
I looked though all 'install' bugs and that's all I found related, but I by the way triaged a handful for people bugs, old ones also.

@Anton-Latukha Anton-Latukha changed the title install-linux: Advancement of destination folder creation means install-nix: Advancement of destination folder creation means Sep 3, 2017
@Anton-Latukha
Copy link
Author

There are 555 open issues.
My PR is 1555.

Thug Life!

@danbst
Copy link
Contributor

danbst commented Sep 7, 2017

I think, every case when $cmd fails, should end with

You can skip this check by manually running '$cmd' as root to create $dest

Also, I don't think that script that writes WHY does it need sudo-permissions will be more trusted then current one (I'm speaking for myself here). I don't trust random curl|sh scripts, even if they post to /dev/stderr they do only good.

Triying su when sudo not found may be a good change though

@Anton-Latukha
Copy link
Author

Anton-Latukha commented Sep 7, 2017

@danbst What are arguments for: I think, every case when $cmd fails, should end with.

  1. When you run remotely on deployment:
    curl https://nixos.org/nix/install | sh
    You don't wait on message:

    You can skip this check by manually running '$cmd' as root to create $dest

    That think itself - "it is not a problem for you", right? It casually asks you to login to server/system and run some commands. With others non-automatic requirements - you need make changes in your Configurations Management. And maintain presetup requirements for Nix.
    And we will not look at the Enterprise level, when the companies require you to write letters, and get acceptance to run command on a servers/make any changes. That can be quite a hassle for that people.

  2. Ask for manual preparation shows that install is not production ready. Nix "automatic setup" in reality is not automatic at this stage, and relies on manual nurturing from admin.

  3. Run:
    # curl -L https://get.docker.com/ | sh
    # curl -L https://bootstrap.saltstack.com | sh

    Does they ask to do something manually before install? They determine your distro, architecture, everything. They also have a lot of options.

    They created to be automatic. I aim to make process unattended as much as possible. And then add key to fully unattended process.

  4. That means they need to use best approach, then other one, that also works, that other one.
    Why fail and ask to do work manually, if all approaches combine ideally in a chain and do what is needed without side-effects in the end.

  5. The point - is to do automatic trouble-free setup that it ready for production and impresses at first use.
    This is our worm welcome to world of Nix.

@danbst
Copy link
Contributor

danbst commented Sep 8, 2017

This is our worm welcome to world of Nix.

This is great, but let me repeat my point again, in detail:

I'm talking about situation, when actual install script failed. Don't know why, probably user chose not to enter sudo password (hey man, you're a script from internet that wants root access, why would I trust you? no-no ^C). They've already read that Nix doesn't need root in single-user usage, but why the hell does it need root for install?

In that case, when actual install failure happened, it is good to explain user that if he can create and own /nix, then script will run without sudo, su or any other access to root.

I'm also 👍 on using su when sudo not found.

@Anton-Latukha
Copy link
Author

Anton-Latukha commented Sep 8, 2017

  1. They've already read that Nix doesn't need root in single-user usage, , but why the hell does it need root for install

    It is documentation error.
    By default, and in 95% setups, Nix installs in /nix, so install by default assumes need to get superuser access to create folder in the root folder.
    But id does not written in documentation.
    It is documentation lacking. Not me, and not Nix.

  2. If user runs install script on Linux, - user expects that superuser can be used.
    Doesn't he?
    On what occasions you was installing applications on Linux without superuser access?

    When user/process installed on Linux something, that was not requiring superuser access, especially package manager.

    It it really astonishing and not expected for user that hey man, you're a script from internet that wants root access, why would I trust you?
    When it happened that Linux user freaked-out when himself doing install, and was asked for superuser password? - It is the most common normal situation, to ask superuser access during install.
    He can aborts it.

  3. Once more: best production oneliners that I mentioned above - expect user knows when he runs it. They are unattended. And they ask for superuser access, if they runned not as superuser.

  4. If user runs curl https://nixos.org/nix/install | sh directly, - that means he trust in script or don't bother.

  5. If user/admin worried - he will look at https://nixos.org/nix/install, or download it and check it out.

    For me - this is defence from the fool. People are decide for themselves to look at it and launch it.

    That can be mentioned in official installation. It is not role of the script. Asking from script to do the job, and to not do the job. So do we need to make install?

  6. User can just not enter password.
    When sudo or su access asked, user can do ctlr-c, to exit, it's no biggy. Tools already have that functionality built-in.

  7. Script tells why it needs superuser access.
    Before asking superuser access. it says why.
    That is what I wrote about in main post.

  8. My pull request does not changed point you object to. It existed before me.
    Currently main way code runs on master - it runs sudo directly. So your note must be pointed at master code.

  9. In fact I even work in favour of your objection here.
    Before using sudo or su,- my code tries to use user rights itself.
    So if we can do it from user, and not use sudo or su - it does it without them.
    Look, it is written in the code.

  10. I am working on script and have solutions further. But I can't get even the most simple pull requests accepted.

@Anton-Latukha
Copy link
Author

Ok. I close this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants