Add silky smooth way to install anchore-cli on Mac OS.

[nanobeep]

Includes build script, binary build for 0.1.0, and updated install instructions.

[nanobeep]

Here's what the install looks like for the user (using my branch's download url):

~> cd /usr/local/bin                                                                                                
/usr/local/bin> curl -LJO https://raw.githubusercontent.com/nanobeep/anchore-cli/silky-smooth-macos/scripts/macos-bin/anchore-cli
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 7060k  100 7060k    0     0  4166k      0  0:00:01  0:00:01 --:--:-- 4167k
/usr/local/bin> chmod 755 anchore-cli                                                                                
/usr/local/bin> cd
~> which anchore-cli
/usr/local/bin/anchore-cli
~> anchore-cli --version
anchore-cli, version 0.1.0

[zhill]

Thanks for the PR @nanobeep. What specific issues did you hit during install of the cli on OS X? IIRC most of the challenge is getting python setup properly for some openssl things, but it's been a while since I set up from scratch. I absolutely want cli install to be a smooth process, but I don't think including a pre-compiled binary in our github repo is the right approach. Do you have a script or some docs around configuring python properly so that the pip install works cleanly? I'd like to start with docs and if those are too cumbersome or unreliable we can explore other options.

[nanobeep]

Depends on how high a priority usability is for this. A very large portion of the potential user base is on Mac OS. I'd bet the majority are not python devs, though it's just a guess. It took me 2 hours of fussing with ssl/crypto and conflicting pythons and pips from the base system and permission and path issues till I had a clean install I could confidently understand and use.

This aims to make the bar very very low for new users to get their hands dirty with Anchore instead of learning the nuances of python on MacOS.

I would love for there to be a better cleaner way - but in the absence of one, this path would have the lowest barrier to entry and so the lowest attrition rate.

My earlier comment on slack: Python is tricky on Mac OS in general and there isn't great info on it. Basically, there is an older pre-installed version, but it doesn't have pip, but you can install pip with easy_install, but you need to use sudo. Then you need to use sudo with pip, unless you are using --user, but if you use --user, then the binary likely won't be in your PATH, so you need to go update that as well. Then if you use brew, it will install python and name it python2 or python3 depending which version you install. Also it will install pip2 or pip3 as well. Then you need to make sure your dirs in your PATH are in the right order or you'll be getting unexpected python since brew also creates a symlink named python. It's not a walk in the park, especially if someone is newer to python.

On Fri, Sep 22, 2017 at 20:17 Zach Hill notifications@github.com wrote:

Thanks for the PR @nanobeep https://github.com/nanobeep. What specific issues did you hit during install of the cli on OS X? IIRC most of the challenge is getting python setup properly for some openssl things, but it's been a while since I set up from scratch. I absolutely want cli install to be a smooth process, but I don't think including a pre-compiled binary in our github repo is the right approach. Do you have a script or some docs around configuring python properly so that the pip install works cleanly? I'd like to start with docs and if those are too cumbersome or unreliable we can explore other options.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/anchore/anchore-cli/pull/1#issuecomment-331507273, or mute the thread https://github.com/notifications/unsubscribe-auth/AABx0N2XDAlDy0e1WSmkoG1Hndge0Vl0ks5sk-uYgaJpZM4Pgm4F .

[nanobeep]

This doesn't prevent python devs from doing their preferred proper install on Mac OS. It's intended as an option for those who want to try Anchore and aren't interested in taking on learning and debugging a new programming language setup they're unfamiliar with.

On Fri, Sep 22, 2017 at 20:52 Matt Jaynes matt@nanobeep.com wrote:

Depends on how high a priority usability is for this. A very large portion of the potential user base is on Mac OS. I'd bet the majority are not python devs, though it's just a guess. It took me 2 hours of fussing with ssl/crypto and conflicting pythons and pips from the base system and permission and path issues till I had a clean install I could confidently understand and use.

This aims to make the bar very very low for new users to get their hands dirty with Anchore instead of learning the nuances of python on MacOS.

I would love for there to be a better cleaner way - but in the absence of one, this path would have the lowest barrier to entry and so the lowest attrition rate.

My earlier comment on slack: Python is tricky on Mac OS in general and there isn't great info on it. Basically, there is an older pre-installed version, but it doesn't have pip, but you can install pip with easy_install, but you need to use sudo. Then you need to use sudo with pip, unless you are using --user, but if you use --user, then the binary likely won't be in your PATH, so you need to go update that as well. Then if you use brew, it will install python and name it python2 or python3 depending which version you install. Also it will install pip2 or pip3 as well. Then you need to make sure your dirs in your PATH are in the right order or you'll be getting unexpected python since brew also creates a symlink named python. It's not a walk in the park, especially if someone is newer to python.

On Fri, Sep 22, 2017 at 20:17 Zach Hill notifications@github.com wrote:

Thanks for the PR @nanobeep https://github.com/nanobeep. What specific issues did you hit during install of the cli on OS X? IIRC most of the challenge is getting python setup properly for some openssl things, but it's been a while since I set up from scratch. I absolutely want cli install to be a smooth process, but I don't think including a pre-compiled binary in our github repo is the right approach. Do you have a script or some docs around configuring python properly so that the pip install works cleanly? I'd like to start with docs and if those are too cumbersome or unreliable we can explore other options.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/anchore/anchore-cli/pull/1#issuecomment-331507273, or mute the thread https://github.com/notifications/unsubscribe-auth/AABx0N2XDAlDy0e1WSmkoG1Hndge0Vl0ks5sk-uYgaJpZM4Pgm4F .

[nanobeep]

Looking again at your questions - yes, a guide could be put together to outline an ideal Python/pip/dependencies setup for Mac OS. It would be educational and there doesn't seem to be an existing good and complete source online. The official Python docs and Homebrew docs are both lacking.

Ultimately, it seems pretty rough to say to users "I know you're excited about Anchore, but rather than get started right away, please learn this new programming ecosystem and how to debug it and then if that's successful, you can try Anchore."

We talked about a golang binary being a possible good solution, so I'm confused about the resistance for a binary. Does the source language matter that much?

[zhill]

@nanobeep Thanks for looking into this and helping improve the user experience. Very much appreciated. I think we need to step back for a second as I think there is some confusion related to the original slack conversation, and apologies for that. The original problem was "how can we make it easy for users to run Anchore CLI if they aren't already a python user on OS X/MacOS". As you discovered, and as I've seen in the past, there can be challenges to get pip and python running on OS X, particularly with homebrew. We want to find a solution that does not require a binary to live in the code repository (introducing binaries in text-based source repos comes along with complications), and if we cannot then we should look into other binary distribution mechanisms for OSX (like adding a release artifact that pushes to homebrew, for OSX homebrew users). I'd still like to merge your script to build the binary--it's useful to have that in the repo. But, after some experimentation I think we can get a good experience with the existing code using some better documentation. I was able to locate a clean Mac over the weekend and experiment with some options and confirmed that there is a pip-based solution that meets the criteria and has the advantage of clean upgrades tracking our code over time and using the existing release process artifacts.

As a Mac OS user starting from scratch, the first challenge is that our instructions do not give specifics for OS X, so one is left to assume linux instructions. Because there are no instructions, a user will likely first try to run 'pip install anchorecli' and discover that pip is not installed. At that point, some googling will take a the user down one of two paths: 'sudo easy_install pip' or 'brew install python'. If you choose the homebrew option, things get tricky quickly. But, if he/she chooses easy_install, it's a very simple and straightforward process that takes 3 commands.

sudo easy_install pip
pip install --user anchorecli
export PATH=${PATH}:${HOME}/Library/Python/2.7/bin

it addresses the problem and works using the existing source distribution without requiring any direct access to github or getting the user off of our specific releases. We can include a step to add the PATH to .bash_profile but I think most users will understand how to do that if desired since our user-base is technical and docker users.

The only downsides to the above that I see are:

1. Requires sudo -- Mac users should be ok with this, they are personal laptops and not shared servers, and the sudo call is not for installing our software but a well known component of the python ecosystem.
2. Uses a user-local pip install -- Once the bin dir is on the path, it's fine as well as being isolated from other weirdness of OS X's python install (the 'six' package specifically).
3. Does not address updating python to latest version -- That is outside the scope of anchore cli install itself, but I did test and using the .pkg you get from python.org for OS X works just fine and does not interfere with the installed CLI. So, for a non-python Mac user that seems a natural path.

I'd like to merge your build script as well as some updates to the README.rst indicating something like the above if you can submit a new PR. I think the cleanest path for the merge is a new PR and I can close the one once you submit the new one. Again, thanks for your help on this and apologies for any confusion. We really appreciate your time and input.

[nanobeep]

Thanks for the details - I see where you're coming from. I probably ran into so many problems since I had previous python/pip installs for Ansible, etc. Perhaps I'll look into brew at some point, but this seems fine for now and should cover the fresh-pip-install users well.