howyallare
commented
1 year ago FWIW, I think the Windows builds would have env=msvc rather than env=gnu (they import VCRUNTIME and UCRT rather than libstdc++ and libgcc).
Closed coolaj86 closed 11 months ago
howyallare
commented
1 year ago FWIW, I think the Windows builds would have env=msvc rather than env=gnu (they import VCRUNTIME and UCRT rather than libstdc++ and libgcc).
coolaj86
commented
1 year ago @howyallare yeah, I misunderstood two things:
I'm AFK for the weekend (on my return trip now), but I'll update the PR when I get back.
howyallare
commented
1 year ago None of the builds use static linking (though Linux and Windows probably should), thus the different glibc and musl versions. This leads to a couple of other considerations:
coolaj86
commented
1 year ago Updated:
- AtomicParsley-x86_64-unknown-linux-musl.zip
+ AtomicParsley-x86_64-unknown-linux-musl++.zip
- AtomicParsley-x86_64-pc-windows-gnu.zip
+ AtomicParsley-x86_64-pc-windows-msvc.zip
- AtomicParsley-x86-pc-windows-gnu.zip
+ AtomicParsley-x86-pc-windows-msvc.zip
wez
commented
11 months ago Thanks for diving in here, and I appreciate the time you've spent on this, but I'm not going to merge either this or the other webi related PR, for a couple of reasons:
1) I'm philosophically opposed to the curl URL | bash installation method, and don't want to encourage users to use this dangerous practice. I'm not going to try to convince you to change anything in your project, it's just not what I want for my projects.
2) This PR only serves as a convenience for automation in one single external project. It makes it harder for humans to pick out the release for their system.
Again, I thank you for your time.
coolaj86
commented
11 months ago I'm philosophically opposed to the
curl URL | bashinstallation method, and don't want to encourage users to use this dangerous practice.
Would you prefer brew-style curl or command-style?
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
/bin/sh -c "$(curl -fsS https://webi.sh/AtomicParsley)"vs
brew install atomicparsley
webi atomicparsleyThe reason we default to curl -sS https://webi.sh | sh rather than sh -c "$(curl -fsS https://webi.sh/) is:
sh, bash, zsh, and fish without alterationsh -c $(...) method)-L - instead we hard fail on http or a misplaced file, which prevents certain MITM attacks \
(brew uses -L because historically GitHub sometimes changes the URL on-the-fly 🤦♂️)brewcurl | sh installs webi, future installs can be done with webi AtomicParsleyAlso, since we don't have to deal with legacy compatibility, we take advantage of a few modern security practices that brew hasn't incorporated yet:
sudo (everything goes into the standard ~/.local/opt and ~/.local/binHowever, if you webi brew, it eliminates the insecure -L and automates the no-sudo install from their official instructions.
wez
commented
11 months ago curl | sh is inherently sketchy and encourages people to blindly trust running scripts from the internet. Normalizing this has consequences: I've seen the results of this sort of flow being owned by attackers and the outcome can be dire.
I'm not going to try to convince you to change anything you are doing, but rather want to make it plain that you cannot convince me to advise people to use this technique to directly install software that I maintain.
Again, I thank you for your effort and interest, but that's all I want to say and do on this matter.
I'm the one of the core maintainers of webinstall.dev and I'm adding an AtomicParsley installer.
I'm submitting this change to use standard host triples for release names so that standard so that the install type can be automated by Webi and other installer and package management tools without requiring custom mappings or manual configuration.
AtomicParsley-x86_64-apple-darwin.zip(Intel & M1)AtomicParsley-x86_64-unknown-linux-musl++.zip(Alpine / musl ONLY due to musl++)AtomicParsley-x86_64-unknown-linux.zip(Debian / libc only)AtomicParsley-x86_64-pc-windows-msvc.zip(Windows & Windows 11 ARM)AtomicParsley-x86-pc-windows-msvc.zip(Windows i686)This is very common across GitHub (and other platforms) for projects that provide binary releases.
The Host Triple Standard
Most of the common C-family / libc-compatible build tools for C, C++, Rust, GoReleaser, and Zig put host triple is format of
<cpu>-<platform>-<os>-<libc>(technically a host quadruple I suppose).LLVM
arch= x86_64, i386, arm, thumb, mips, etc.sub= for ex. on ARM: v5, v6m, v7a, v7m, etc.vendor= pc, apple, nvidia, ibm, etc.sys= none, linux, win32, darwin, cuda, etc.env= eabi, gnu, android, macho, elf, etc.Source: https://clang.llvm.org/docs/CrossCompilation.html
Rust
Zig
Zig also has a nice list: