install: Allow to specify alternative `sudo` command #11761

abitrolly · 2024-10-28T07:17:07Z

This allows to specify identity change command for nix installation.

And also prepends such command with env to set environment variables, because not all sudo alternatives support this.

Testing: I haven't found a way to test this yet. Looks like it needs building binary package, which requires nix installed, and I can't install it, because I don't have sudo. :D catch22

Motivation

Some systems do not use sudo but its alternatives like doas.

Context

Prior work.

A good testing strategy would be to run CI tests with Arch box and only doas installed, but I am not proficient yet with nix testing infrastructure to add it here.

Priorities and Process

Add 👍 to pull requests you find important.

The Nix maintainer team uses a GitHub project board to schedule and track reviews.

abathur · 2024-10-28T15:28:38Z

Testing: I haven't found a way to test this yet. Looks like it needs building binary package, which requires nix installed, and I can't install it, because I don't have sudo. :D catch22

It does require some one-time setup (signing up for a third party service and setting up a secret) at the moment, but you can enable CI in your own fork of the repo to generate installers with the process outlined here:

https://github.com/NixOS/nix/blob/master/doc/manual/source/development/testing.md#installer-tests

Then I imagine you could validate that with your local system?

You can use the generated installer locally with something like:

sh <(curl -L https://<username>-nix-install-tests.cachix.org/serve/<hash-that-you-fish-out-of-the-installer-test-job's-install-step>/install) --tarball-url-prefix https://<username>-nix-install-tests.cachix.org/serve

abitrolly · 2024-10-28T16:59:00Z

@abathur I've already installed nix from Arch official package, so it is hard for me to get that involved now. If it is possible to make install scripts self-sufficient, I could test them locally.

Mic92 · 2024-10-30T09:59:17Z

scripts/install-multi-user.sh

@@ -56,6 +56,9 @@ readonly NIX_INSTALLED_CACERT="@cacert@"
 #readonly NIX_INSTALLED_CACERT="/nix/store/7dxhzymvy330i28ii676fl1pqwcahv2f-nss-cacert-3.49.2"
 readonly EXTRACTED_NIX_PATH="$(dirname "$0")"

+# allow to override identity change command
+readonly NIX_BECOME=${NIX_BECOME:-sudo}


I wonder if we could document this somewhere?

Before documenting this as officially supported, need to ensure that alternatives work as expeted. Which requires CI test setup with Arch + doas, for example.

bryanhonof · 2024-11-04T13:56:15Z

scripts/install-multi-user.sh

@@ -56,6 +56,9 @@ readonly NIX_INSTALLED_CACERT="@cacert@"
 #readonly NIX_INSTALLED_CACERT="/nix/store/7dxhzymvy330i28ii676fl1pqwcahv2f-nss-cacert-3.49.2"
 readonly EXTRACTED_NIX_PATH="$(dirname "$0")"

+# allow to override identity change command
+readonly NIX_BECOME=${NIX_BECOME:-sudo}


nitpick(non-blocking): The NIX_BECOME name is confusing to me. Something like NIX_SUDO_PROGRAM would convey the intent a bit better, at least to me. Or maybe the _BECOME name is just a convention I just haven't yet encountered?

It's used in the ansible world: https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_privilege_escalation.html

At first it was NIX_SUDO, but then doas is not sudo - it doesn't support sudo config files etc. So I used Ansible way to name privilege escalation program.

scripts/install-multi-user.sh

Mic92 · 2024-11-04T20:50:30Z

@abathur I've already installed nix from Arch official package, so it is hard for me to get that involved now. If it is possible to make install scripts self-sufficient, I could test them locally.

Docker container could be used for testing this or this https://github.com/quickemu-project/quickemu/

abitrolly · 2024-11-13T12:20:46Z

Ok. I installed quickemu. It pulled a ton of stuff.

$ quickget archlinux latest
Downloading Arch Linux latest 
...
To start your Arch Linux virtual machine run:
    quickemu --vm archlinux-latest.conf

Now need to know what's next.

abitrolly · 2024-11-15T14:27:22Z

$ quickemu --vm archlinux-latest.conf
...
 - Process:  Started archlinux-latest.conf as archlinux-latest (5858)

Now how to test this PR? :D

Mic92 · 2024-11-19T09:14:46Z

Sorry for the delay!

Add this to your virtual machine (I believe quickemu has some file sharing somewhere):

$ nix build ".#hydraJobs.binaryTarball.x86_64-linux"
$ ls -la ./result
dr-xr-xr-x root root     4 B  54 years ago    ./
drwxrwxr-t root nixbld 140 KB 27 minutes ago  ../
.r--r--r-- root root    23 MB 54 years ago    nix-2.25.0pre20241112_dirty-x86_64-linux.tar.xz
dr-xr-xr-x root root     3 B  54 years ago    nix-support/

Unpack on the destination and run the install script:

tar -xf nix*.tar.xz
./nix-*-x86_64-linux/install

abitrolly · 2024-11-22T11:21:13Z

$ nix build ".#hydraJobs.binaryTarball.x86_64-linux"

Looks like I need to have two clean machines.

Machine1 (with nix to build nix from my version of source code):

pacman -Syu --noconfirm nix git
git clone -b alt-sudo https://github.com/abitrolly/nix
cd nix
nix build ".#hydraJobs.binaryTarball.x86_64-linux"
# push ./result/nix*.tar.xz somewhere

Then somehow pull ./result/nix*.tar.xz to push it to another machine.

Machine2 (with no nix to test installation script):

cd /tmp
# pull nix*.tar.xz from somewhere
tar -xf nix*.tar.xz
./nix-*-x86_64-linux/install

Now testing it with containers. quickemu still harder to operate.

abitrolly · 2024-11-22T16:01:00Z

@Mic92

$ nix build ".#hydraJobs.binaryTarball.x86_64-linux"
error: experimental Nix feature 'nix-command' is disabled; add '--extra-experimental-features nix-command' to enable it

Am I doing something wrong?

abitrolly · 2024-11-22T16:25:42Z

The command that worked (thanks to https://discourse.nixos.org/t/error-experimental-nix-feature-nix-command-is-disabled/18089/6 thread from two years ago).

nix --extra-experimental-features "nix-command flakes" build ".#hydraJobs.binaryTarball.x86_64-linux"

abitrolly · 2024-11-22T18:13:15Z

The build took 1 hour.

Mic92 · 2024-11-22T18:50:32Z

Oh. If your computer is not fast enough you may want to get access to an x86 community builder that we have in nix-community.

Mic92 · 2024-11-22T18:52:22Z

So installation with sudo and with doas works?

abitrolly · 2024-11-22T19:21:47Z

So installation with sudo and with doas works?

Nope. I don't know why yet.

$ NIX_BECOME=doas ./nix-2.25.0pre20241112_e87284b-x86_64-linux/install
Note: a multi-user installation is possible. See https://nixos.org/manual/nix/stable/installation/installing-binary.html#multi-user-installation
performing a single-user installation of Nix...
directory /nix does not exist; creating it by running 'mkdir -m 0755 /nix && chown testu /nix' using sudo
./nix-2.25.0pre20241112_e87284b-x86_64-linux/install: line 144: sudo: command not found
./nix-2.25.0pre20241112_e87284b-x86_64-linux/install: please manually run 'mkdir -m 0755 /nix && chown testu /nix' as root to create /nix

abitrolly · 2024-11-22T19:30:30Z

I am trying to find the file from which this ./install script was generated.

abathur · 2024-11-22T19:51:40Z

https://github.com/NixOS/nix/blob/master/scripts/install.in

abitrolly · 2024-11-22T19:55:34Z

@abathur no, this is the script https://github.com/NixOS/nix/blob/master/scripts/install-nix-from-closure.sh

I don't know why the fancy name - for me it should be called install-nix-from-tarball.sh, because it is used in one place only.

✗ rg from-closure
scripts/binary-tarball.nix
26:  substitute ${./install-nix-from-closure.sh} $TMPDIR/install \

maintainers/flake-module.nix
501:            ''^scripts/install-nix-from-closure\.sh$''

Mic92 · 2024-11-23T07:56:04Z

@abitrolly you are currently running a single-user installation whereas your patch is for the multi-user nix-daemon one.

Mic92 · 2024-12-01T15:52:54Z

@abitrolly is this ready for a test?

abitrolly · 2024-12-01T16:28:31Z

Test setup for Arch container/VM.

pacman -Syu --noconfirm doas
echo "permit setenv {PATH=/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin} :wheel" >> /etc/doas.conf
chmod 0400 /etc/doas.conf
useradd -m testu -G wheel
su testu

abitrolly · 2024-12-01T16:32:21Z

@Mic92 yes, I think it is ready.

$ NIX_BECOME=doas ./nix-2.25.0pre20241112_e87284b-x86_64-linux/install
Note: a multi-user installation is possible. See https://nixos.org/manual/nix/stable/installation/installing-binary.html#multi-user-installation
performing a single-user installation of Nix...
directory /nix does not exist; creating it by running 'mkdir -m 0755 /nix && chown testu /nix' using doas
doas (testu@30ace391473a) password: 
copying Nix to /nix/store......................................................
installing 'nix-2.25.0pre20241112_e87284b'
building '/nix/store/64fdx62hd5nmz2plvfwq827c4jbqkj4b-user-environment.drv'...
unpacking 1 channels...
modifying /home/testu/.bash_profile...

Installation finished!  To ensure that the necessary environment
variables are set, either log in again, or type

  . /home/testu/.nix-profile/etc/profile.d/nix.sh

in your shell.
$ . /home/testu/.nix-profile/etc/profile.d/nix.sh
$ nix
error: no subcommand specified
Try 'nix --help' for more information.

abitrolly · 2024-12-05T09:52:22Z

I've tried to setup automated testing using tmt, but it looks not ready for the prime time yet - teemtee/tmt#3405

Do you know any alternative testing frameworks that run tests in isolation with containers?

nixos-discourse · 2024-12-11T21:22:37Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/2024-12-13-nix-team-meeting-minutes-202/57281/1

Mic92 · 2024-12-12T01:12:53Z

Tested single-user and multi-user with sudo and doas.

Mic92 · 2024-12-12T01:13:36Z

@mergify queue

mergify · 2024-12-12T01:13:39Z

queue

✅ The pull request has been merged automatically

The pull request has been merged automatically at 9cf1b0c

abitrolly requested a review from edolstra as a code owner October 28, 2024 07:17

abitrolly force-pushed the alt-sudo branch from 24cc46d to b18d6b1 Compare October 28, 2024 07:52

Mic92 reviewed Oct 30, 2024

View reviewed changes

bryanhonof reviewed Nov 4, 2024

View reviewed changes

abitrolly mentioned this pull request Nov 23, 2024

Rename install-nix-from-closure.sh into install-nix-from-tarball.sh.in #11938

Merged

abitrolly mentioned this pull request Nov 27, 2024

shellcheck: simplify install-nix-from-tarball.sh #11982

Merged

abitrolly added 2 commits November 30, 2024 10:07

install: Allow to specify alternative sudo command

04975f7

Allow sudo alternatives when installing from tarball

e83481f

abitrolly force-pushed the alt-sudo branch from e87284b to e83481f Compare December 1, 2024 15:47

edolstra assigned Mic92 Dec 11, 2024

mergify bot added a commit that referenced this pull request Dec 12, 2024

Merge of #11761

8bb4dac

mergify bot mentioned this pull request Dec 12, 2024

merge queue: embarking master (be04e68) and #11761 together #12041

Closed

27 tasks

mergify bot merged commit 9cf1b0c into NixOS:master Dec 12, 2024
12 checks passed

abitrolly deleted the alt-sudo branch December 12, 2024 08:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

install: Allow to specify alternative `sudo` command #11761

install: Allow to specify alternative `sudo` command #11761

abitrolly commented Oct 28, 2024 •

edited

Loading

abathur commented Oct 28, 2024 •

edited

Loading

abitrolly commented Oct 28, 2024

Mic92 Oct 30, 2024

abitrolly Oct 30, 2024

bryanhonof Nov 4, 2024 •

edited

Loading

Mic92 Nov 4, 2024

abitrolly Nov 12, 2024

Mic92 commented Nov 4, 2024

abitrolly commented Nov 13, 2024

abitrolly commented Nov 15, 2024

Mic92 commented Nov 19, 2024 •

edited

Loading

abitrolly commented Nov 22, 2024 •

edited

Loading

abitrolly commented Nov 22, 2024

abitrolly commented Nov 22, 2024

abitrolly commented Nov 22, 2024

Mic92 commented Nov 22, 2024

Mic92 commented Nov 22, 2024

abitrolly commented Nov 22, 2024

abitrolly commented Nov 22, 2024

abathur commented Nov 22, 2024

abitrolly commented Nov 22, 2024

Mic92 commented Nov 23, 2024

Mic92 commented Dec 1, 2024

abitrolly commented Dec 1, 2024

abitrolly commented Dec 1, 2024

abitrolly commented Dec 5, 2024

nixos-discourse commented Dec 11, 2024

Mic92 commented Dec 12, 2024

Mic92 commented Dec 12, 2024

mergify bot commented Dec 12, 2024 •

edited

Loading

install: Allow to specify alternative sudo command #11761

install: Allow to specify alternative sudo command #11761

Conversation

abitrolly commented Oct 28, 2024 • edited Loading

Motivation

Context

Priorities and Process

abathur commented Oct 28, 2024 • edited Loading

abitrolly commented Oct 28, 2024

Mic92 Oct 30, 2024

Choose a reason for hiding this comment

abitrolly Oct 30, 2024

Choose a reason for hiding this comment

bryanhonof Nov 4, 2024 • edited Loading

Choose a reason for hiding this comment

Mic92 Nov 4, 2024

Choose a reason for hiding this comment

abitrolly Nov 12, 2024

Choose a reason for hiding this comment

Mic92 commented Nov 4, 2024

abitrolly commented Nov 13, 2024

abitrolly commented Nov 15, 2024

Mic92 commented Nov 19, 2024 • edited Loading

abitrolly commented Nov 22, 2024 • edited Loading

abitrolly commented Nov 22, 2024

abitrolly commented Nov 22, 2024

abitrolly commented Nov 22, 2024

Mic92 commented Nov 22, 2024

Mic92 commented Nov 22, 2024

abitrolly commented Nov 22, 2024

abitrolly commented Nov 22, 2024

abathur commented Nov 22, 2024

abitrolly commented Nov 22, 2024

Mic92 commented Nov 23, 2024

Mic92 commented Dec 1, 2024

abitrolly commented Dec 1, 2024

abitrolly commented Dec 1, 2024

abitrolly commented Dec 5, 2024

nixos-discourse commented Dec 11, 2024

Mic92 commented Dec 12, 2024

Mic92 commented Dec 12, 2024

mergify bot commented Dec 12, 2024 • edited Loading

✅ The pull request has been merged automatically

install: Allow to specify alternative `sudo` command #11761

install: Allow to specify alternative `sudo` command #11761

abitrolly commented Oct 28, 2024 •

edited

Loading

abathur commented Oct 28, 2024 •

edited

Loading

bryanhonof Nov 4, 2024 •

edited

Loading

Mic92 commented Nov 19, 2024 •

edited

Loading

abitrolly commented Nov 22, 2024 •

edited

Loading

mergify bot commented Dec 12, 2024 •

edited

Loading