install: Allow to specify alternative sudo command
#11761
Conversation
It does require some one-time setup (signing up for a third party service and setting up a secret) at the moment, but you can enable CI in your own fork of the repo to generate installers with the process outlined here: https://github.com/NixOS/nix/blob/master/doc/manual/source/development/testing.md#installer-tests Then I imagine you could validate that with your local system? You can use the generated installer locally with something like: |
|
@abathur I've already installed |
| @@ -56,6 +56,9 @@ readonly NIX_INSTALLED_CACERT="@cacert@" | |||
| #readonly NIX_INSTALLED_CACERT="/nix/store/7dxhzymvy330i28ii676fl1pqwcahv2f-nss-cacert-3.49.2" | |||
| readonly EXTRACTED_NIX_PATH="$(dirname "$0")" | |||
|
|
|||
| # allow to override identity change command | |||
| readonly NIX_BECOME=${NIX_BECOME:-sudo} | |||
There was a problem hiding this comment.
I wonder if we could document this somewhere?
There was a problem hiding this comment.
Before documenting this as officially supported, need to ensure that alternatives work as expeted. Which requires CI test setup with Arch + doas, for example.
| @@ -56,6 +56,9 @@ readonly NIX_INSTALLED_CACERT="@cacert@" | |||
| #readonly NIX_INSTALLED_CACERT="/nix/store/7dxhzymvy330i28ii676fl1pqwcahv2f-nss-cacert-3.49.2" | |||
| readonly EXTRACTED_NIX_PATH="$(dirname "$0")" | |||
|
|
|||
| # allow to override identity change command | |||
| readonly NIX_BECOME=${NIX_BECOME:-sudo} | |||
There was a problem hiding this comment.
nitpick(non-blocking): The NIX_BECOME name is confusing to me. Something like NIX_SUDO_PROGRAM would convey the intent a bit better, at least to me. Or maybe the _BECOME name is just a convention I just haven't yet encountered?
There was a problem hiding this comment.
It's used in the ansible world: https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_privilege_escalation.html
| @@ -343,7 +346,7 @@ __sudo() { | |||
|
|
|||
| echo "I am executing:" | |||
| echo "" | |||
| printf " $ sudo %s\\n" "$cmd" | |||
| printf " $ $NIX_BECOME %s\\n" "$cmd" | |||
There was a problem hiding this comment.
| printf " $ $NIX_BECOME %s\\n" "$cmd" | |
| printf " $ %s %s\\n" "$NIX_BECOME" "$cmd" |
Docker container could be used for testing this or this https://github.com/quickemu-project/quickemu/ |
This allows to specify identity change command for
nixinstallation.And also prepends such command with
envto set environment variables, because not allsudoalternatives support this.Testing: I haven't found a way to test this yet. Looks like it needs building binary package, which requires
nixinstalled, and I can't install it, because I don't havesudo. :D catch22Motivation
Some systems do not use
sudobut its alternatives likedoas.Context
Prior work.
A good testing strategy would be to run CI tests with Arch box and only
doasinstalled, but I am not proficient yet withnixtesting infrastructure to add it here.Priorities and Process
Add 👍 to pull requests you find important.
The Nix maintainer team uses a GitHub project board to schedule and track reviews.