4 ms·

I'm sorry, I cannot treat seriously project with these installation instructions: --- curl -fsSL https://xmake.io/shget.text https://xmake.io/shget.text | bash

I'm sorry, I cannot treat seriously project with these installation instructions: --- curl -fsSL https://xmake.io/shget.text https://xmake.io/shget.text | bash --- System packet manager? What is it? Never heard about it. It is like copying "src" directory to new name with each change in sources instead using version control system.

williamcotton 2y ago
You mean a package manager like this? /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
- rbanffy 2y ago
  Well… Homebrew solves a lot of problems, and is extremely convenient, but the project was never accused of being a reference for good practices. In that space, I tend to prefer MacPorts.
- saurik 2y ago
  That's actually very different, as first downloading the code and then executing it all at once removes the ability to differentiate--and then serve different files to--people who are separating the two steps for audit from people who are streaming the one to the other via pipe. This paradigm is still reckless, though, even if you refused to believe in the security arguments: if you "merely" have a transient error during the script response--which might actually cut off only part of the last line you received!!--you shouldn't execute the fragment :/. If you insist on doing this and you don't want it to feel like amateur hour to people like me--people who have a strong innate sense of exception safety--you (at least) need to use the bash -c with substitution and add a variable (so you can catch the error with set -e or &&). (c=$(curl) && bash -c "$c")
WhereIsTheTruth 2y ago
Not everyone can rely on their system package manager for up to date programs xmake is available in many OS, including debian https://sources.debian.org/src/xmake/ https://sources.debian.org/src/xmake/
- blacklion 2y ago
  Then installation instructions, which can be checked and reverted if needed step-by step should be provided. Nothing wrong with this. And some script which can fail half-way and leave some debris in filesystem is not good practice.
xigoi 2y ago
So instead of providing a way for anyone to install it, they should convince every single distro to add it to their package manager?

williamcotton 2y ago

You mean a package manager like this? /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

rbanffy 2y ago
Well… Homebrew solves a lot of problems, and is extremely convenient, but the project was never accused of being a reference for good practices. In that space, I tend to prefer MacPorts.
saurik 2y ago
That's actually very different, as first downloading the code and then executing it all at once removes the ability to differentiate--and then serve different files to--people who are separating the two steps for audit from people who are streaming the one to the other via pipe. This paradigm is still reckless, though, even if you refused to believe in the security arguments: if you "merely" have a transient error during the script response--which might actually cut off only part of the last line you received!!--you shouldn't execute the fragment :/. If you insist on doing this and you don't want it to feel like amateur hour to people like me--people who have a strong innate sense of exception safety--you (at least) need to use the bash -c with substitution and add a variable (so you can catch the error with set -e or &&). (c=$(curl) && bash -c "$c")

WhereIsTheTruth 2y ago

Not everyone can rely on their system package manager for up to date programs xmake is available in many OS, including debian https://sources.debian.org/src/xmake/ https://sources.debian.org/src/xmake/

blacklion 2y ago
Then installation instructions, which can be checked and reverted if needed step-by step should be provided. Nothing wrong with this. And some script which can fail half-way and leave some debris in filesystem is not good practice.

xigoi 2y ago

So instead of providing a way for anyone to install it, they should convince every single distro to add it to their package manager?