3 ms·
Right, you need to have uv installed, and if you don't, you'll probably have to install it manually or through `curl | sh`. I think this is a valid complaint. S
by networked 2y ago
Right, you need to have uv installed, and if you don't, you'll probably have to install it manually or through `curl | sh`.
I think this is a valid complaint.
Something to consider is that it will become less of an issue as package managers include uv in their repositories.
For example, uv is already available in Alpine Linux and Homebrew: https://repology.org/project/uv/versions https://repology.org/project/uv/versions.
Another thing is that inline script metadata is a Python standard.
When there is no uv on the system and uv isn't packaged but you have the right version of Python for the script, you can run the script with pipx: https://pipx.pypa.io/stable/examples/#pipx-run-examples https://pipx.pypa.io/stable/examples/#pipx-run-examples.
pipx is much more widely packaged: https://repology.org/project/pipx/versions https://repology.org/project/pipx/versions.
- Gud 2y agocurl | sh is an abhorrent practice and should never be used.
- tempaccount420 2y agoThe alternative is to wait for the 10 different distros to all package your program and then update it once every blue moon.
- Gud 2y agoWhy do you use 10 different distros that only get updated once in a blue moon?
- dagw 2y agoI am not using 10 different OSs/distors, but across every potential user of my tool, it could very easily be 10+.
- sgarland 2y agoNo, the alternative is to package it yourself and offer it with a signing key. If you make a .deb and .rpm, you’ve covered a large majority of end users.
- tempaccount420 2y agoThat sounds worse than the status quo, a lot of developers use Arch Linux, NixOS, other uncommon (to non-devs) distros. Why is signing key with .deb/.rpm better than `curl | sh` from a HTTPS link on a domain owned by the author? .deb/.rpm also contain arbitrary shell commands.
- sgarland 2y agoIf the shell script happens to have key verification built in to it, then not much from the perspective of provenance verification, but that’s rare IME. Also, using the OS’s package manager means that you can trivially uninstall it.
- Myrmornis 2y agoIt's often both useful and appropriate in Dockerfiles.
- Gud 2y agoThat this is normal docker practice just confirms my belief that docker is to be avoided.