Idea: Install script to better support improving contributor-friendliness of projects

Idea: Install script to better support improving contributor-friendliness of projects

[Никита Чураев]

Here's how I want to use Guix and it is to increase 
contributor-friendliness of a project, so that the user can simply run a 
distribution-independent command to install all dependencies without 
having to hunt for them with `apt` and `dnf` manually.

Unfortunately, Guix itself is not very easy to install, and the 
instructions are full of rather technical stuff like 'systemd' and 
'upstart'.

https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html

There should be a script like the one Haskell Stack uses:

|curl -sSL https://get.haskellstack.org/ | sh|

IMO supporting this as a use case could really bring popularity to GNU Guix.

||||

||

Re: Idea: Install script to better support improving contributor-friendliness of projects

[ng0]

[-- Attachment #1: Type: text/plain, Size: 1171 bytes --]

Никита Чураев transcribed 0.7K bytes:
> Here's how I want to use Guix and it is to increase contributor-friendliness
> of a project, so that the user can simply run a distribution-independent
> command to install all dependencies without having to hunt for them with
> `apt` and `dnf` manually.
> 
> Unfortunately, Guix itself is not very easy to install, and the instructions
> are full of rather technical stuff like 'systemd' and 'upstart'.
> 
> https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html
> 
> There should be a script like the one Haskell Stack uses:
> 
> |curl -sSL https://get.haskellstack.org/ | sh|

Hi,

Personally I fail to see how piping an arbitrary shell command improves access
to Guix itself. This must be a recent trend, I've seen it first maybe 7 years
ago.
What do you think is bad about the Handbook? We are open to suggestions
for improvement.

> IMO supporting this as a use case could really bring popularity to GNU Guix.
> 
> ||||
> 
> ||
> 
> 
> 

-- 
GnuPG: A88C8ADD129828D7EAC02E52E22F9BBFEE348588
GnuPG: https://c.n0.is/ng0_pubkeys/tree/keys
  WWW: https://n0.is

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Mark H Weaver]

Hi,

Никита Чураев <lamefun.x0r@gmail.com> writes:

> Here's how I want to use Guix and it is to increase
> contributor-friendliness of a project, so that the user can simply run
> a distribution-independent command to install all dependencies without
> having to hunt for them with `apt` and `dnf` manually.
>
> Unfortunately, Guix itself is not very easy to install, and the
> instructions are full of rather technical stuff like 'systemd' and
> 'upstart'.
>
> https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html
>
> There should be a script like the one Haskell Stack uses:
>
> |curl -sSL https://get.haskellstack.org/ | sh|

I can understand the appeal of such a convenient approach.  However,
this practice of downloading a script via HTTPS and immediately running
it as root without inspection puts you at considerable risk.  A
man-in-the-middle with the resources to compromise or bribe *any*
certificate authority in your trust store (the attacker could choose
which one) could acquire a fraudulent certificate to impersonate our
site, and then substitute in a different script than the one we
provided.  Quite a few organizations are capable of such an attack
today.

Therefore, I believe it would be irresponsible for us to promote this
style of installation.

However, if there's sufficient interest, and if we could produce a
sufficiently robust "auto-install" script, we could perhaps do something
close to what you suggested.  We could provide a script along with a
GnuPG digital signature.  We could ask the user to download the script,
acquire our signing key, verify the signature on the script, and then
run the script as root.

      Mark

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Alex Vong]

[-- Attachment #1: Type: text/plain, Size: 959 bytes --]

Hello,

Here is a further explaination of why 'curl | sh' is a bad idea:

https://stackoverflow.com/questions/29382739/why-using-curl-sudo-sh-is-not-advised

Cheers,
Alex

Никита Чураев <lamefun.x0r@gmail.com> writes:

> Here's how I want to use Guix and it is to increase
> contributor-friendliness of a project, so that the user can simply run
> a distribution-independent command to install all dependencies without
> having to hunt for them with `apt` and `dnf` manually.
>
> Unfortunately, Guix itself is not very easy to install, and the
> instructions are full of rather technical stuff like 'systemd' and
> 'upstart'.
>
> https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html
>
> There should be a script like the one Haskell Stack uses:
>
> |curl -sSL https://get.haskellstack.org/ | sh|
>
> IMO supporting this as a use case could really bring popularity to GNU Guix.
>
> ||||
>
> ||

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Adonay Felipe Nogueira]

+1

2017-11-28T05:06:28+0800 Alex Vong wrote:
> Hello,
>
> Here is a further explaination of why 'curl | sh' is a bad idea:
>
> https://stackoverflow.com/questions/29382739/why-using-curl-sudo-sh-is-not-advised
>
> Cheers,
> Alex

-- 
- https://libreplanet.org/wiki/User:Adfeno
- Palestrante e consultor sobre /software/ livre (não confundir com
  gratis).
- "WhatsApp"? Ele não é livre. Por favor, veja formas de se comunicar
  instantaneamente comigo no endereço abaixo.
- Contato: https://libreplanet.org/wiki/User:Adfeno#vCard
- Arquivos comuns aceitos (apenas sem DRM): Corel Draw, Microsoft
  Office, MP3, MP4, WMA, WMV.
- Arquivos comuns aceitos e enviados: CSV, GNU Dia, GNU Emacs Org, GNU
  GIMP, Inkscape SVG, JPG, LibreOffice (padrão ODF), OGG, OPUS, PDF
  (apenas sem DRM), PNG, TXT, WEBM.

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Ludovic Courtès]

Hello,

Mark H Weaver <mhw@netris.org> skribis:

> Никита Чураев <lamefun.x0r@gmail.com> writes:
>
>> Here's how I want to use Guix and it is to increase
>> contributor-friendliness of a project, so that the user can simply run
>> a distribution-independent command to install all dependencies without
>> having to hunt for them with `apt` and `dnf` manually.
>>
>> Unfortunately, Guix itself is not very easy to install, and the
>> instructions are full of rather technical stuff like 'systemd' and
>> 'upstart'.
>>
>> https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html
>>
>> There should be a script like the one Haskell Stack uses:
>>
>> |curl -sSL https://get.haskellstack.org/ | sh|
>
> I can understand the appeal of such a convenient approach.  However,
> this practice of downloading a script via HTTPS and immediately running
> it as root without inspection puts you at considerable risk.  A
> man-in-the-middle with the resources to compromise or bribe *any*
> certificate authority in your trust store (the attacker could choose
> which one) could acquire a fraudulent certificate to impersonate our
> site, and then substitute in a different script than the one we
> provided.  Quite a few organizations are capable of such an attack
> today.
>
> Therefore, I believe it would be irresponsible for us to promote this
> style of installation.

Seconded.

> However, if there's sufficient interest, and if we could produce a
> sufficiently robust "auto-install" script, we could perhaps do something
> close to what you suggested.  We could provide a script along with a
> GnuPG digital signature.  We could ask the user to download the script,
> acquire our signing key, verify the signature on the script, and then
> run the script as root.

I while back Chris Baines and someone else (?) had worked on such a
script, but I’m not sure what happened.

Chris, does that ring a bell?

It would be nice to have it in time for the new release.

Ludo’.

Re: Idea: Install script to better support improving contributor-friendliness of projects

[myglc2]

On 11/26/2017 at 15:35 Mark H Weaver writes:

> Hi,
>
> Никита Чураев <lamefun.x0r@gmail.com> writes:
>
>> Here's how I want to use Guix and it is to increase
>> contributor-friendliness of a project, so that the user can simply run
>> a distribution-independent command to install all dependencies without
>> having to hunt for them with `apt` and `dnf` manually.
>>
>> Unfortunately, Guix itself is not very easy to install, and the
>> instructions are full of rather technical stuff like 'systemd' and
>> 'upstart'.
>>
>> https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html
>>
>> There should be a script like the one Haskell Stack uses:
>>
>> |curl -sSL https://get.haskellstack.org/ | sh|

Agreed, thank you for raising these issues.

As you point out, the current manual binary install imposes a minimum
bound on the technical sophistication and determination of Guix
"triers". The absence of an automated install effectively filters out
"less sophisticated" users. It no doubt strongly limits the rate of
adoption and size of the user base.

Something like you have suggested is a must to reach a larger audience.
Not having it is like an exclusionary fence around Guix.  If we are
committed to usability and availability of Guix for anyone, we should
provide an automated install. Why haven't we done this yet?  Probably
because no Guix developer has to in/uninstalled Guix on multiple
GNU/Linux distributions every day ;-)

> I can understand the appeal of such a convenient approach.  However,
> this practice of downloading a script via HTTPS and immediately running
> it as root without inspection puts you at considerable risk.  A
> man-in-the-middle with the resources to compromise or bribe *any*
> certificate authority in your trust store (the attacker could choose
> which one) could acquire a fraudulent certificate to impersonate our
> site, and then substitute in a different script than the one we
> provided.  Quite a few organizations are capable of such an attack
> today.
>
> Therefore, I believe it would be irresponsible for us to promote this
> style of installation.
>
> However, if there's sufficient interest, and if we could produce a
> sufficiently robust "auto-install" script, we could perhaps do something
> close to what you suggested.  We could provide a script along with a
> GnuPG digital signature.  We could ask the user to download the script,
> acquire our signing key, verify the signature on the script, and then
> run the script as root.

+1

WRT "sufficient interest", script users will be the prospective Guix
users that today hit a wall on the manual install.  This number no doubt
exceeds all Guix users today ;-)

ISTM, these are the downsides to releasing such a script:

1) increased "less sophisticated" Guix noob support load

2) stress-tests of Guix package management usability

3) increased hydra etal loads

Re: Idea: Install script to better support improving contributor-friendliness of projects

[lamefun.x0r]

Another question, is Guix ever going to ship NVIDIA OpenGL libraries,
considering that this is a GNU project? Flatpak for example ships them
to support NVIDIA GPUs. The project I want to make contributor-friendly 
with help of Guix is a 3D game, so without them Guix is essentially
useless as a dependency installer for many of the potential
contributors.

I managed to launch SuperTux, by forcing it to use system libraries:

LD_PRELOAD="/usr/lib64/libGL.so.1 /usr/lib64/libGLX.so.0 \
/usr/lib64/libX11.so.6 /usr/lib64/libXext.so.6 \
/usr/lib64/libGLdispatch.so.0 /usr/lib64/libxcb.so.1 \
/usr/lib64/libXau.so.6" supertux2

This probably not possible to reliably automate and certainly is
segfault-prone though...

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 728 bytes --]

On Tue, Nov 28, 2017 at 10:43:49PM +0300, lamefun.x0r@gmail.com wrote:
> Another question, is Guix ever going to ship NVIDIA OpenGL libraries,
> considering that this is a GNU project? Flatpak for example ships them
> to support NVIDIA GPUs. The project I want to make contributor-friendly 
> with help of Guix is a 3D game, so without them Guix is essentially
> useless as a dependency installer for many of the potential
> contributors.

Are those libraries free software?

If not, no, we'll never include them in GNU Guix.

But Guix is free software, which means one can use it however they like.
So there is nothing stopping someone from packaging nonfree software and
distributing the packages on their own.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Adonay Felipe Nogueira]

Contributing to what Leo Famulari said:

Guix already allows you to setup a repository yourself for all of those
who use GNU Guix package manager. I think the command was `guix
publish'?

From there on, unless the repository maintainers are commited to follow
the GNU FSDG, the official GNU Guix community will not be able to
recommend it to the general public.

2017-11-28T22:43:49+0300 lamefun.x0r@gmail.com wrote:
> Another question, is Guix ever going to ship NVIDIA OpenGL libraries,
> considering that this is a GNU project? Flatpak for example ships them
> to support NVIDIA GPUs. The project I want to make contributor-friendly 
> with help of Guix is a 3D game, so without them Guix is essentially
> useless as a dependency installer for many of the potential
> contributors.
>
> I managed to launch SuperTux, by forcing it to use system libraries:
>
> LD_PRELOAD="/usr/lib64/libGL.so.1 /usr/lib64/libGLX.so.0 \
> /usr/lib64/libX11.so.6 /usr/lib64/libXext.so.6 \
> /usr/lib64/libGLdispatch.so.0 /usr/lib64/libxcb.so.1 \
> /usr/lib64/libXau.so.6" supertux2
>
> This probably not possible to reliably automate and certainly is
> segfault-prone though...
>
>

-- 
- https://libreplanet.org/wiki/User:Adfeno
- Palestrante e consultor sobre /software/ livre (não confundir com
  gratis).
- "WhatsApp"? Ele não é livre. Por favor, veja formas de se comunicar
  instantaneamente comigo no endereço abaixo.
- Contato: https://libreplanet.org/wiki/User:Adfeno#vCard
- Arquivos comuns aceitos (apenas sem DRM): Corel Draw, Microsoft
  Office, MP3, MP4, WMA, WMV.
- Arquivos comuns aceitos e enviados: CSV, GNU Dia, GNU Emacs Org, GNU
  GIMP, Inkscape SVG, JPG, LibreOffice (padrão ODF), OGG, OPUS, PDF
  (apenas sem DRM), PNG, TXT, WEBM.

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Pjotr Prins]

On Tue, Nov 28, 2017 at 10:43:49PM +0300, lamefun.x0r@gmail.com wrote:
> Another question, is Guix ever going to ship NVIDIA OpenGL libraries,
> considering that this is a GNU project? Flatpak for example ships them
> to support NVIDIA GPUs. The project I want to make contributor-friendly 
> with help of Guix is a 3D game, so without them Guix is essentially
> useless as a dependency installer for many of the potential
> contributors.

OpenGL is free software though possibly underlying CUDA is not. We
started work on it here:

  https://github.com/Brainiarc7/guix-bioinformatics/blob/master/gn/packages/cl.scm

but never got it to work properly.

> I managed to launch SuperTux, by forcing it to use system libraries:
> 
> LD_PRELOAD="/usr/lib64/libGL.so.1 /usr/lib64/libGLX.so.0 \
> /usr/lib64/libX11.so.6 /usr/lib64/libXext.so.6 \
> /usr/lib64/libGLdispatch.so.0 /usr/lib64/libxcb.so.1 \
> /usr/lib64/libXau.so.6" supertux2
> 
> This probably not possible to reliably automate and certainly is
> segfault-prone though...

Yes, and worse, there is no guarantee that they are the same on a
user's system. What you want is a reproducible setup.

I think packaging your game with OpenCL is possible with GNU Guix. You
can ask people here how they are deploying their software.

Distributing the game is possible too. Even installing user land
directories - using my installer

  https://gitlab.com/pjotrp/guix-relocatable-binary-packages

would be straightforward to accomplish.

Pj.

-- 

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Ricardo Wurmus]

Hi,

> Another question, […]

Please start a new thread instead of replying to an unrelated thread.

--
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
https://elephly.net

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Ludovic Courtès]

Mark H Weaver <mhw@netris.org> skribis:

> Никита Чураев <lamefun.x0r@gmail.com> writes:
>
>> Here's how I want to use Guix and it is to increase
>> contributor-friendliness of a project, so that the user can simply run
>> a distribution-independent command to install all dependencies without
>> having to hunt for them with `apt` and `dnf` manually.
>>
>> Unfortunately, Guix itself is not very easy to install, and the
>> instructions are full of rather technical stuff like 'systemd' and
>> 'upstart'.
>>
>> https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html

[...]

> However, if there's sufficient interest, and if we could produce a
> sufficiently robust "auto-install" script

Related to that, someone on IRC suggested removing the “#” from the
shell snippets at
<https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html>,
for easier copy/pasting.

I think I’ll go ahead and do that if nobody objects.

Thanks,
Ludo’.

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Hartmut Goebel]

Am 30.11.2017 um 10:59 schrieb Ludovic Courtès:
> Related to that, someone on IRC suggested removing the “#” from the
> shell snippets at

+1

-- 
Regards
Hartmut Goebel

| Hartmut Goebel          | h.goebel@crazy-compilers.com               |
| www.crazy-compilers.com | compilers which you thought are impossible |

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Arun Isaac]

Ludovic Courtès <ludo@gnu.org> writes:

> Related to that, someone on IRC suggested removing the “#” from the
> shell snippets at
> <https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html>,
> for easier copy/pasting.
>
> I think I’ll go ahead and do that if nobody objects.

There is some value to the "$" and "#" as a way of unambiguously stating
which commands are to be run as root and which commands are to be run as
an unprivileged user. But, it's not a big deal in this case. If you
think it's already clear from the context, do go ahead.

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Vincent Legoll]

On Thu, Nov 30, 2017 at 1:59 PM, Arun Isaac <arunisaac@systemreboot.net> wrote:
> There is some value to the "$" and "#" as a way of unambiguously stating
> which commands are to be run as root and which commands are to be run as
> an unprivileged user. But, it's not a big deal in this case. If you
> think it's already clear from the context, do go ahead.

I prefer a "sudo" in front of the lines that need root perms, looks
more obvious,
the ease of copy/paste is good to have, IMHO.

-- 
Vincent Legoll

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Adonay Felipe Nogueira]

I think it could be replaced with command instructions such as `sudo -i'
(or the one with long option instead, `sudo --login') or the related
`su'-only counterpart (which I forgot how to use because I can't do so).

Perhaps something like this (I don't know if this is correct):

--8<---------------cut here---------------start------------->8---
sudo -i || su
... Do stuff as real/full root.
exit
... Do stuff as normal user.
--8<---------------cut here---------------end--------------->8---

2017-11-30T10:59:09+0100 Ludovic Courtès wrote:
> Mark H Weaver <mhw@netris.org> skribis:
>
>
> [...]
>
>
> Related to that, someone on IRC suggested removing the “#” from the
> shell snippets at
> <https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html>,
> for easier copy/pasting.
>
> I think I’ll go ahead and do that if nobody objects.
>
> Thanks,
> Ludo’.

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Vincent Legoll]

On Thu, Nov 30, 2017 at 2:14 PM, Adonay Felipe Nogueira
<adfeno@hyperbola.info> wrote:
> Perhaps something like this (I don't know if this is correct):
>
> --8<---------------cut here---------------start------------->8---
> sudo -i || su
> ... Do stuff as real/full root.
> exit
> ... Do stuff as normal user.
> --8<---------------cut here---------------end--------------->8---

That would be cleaner, but the other form (sudo on each line) is more
robust wrt doc refactoring

pick your poison

-- 
Vincent Legoll

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Hartmut Goebel]

Am 30.11.2017 um 14:52 schrieb Vincent Legoll:
> That would be cleaner, but the other form (sudo on each line) is more
> robust wrt doc refactoring

But sudo needs to be set up – which on many systems is not the case

-- 
Regards
Hartmut Goebel

| Hartmut Goebel          | h.goebel@crazy-compilers.com               |
| www.crazy-compilers.com | compilers which you thought are impossible |

Re: Idea: Install script to better support improving contributor-friendliness of projects

[Adonay Felipe Nogueira]

+1

2017-11-30T15:12:41+0100 Hartmut Goebel wrote:
> But sudo needs to be set up – which on many systems is not the case