NetSparkleUpdater / NetSparkle

NetSparkle is a C#, cross-platform, highly-configurable software update framework with pre-built UI for .NET developers compatible with .NET 4.6.2/.NET 6+, WinForms, WPF, and Avalonia; uses Ed25519 signatures. View basic usage here in the README and try the samples for yourself.
https://netsparkleupdater.github.io/NetSparkle/
MIT License
596 stars 81 forks source link

Test/fix Linux permissions for installing #250

Open Deadpikle opened 2 years ago

Deadpikle commented 2 years ago

https://github.com/NetSparkleUpdater/NetSparkle/blob/957d131b3e3f724ad3d020da46d239248ba95dc0/src/NetSparkle/SparkleUpdater.cs#L1257

How does sudo work here? Do we even need sudo? Does Linux pop open a thing asking for the password? (I doubt it.) Do we need to pop open a terminal and run things in there (aka make the process not silent so that they can be prompted for their password)? I'm not as familiar with how Linux works, plus there are so many distributions...

Links:

daniel-pastalab commented 2 years ago

There is a way to install linux packages without root by installing it with --force-not-root (https://askubuntu.com/questions/339/how-can-i-install-a-package-without-root-access). But there may be a lot of problems with dependencies (https://stackoverflow.com/questions/18858412/errors-installing-a-deb-without-sudo-root). Unfortunately a lot of distributions are not automatically popping up a graphical password prompt (or even have one).

If gksu is installed (which gksu) the command can be simply run with gksu:

gksu echo hello world

If gksu is not available i think the safest way is to open a separate terminal window with the sudo command (i've seen this method in the wild). The terminal will then ask the user for the password. The problem with this is you have to find out which terminal emulator is used. For that it is advised to go through a list of known terminal emulators (https://superuser.com/questions/1153988/find-the-default-terminal-emulator).

With the known terminal emulator (here urxvt) and the $SHELL variable (already used in SparkleUpdater.cs) you can open a new terminal window:

urxvt -e $SHELL -c "sudo echo hello world"

The much more unsafe method is to ask for the password from the SparkleUpdater and pass it as a parameter to the sudo command (https://superuser.com/questions/67765/sudo-with-password-in-one-command-line). But i think its very unwise to hold it in the application memory.