fix(trust): make trust install runnable — drop the wrong sudo, wire stdin, use abs path - #102
Merged
Merged
Conversation
… stdin, use abs path `devstack doctor` told users to `sudo devstack trust install`, which failed on three counts: 1. `sudo devstack` → "command not found": sudo resets PATH to its secure_path, which excludes ~/.local/bin, so a user-local install isn't found. 2. Running the whole CLI as root is wrong for mkcert anyway — it puts the CA in root's CAROOT (/root/.local/share/mkcert), so cert generation (run as the user) can't find it. mkcert self-elevates its own sudo for just the system store, so `trust install` must run as the user. 3. Even run as the user, `execRunner.Run` wired stdout/stderr but not stdin, so mkcert's internal sudo had no terminal to prompt for a password and failed. Fixes: trust-install remediation now says `devstack trust install` (as the user, no sudo); execRunner.Run wires os.Stdin so mkcert's sudo can prompt; and the remediations that genuinely need root (`dns setup`, `uninstall`) now use the absolute binary path via a new sudoSelfCmd helper (os.Executable()), so `sudo <abs>/devstack …` works despite secure_path. Tests: the CA-not-installed remediation no longer says `sudo devstack …` and points at `trust install`; sudoSelfCmd renders an absolute path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem (reported live)
devstack doctorrecommendssudo devstack trust install, and running it fails withsudo: devstack: command not found. Three bugs:sudo devstack→ "command not found". sudo resetsPATHtosecure_path, which excludes~/.local/bin. (The binary is installed at~/.local/bin/devstack, withds→ symlink — just invisible to sudo.)CAROOTresolves to root's home, so the CA is created in/root/.local/share/mkcertwhile cert generation (as the user) looks in~/.local/share/mkcert. mkcert self-elevates for only the system-store step, sotrust installmust run as the user.execRunner.Runwired stdout/stderr but not stdin, so mkcert's internalsudohad no terminal to prompt for a password.Fix
trust installremediation now saysdevstack trust install(as your user, not sudo).execRunner.Runwiresos.Stdinso mkcert's sudo prompt works.dns setup,uninstall) use the absolute binary path via a newsudoSelfCmdhelper (os.Executable()), sosudo <abs>/devstack …works despitesecure_path.Tests
sudo devstack …and points attrust install.sudoSelfCmdrenders an absolute path.Build (CGO=0),
go vet,trust/clitests all green.🤖 Generated with Claude Code