Why the crappy system-breaking script for installation?
I know this has been a theme for years now: instead of providing a tarball and documentation, most "apps" nowadays provide a script that does horrible things on your system unless it's ran in a container... and even then...
But I would have expected much better from this. Mojo should be installable as non-root and without using a script and repo setup should be more standard.
Yes, there are manual instructions (telling users to use curl as root, which is a big no-no) and putting data (gpg keys) in a location that belongs to the package manager (/usr/share) yet is not tracked by the package manager (that key should be under /run or /etc depending on how long it is kept around,).
So while I do really commend the fact that you got this almost right, getting to a system where the modular sdk is installed and updated by the package manager, the ways provided to get there are atrocious.
Please provide a signed tarball and minimal documentation for non-root installs, change /usr/share/keyrings/... -> /etc/keyrings/... and just tell people which repositories to add on the (custom page) website instead of having them run curl for no reason (and as root).
You already spell out a 6-line custom "manual installation" script, it wouldn't have been much harder to tell people to install apt-transport-https and show the verbatim content of the files you tell people to curl telling them where to paste them.
I understand you want to be as foolproof as possible (and as such, I'm not suggesting removing the "manual installation" part or make that exact thing a script) but please just make it easy and secure for non-fools too. And stop with the overcomplicated script madness: you support Ubuntu 20.04. You might have rpm repos, just document how to cleanly use it then. It's fine.
9 Replies
Hi thanks for the feedback, the items I have are:
- Allow to install without sudo
- For manual instructions, just give the actual script instead of asking to curl it
- put gpg keys into /etc/keyrings/...
Was that everything or do you think those three items cover it?
In addition to the 3 points, if you have to provide a script, I would make it much simpler: just support Ubuntu, make it a single file and sign it. On any other system, people will figure it out with the "manual" instructions. Thanks for having a look Jack.
I use OpenSUSE Tumbleweed on my laptop, and would appreciate an rpm repo compatible with Yast to provide easy installation and updates to Mojo. TIA! 😀
I am not questioning that. The repos are excellent, the documentation and scripts to put it in place are awful.
I'm sure a 'rustup' style updater written in mojo will appear some time in future.
Relevant and entertaining talk: https://www.youtube.com/watch?v=stChOsejLEQ
Zig SHOWTIME
YouTube
Stay Together For The Kids - Andrew Kelley - Software You Can Love ...
Stay Together For The Kids: Why System Package Managers and Language Package Managers Struggle to Cooperate
I didn't mind the script, however it errored out on the "apt-get update" step. and it took me a while to figure out that what was going.
Which was this:
I have a couple dangling repos that I don't care about: they give apt-get update errors which I just ignore.
However the installer catches these apt-get errors and terminats the installation with a very unhelpful error message I had to figure out where the remote installation script was (two levels of indirection), and copy it into a text file to locate the problem. (The installer script sends apt-get output to &>$tmp_log (which I couldn't find)). Stripping off &>$tmp_log revealed what was going on. Anyhoo, that wasted about an hour. Although it did force me to tidy up my repos, so there's that.
However the installer catches these apt-get errors and terminats the installation with a very unhelpful error message I had to figure out where the remote installation script was (two levels of indirection), and copy it into a text file to locate the problem. (The installer script sends apt-get output to &>$tmp_log (which I couldn't find)). Stripping off &>$tmp_log revealed what was going on. Anyhoo, that wasted about an hour. Although it did force me to tidy up my repos, so there's that.
This is a great talk, AK is always great, this is one of my fav ever: https://vimeo.com/649009599
Handmade Cities
Vimeo
Andrew Kelley - Practical DOD
Andrew Kelley, creator of Zig, picks up where Mike Acton left off to teach us practical ways to apply data-oriented design References: - CppCon 2014: Mike Acton…
@MPloppy I raised an internal ticket for the points you raised here thanks