search

carvel-dev / carvel

Carvel provides a set of reliable, single-purpose, composable tools that aid in your application building, configuration, and deployment to Kubernetes. This repo contains information regarding the Carvel open-source community.
https://carvel.dev/
Apache License 2.0
378 stars 120 forks source link

Install script improvements #656

Open davidpanic opened 1 year ago

davidpanic commented 1 year ago

The current install script has bogus requirements of bash and shasum. Because of the way it is written the script runs fine with sh and sha1sum.

This should be fixed because some environments, for example the Alpine Linux docker image, do not have them. If you are checking for curl and wget, you should also check for sha1sum (or better yet use sha256sum).

The hard requirement on bash is just unneeded.

The requirements can easily be bypassed by just faking the environment, proving my point:

cat <(echo "BASH_VERSION=fake; function shasum() { sha1sum $@; }") <(wget -O- https://carvel.dev/install.sh) | sh
100mik commented 1 year ago

This would actually be true for all the tools so we should probably move this issue

100mik commented 1 year ago

Thanks for bringing this up! The ask is reasonable, but I believe we should see if folks run into this often. If this is a recurring pain point then we would be open to working towards a solution 🙏🏼

Kiran-pro2001 commented 6 months ago

Can I work on this project!

praveenrewar commented 6 months ago

@Kiran-pro2001 Sure! Feel free to raise a PR.

joaopapereira commented 6 months ago

As a matter of fact, the script is autogenerated from the template in https://github.com/carvel-dev/release-scripts/blob/main/scripts/install_sh/install.sh.txt, so any change should be done there.

Ghanasree commented 2 weeks ago

Hey! Can I work on this Issue?

joaopapereira commented 2 weeks ago

The PR #785 was created against this repo and I asked @Jenil1905 to create it in the https://github.com/carvel-dev/release-scripts repository. Was not sure if the answer was "no, I will not do it" or "no, I do not mind creating the PR in that repo" 😄 Nevertheless I am open to any of you 2 to create a PR in that repository and I will review it.