install-multi-user.sh asks user to "edit this script" when it's invoked by the curl | sh script

[zhaofengli]

Describe the bug

Currently, install-multi-user.sh asks the user to "edit this script" when it's invoked by the curl | sh script, which can be confusing.

Steps To Reproduce

Was helping a friend resolve some Nix issue on Arch Linux. He had a previous multi-user Nix installation with archlinux-nix and wanted to reinstall with the official script. The script outputs the following:

---- oh no! --------------------------------------------------------------------
It seems the build group nixbld already exists, but
with the UID 967. This script can't really handle
that right now, so I'm going to give up.

You can fix this by editing this script and changing the
NIX_BUILD_GROUP_ID variable near the top to from 30000
to 967 and re-run.

We'd love to help if you need it.If you can, open an issue at https://github.com/nixos/nix/issuesOr feel free to contact the team,
 - on IRC #nixos on irc.freenode.net
 - on twitter @nixos_org

Expected behavior

The script should not ask the user to edit it when it's invoked by install-nix-from-closure.sh or through the the curl | sh command (manual). The user is unlikely to find the correct file to edit.

[abathur]

@zhaofengli I agree this isn't helpful.

I'm not sure if the two of you are actually hoping to follow the process the error suggests, but just in case here's what I remember doing for an unrelated reason a while back:

1. curl the installer script and either read the output on console directly or redirect it to a file as a reference.
2. look in the script for the curl command it uses to download the full installer tarball and its subsequent commands for unpacking the tarball
3. IIRC these use a tmpdir by default; modify them to download and unpack the tarball into a regular directory
4. modify the script
5. run the actual install script (I think install-nix-from-closure.sh is named install in the tarball).

Feel free to ignore the section below; I'm just connecting dots/cross-referencing.

---

• WIP: Avoid using integer identifiers in install script #4346 would obsolete this installer behavior if it landed (though it would need to be updated per other issues/PRs since it was opened--intentionally avoiding cross-linking those here since they aren't directly related).

• I'm not up on their full implications, but Automatic UID allocation #3600 / Merge master into #3600 #4155 might also ultimately fix this issue (at least on Linux).

• The underlying issue here is one of a small cluster that boil down to fragile handling of UIDs and GIDs (such as Nix fails to install when an existing group is assigned the GID of 30000 #3846).

  (I don't think it _has_ to be fragile, but there are ~real reasons it is...)

  • lack of cross-platfrom automated testing has made testing installer changes tedious. basic automated cross-platform installer testing was added a few months ago (this is a large improvement--but there also isn't a robust test suite behind it yet...)
  • getting this right is "hard" because different systems have different commands for managing users/groups that the installer needs to abstract over
  • the subset of people with the stomach to touch the installer is small
  • the subset of those with mac + linux systems (and knowledge) is smaller
  • the subset of those with the stomach to fiddle people's users/groups is even smaller

• A good implementation of the installer change(s) described in https://discourse.nixos.org/t/anyone-up-for-picking-at-some-nix-onboarding-improvements/13152 should include the ability to remove Nix's build users/group across platforms, which would likely fix this specific issue (by prompting the user for permission to remove the group).

  I hadn't thought of group-already-exists-with-unexpected-GID as in-scope there, but the ~goal of that effort is to sand down exactly this kind of rough edge (i.e., the kind that halts the installer and gives the user homework).

[benley]

As an interim workaround, would it be reasonable to let users override NIX_BUILD_GROUP_ID without editing the script? I believe it would be a very small change that should not complicate future improvements:

diff --git a/scripts/install-multi-user.sh b/scripts/install-multi-user.sh
index 7d1cb8c5a..a1e44dc4f 100644
--- a/scripts/install-multi-user.sh
+++ b/scripts/install-multi-user.sh
@@ -23,7 +23,7 @@ readonly RED='\033[31m'
 # installer allows overriding build user count to speed up installation
 # as creating each user takes non-trivial amount of time on macos
 readonly NIX_USER_COUNT=${NIX_USER_COUNT:-32}
-readonly NIX_BUILD_GROUP_ID="30000"
+readonly NIX_BUILD_GROUP_ID=${NIX_BUILD_GROUP_ID:-30000}
 readonly NIX_BUILD_GROUP_NAME="nixbld"
 # darwin installer needs to override these
 NIX_FIRST_BUILD_UID="30001"
@@ -438,12 +438,11 @@ create_build_group() {
         if [ "$primary_group_id" -ne "$NIX_BUILD_GROUP_ID" ]; then
             failure <<EOF
 It seems the build group $NIX_BUILD_GROUP_NAME already exists, but
-with the UID $primary_group_id. This script can't really handle
+with the GID $primary_group_id. This script can't really handle
 that right now, so I'm going to give up.
 
-You can fix this by editing this script and changing the
-NIX_BUILD_GROUP_ID variable near the top to from $NIX_BUILD_GROUP_ID
-to $primary_group_id and re-run.
+You can fix this by setting NIX_BUILD_GROUP_ID=$primary_group_id in
+your shell environment and re-running the installer.
 EOF
         else
             row "            Exists" "Yes"

[abathur]

I think it is roughly this simple, though it overlaps with a (stalled?) effort at making both UIDs and GIDs resilient without user input in #4346.

Not that perfect should be the enemy of incremental improvement. Perhaps @matthewbauer has thoughts on whether it's better to open a PR along the lines of your diff above, or if the effort in #4346 can be jumpstarted.

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/cant-install-nix/16035/3

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/can-i-install-nix-as-root/19577/6

[NireBryce]

still an issue.

unless I'm missing something, I'd honestly recommend the script just doing this itself on failure as the stopgap? Especially when the script telling you what to edit isn't the actual script that needs editing.

[hitchhooker]

feels retarded to be asked to do something that i do not even have script file for if used nix-install.sh only

[abathur]

It looks like these were made configurable via environment in installer: allow overriding nix user GID and UIDs by bjornfor · Pull Request #4345 · NixOS/nix · GitHub, but the message didn't get changed.