8 ms·

Ok, so I gotta ask - why package it at all? I'd never recommend it for a public tool, but in an internal, trusted environment, why not post a "curl ... | sh" co

Ok, so I gotta ask - why package it at all? I'd never recommend it for a public tool, but in an internal, trusted environment, why not post a "curl ... | sh" command? Or point them at the master/main.zip of the repo where that script lives in gitlab/hub/something? If this is aimed for developers, going through all of that to provide an installable and clickable thing feels a bit unnecessary... Alternatively, since you're already using nixpkgs, that contains some wrappers and examples for signing Darwin binaries. May be easier than doing it from scratch.

madduci 3y ago
> Ok, so I gotta ask - why package it at all? I'd never recommend it for a public tool, but in an internal, trusted environment, why not post a "curl ... | sh" command? Because I don't want to install some tools on my PC just to build _your tool_. A packaged application is less complicated for the final user to use it. In this, Windows and some Linux distribution have managed to create a good experience (MSI, AppImage, Flatpack)
- fodkodrasz 3y ago
  You call MSI a good experience until you had to create one.
  - chii 3y ago
    The end user isn't privy to how an MSI is created - and that's all that matters. Developers suffer what they must, while the user suffers what they will.
    - fodkodrasz 3y ago
      The article is about developers suffering what they must, so I guess it matters only as much as the article we are commenting.
  - pjc50 3y ago
    MSI is one of the more insane file formats out there. MSIX/Appx is a little more sane but still quite bureaucratic to construct.
    - viraptor 3y ago
      With some cherries on top like msix supporting setting up services on desktop but not server editions of windows. Chef's kiss...
  - deleted 3y ago
    [deleted]
- viraptor 3y ago
  This post describes installing a script to install other things. So that decision's already been made in this case.
- threeseed 3y ago
  But this is about the Mac and curl etc is built-in. And the Mac has equivalents such as the standard installer, DMG images etc.
- latexr 3y ago
  > Because I don't want to install some tools on my PC just to build _your tool_. You’re conflating packaging with building. They’re different steps. You package for distribution after building. Yes, yes, you can have a package manager build the tool and whatnot, but that’s not the case the article is discussing.
eesmith 3y ago
The author wrote the following concerning a curl option: """So, what can we do with all of this? We have a few options, but none of them are particularly appealing. ... Download the file with curl. Unix command-line tools like curl and tar don’t add the quarantine bit to the files they create on macOS, so it’s pretty easy to run software downloaded with them. Unfortunately, the repository where this tool is developed is private, so unauthenticated curl downloads won’t work. I’m seriously considering asking the CTO if we can make the repository public solely so we can use curl as a distribution mechanism. I could even write a platform-detecting shell script! """ The "curl ... | sh" technique could get pass through the authentication information for a subsequent curl call, but then authentication becomes a facade.
- viraptor 3y ago
  That's why I added the bit about downloading master/main.zip. You can do that from the logged in browser and it's still around the same number of steps as installing a custom package and running it. (Login. Download the package/script. Install the package or unzip the script. Run it.)
- josephg 3y ago
  Just add an authentication header to the curl command.
- jwalton 3y ago
  > Unfortunately, the repository where this tool is developed is private Have you thought about publishing the install.sh and final zip file through GitHub pages? Or Cloudflare pages? Then the repo stays private, but the built application can be accessed publicly, and behind a hard-to-guess url.
deleted 3y ago
[deleted]
beccaooo 3y ago
This is a great question! For some added context, this is the tool that bootstraps the developer environment. It installs Nix and Homebrew, configures the PostgreSQL service, and so on. I also work on developer UX full time, so I had hoped code signing would be a way to make the developer experience smooth and seamless (we already pay Apple for the signing certs, after all!). > in an internal, trusted environment, why not post a "curl ... | sh" command? It's internal code, so we can't use a public (e.g.) GitHub URL, and developers running this tool may not yet have SSH keys or the VPN set up yet. > point them at the master/main.zip of the repo Basically the same issue -- developers would have to install a Rust toolchain and compile the code themselves. > Alternatively, since you're already using nixpkgs, that contains some wrappers and examples for signing Darwin binaries. It would! But this tool is what developers use to install and configure Nix in the first place, so it's not a great fit here. (Although we do have it packaged in Nix for users that already have Nix installed.)
- viraptor 3y ago
  > Basically the same issue -- developers would have to install a Rust toolchain and compile the code themselves. Why? The current script installs Rust for them, so the downloaded repo snapshot can do the same thing. Whatever is distributed in the signed package can be in that zip file instead.

madduci 3y ago

> Ok, so I gotta ask - why package it at all? I'd never recommend it for a public tool, but in an internal, trusted environment, why not post a "curl ... | sh" command? Because I don't want to install some tools on my PC just to build _your tool_. A packaged application is less complicated for the final user to use it. In this, Windows and some Linux distribution have managed to create a good experience (MSI, AppImage, Flatpack)

fodkodrasz 3y ago
You call MSI a good experience until you had to create one.
- chii 3y ago
  The end user isn't privy to how an MSI is created - and that's all that matters. Developers suffer what they must, while the user suffers what they will.
  - fodkodrasz 3y ago
    The article is about developers suffering what they must, so I guess it matters only as much as the article we are commenting.
- pjc50 3y ago
  MSI is one of the more insane file formats out there. MSIX/Appx is a little more sane but still quite bureaucratic to construct.
  - viraptor 3y ago
    With some cherries on top like msix supporting setting up services on desktop but not server editions of windows. Chef's kiss...
- deleted 3y ago
  [deleted]
viraptor 3y ago
This post describes installing a script to install other things. So that decision's already been made in this case.
threeseed 3y ago
But this is about the Mac and curl etc is built-in. And the Mac has equivalents such as the standard installer, DMG images etc.
latexr 3y ago
> Because I don't want to install some tools on my PC just to build _your tool_. You’re conflating packaging with building. They’re different steps. You package for distribution after building. Yes, yes, you can have a package manager build the tool and whatnot, but that’s not the case the article is discussing.

eesmith 3y ago

The author wrote the following concerning a curl option: """So, what can we do with all of this? We have a few options, but none of them are particularly appealing. ... Download the file with curl. Unix command-line tools like curl and tar don’t add the quarantine bit to the files they create on macOS, so it’s pretty easy to run software downloaded with them. Unfortunately, the repository where this tool is developed is private, so unauthenticated curl downloads won’t work. I’m seriously considering asking the CTO if we can make the repository public solely so we can use curl as a distribution mechanism. I could even write a platform-detecting shell script! """ The "curl ... | sh" technique could get pass through the authentication information for a subsequent curl call, but then authentication becomes a facade.

viraptor 3y ago
That's why I added the bit about downloading master/main.zip. You can do that from the logged in browser and it's still around the same number of steps as installing a custom package and running it. (Login. Download the package/script. Install the package or unzip the script. Run it.)
josephg 3y ago
Just add an authentication header to the curl command.
jwalton 3y ago
> Unfortunately, the repository where this tool is developed is private Have you thought about publishing the install.sh and final zip file through GitHub pages? Or Cloudflare pages? Then the repo stays private, but the built application can be accessed publicly, and behind a hard-to-guess url.

deleted 3y ago

[deleted]

beccaooo 3y ago

This is a great question! For some added context, this is the tool that bootstraps the developer environment. It installs Nix and Homebrew, configures the PostgreSQL service, and so on. I also work on developer UX full time, so I had hoped code signing would be a way to make the developer experience smooth and seamless (we already pay Apple for the signing certs, after all!). > in an internal, trusted environment, why not post a "curl ... | sh" command? It's internal code, so we can't use a public (e.g.) GitHub URL, and developers running this tool may not yet have SSH keys or the VPN set up yet. > point them at the master/main.zip of the repo Basically the same issue -- developers would have to install a Rust toolchain and compile the code themselves. > Alternatively, since you're already using nixpkgs, that contains some wrappers and examples for signing Darwin binaries. It would! But this tool is what developers use to install and configure Nix in the first place, so it's not a great fit here. (Although we do have it packaged in Nix for users that already have Nix installed.)

viraptor 3y ago
> Basically the same issue -- developers would have to install a Rust toolchain and compile the code themselves. Why? The current script installs Rust for them, so the downloaded repo snapshot can do the same thing. Whatever is distributed in the signed package can be in that zip file instead.