3 ms·

Install scripts are kinda like make install, with which I had bad experiences. Often there is no command to uninstall again, and even if, can you trust that it

by est31 6y ago

Install scripts are kinda like make install, with which I had bad experiences. Often there is no command to uninstall again, and even if, can you trust that it works and really uninstalls stuff cleanly? What if there is an error in one half of the execution? Scripts are not a good way to install software. Do everything with declarative schemes if you can. Then have the runtime deal with partial installs/uninstalls etc. This is less of a security issue and more of a conventions issue. Also, install scripts often run as root instead of the compiling user.

jessaustin 6y ago
With "make install", I usually just pass a "--prefix=/usr/local/stow/" flag and let GNU stow take care of actual install and uninstall. You may be able to alter the perms on that subdirectory to avoid running as root, although I haven't bothered. I only go to such trouble when it's necessary to use something that hasn't been packaged by OS maintainers. Like make, npm isn't really intended to replace OS package management. npm is for using really "fresh" software. Of course we have to be more careful doing that, so we only do it when the benefits outweigh the costs.
- est31 6y ago
  > Like make, npm isn't really intended to replace OS package management. npm is for using really "fresh" software. I'm not sure what you suggest here. Chrome extensions are heavily sandboxed and thanks to that you can remove them cleanly. Does this mean that Chrome replaces OS package management? Is your intent to say that making npm installation more "dangerous" for users is a good idea as it drives people towards OS package management? What about the large set of software that is not won't ever be packaged for your distro/OS?
- johnisgood 6y ago
  I use zpkg[1] for that. I only mention it because I doubt anyone really knows about it. I got to know about it by "accident". There is no README, so I am afraid you have to just listen to the output you get from running it and/or reading the source code. I used GNU stow before, but this one does what I want and not much more. [1] https://zolk3ri.name/cgit/zpkg/ https://zolk3ri.name/cgit/zpkg/ (https://zolk3ri.name/cgit/zpkg/tree/src/zpkg.ml https://zolk3ri.name/cgit/zpkg/tree/src/zpkg.ml)
- Galanwe 6y ago
  > With "make install", I usually just pass a "--prefix=/usr/local/stow/" flag and let GNU stow take care of actual install and uninstall I used to do something like that 10 years ago. From what I remember, GNU stow was not really able to do that properly though, because of the way it handles nested un-existing directories. I. E. It will symlinks a whole directory if it does not previously exist, which will make later deployments of new symlinks inside impossible. Also it did not handle absolute symlinks. For these reasons, I used "xstow". Edit: just had a look at the latest version of GNU stow, looks like they corrected the folding issue, that's great!

by est31 6y ago

jessaustin 6y ago

With "make install", I usually just pass a "--prefix=/usr/local/stow/" flag and let GNU stow take care of actual install and uninstall. You may be able to alter the perms on that subdirectory to avoid running as root, although I haven't bothered. I only go to such trouble when it's necessary to use something that hasn't been packaged by OS maintainers. Like make, npm isn't really intended to replace OS package management. npm is for using really "fresh" software. Of course we have to be more careful doing that, so we only do it when the benefits outweigh the costs.

est31 6y ago
> Like make, npm isn't really intended to replace OS package management. npm is for using really "fresh" software. I'm not sure what you suggest here. Chrome extensions are heavily sandboxed and thanks to that you can remove them cleanly. Does this mean that Chrome replaces OS package management? Is your intent to say that making npm installation more "dangerous" for users is a good idea as it drives people towards OS package management? What about the large set of software that is not won't ever be packaged for your distro/OS?
johnisgood 6y ago
I use zpkg[1] for that. I only mention it because I doubt anyone really knows about it. I got to know about it by "accident". There is no README, so I am afraid you have to just listen to the output you get from running it and/or reading the source code. I used GNU stow before, but this one does what I want and not much more. [1] https://zolk3ri.name/cgit/zpkg/ https://zolk3ri.name/cgit/zpkg/ (https://zolk3ri.name/cgit/zpkg/tree/src/zpkg.ml https://zolk3ri.name/cgit/zpkg/tree/src/zpkg.ml)
Galanwe 6y ago
> With "make install", I usually just pass a "--prefix=/usr/local/stow/" flag and let GNU stow take care of actual install and uninstall I used to do something like that 10 years ago. From what I remember, GNU stow was not really able to do that properly though, because of the way it handles nested un-existing directories. I. E. It will symlinks a whole directory if it does not previously exist, which will make later deployments of new symlinks inside impossible. Also it did not handle absolute symlinks. For these reasons, I used "xstow". Edit: just had a look at the latest version of GNU stow, looks like they corrected the folding issue, that's great!