Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add fallback input option to ensure that fallback is not used #517

Merged
merged 1 commit into from
Jun 9, 2024
+33 −1
Merged

Add fallback input option to ensure that fallback is not used #517

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ jobs:
run: just --version & shfmt --version & protoc --version
shell: cmd
if: startsWith(matrix.os, 'windows')
# We use the version output to check the version of binstall, but they
# We use the version output to check the version of cargo-binstall, but they
# several times change the version output format in the past so we need to
# check it with CI. (e.g., 0.14.0->0.16.0 update change it
# from "cargo-binstall <version>" to "<version>")
Expand Down
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com

## [Unreleased]

- Add `fallback: none` input option to ensure that fallback is not used. ([#517](https://github.com/taiki-e/install-action/pull/517))

- `cargo-nextest` installation no longer use `cargo-binstall`.
This improves security, performance, robustness of installation. See [#487](https://github.com/taiki-e/install-action/issues/487) for more.

Expand Down
14 changes: 14 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,18 @@ See [TOOLS.md](TOOLS.md) for the list of tools that are installed from manifests

If a tool not included in the list above is specified, this action uses [cargo-binstall] as a fallback.

If you want to ensure that fallback is not used, use `fallback: none`.

```yaml
- uses: taiki-e/install-action@v2
with:
tool: cargo-hack
# Possible values:
# - none: disable all fallback
# - cargo-binstall (default): cargo-binstall (includes quickinstall)
fallback: none
```

### Add support for new tool

See the [development guide](DEVELOPMENT.md) for how to add support for new tool.
Expand All @@ -93,6 +105,8 @@ Additionally, we also verify signature if the tool distributes signed archives.

See the linked documentation for information on security when installed using [snap](https://snapcraft.io/docs) or [cargo-binstall](https://github.com/cargo-bins/cargo-binstall#faq).

See the [Supported tools section](#supported-tools) for how to ensure that fallback is not used.

## Compatibility

This action has been tested for GitHub-hosted runners (Ubuntu, macOS, Windows) and containers (Ubuntu, Debian, Fedora, CentOS, Alma, openSUSE, Arch, Alpine).
Expand Down
2 changes: 2 additions & 0 deletions TOOLS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@ This is a list of tools that are installed from manifests managed in this action

If a tool not included in the list below is specified, this action uses [cargo-binstall] as a fallback.

See the [Supported tools section in README.md](README.md#supported-tools) for how to ensure that fallback is not used.

> If `$CARGO_HOME/bin` is not available, Rust-related binaries will be installed to `$HOME/.cargo/bin`.<br>
> If `$HOME/.cargo/bin` is not available, Rust-related binaries will be installed to `/usr/local/bin`.<br>
> If `/usr/local/bin` is not available, binaries will be installed to `$HOME/.install-action/bin`.<br>
Expand Down
5 changes: 5 additions & 0 deletions action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,10 @@ inputs:
description: Whether to enable checksums
required: false
default: 'true'
fallback:
description: Whether to use fallback (none or cargo-binstall)
required: false
default: 'cargo-binstall'

# Note:
# - inputs.* should be manually mapped to INPUT_* due to https://github.com/actions/runner/issues/665
Expand All @@ -22,3 +26,4 @@ runs:
env:
INPUT_TOOL: ${{ inputs.tool }}
INPUT_CHECKSUM: ${{ inputs.checksum }}
INPUT_FALLBACK: ${{ inputs.fallback }}
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd suggest INPUT_STRATEGIES and pass it directly to cargo-binstall.

User can specify crate-meta-data for trying to download it from official maintainer, quick-install from third-party quickinstall, compile for from source.

If empty, then disable cargo-binstall

https://github.com/cargo-bins/cargo-binstall/blob/48ee0b0e3e646f7f0cfb2428f46dbcd32afe979b/crates/bin/src/args.rs#L418

Copy link
Contributor

@jayvdb jayvdb Jun 8, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

getting approval for cargo-binstall would be worth attempting IMO if its cargo-quickinstall was disabled.
i.e. trying to explain to my cyber-security team that we're using install-action which falls back to cargo-binstall which falls back to cargo-quickinstall is too hard, and it is that cargo-quickinstall stage which becomes "oh its just grabbing some binary from somewhere on the internet, but they are good people running it, trust them". The fall back to cargo-binstall is explainable if it is "it fetches from github releases or it builds from source 100%"

Copy link
Collaborator

@NobodyXu NobodyXu Jun 8, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's good to hear, disabling quickinstall is pretty easy, you just need to pass --strategies crate-meta-data,compile and it will only use the prebuilt from the official repository specified in Cargo.toml on https://crates.io , or fallback to cargo-install.

--strategies compile would then be equivalent to launching cargo-install, though cargo-binstall would launch multiple cargo-install for each crate to compile them in parallel, with a jobserver to limit parallelism.

Copy link
Owner Author

@taiki-e taiki-e Jun 8, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO, for a reviewer who is not familiar with the details of cargo-binstall's API but needs to review code that uses this action, something like strategies: ''/strategies: crate-meta-data,compile is not at all clear at first glance. (compared to something like fallback: none/fallback: binstall-first-party)

Copy link
Collaborator

@NobodyXu NobodyXu Jun 8, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's true, maybe we can pass --disable-strategies instead.

--disable-strategies quick-install is equivalent to --strategies crate-meta-data,compile, and it's much more straight forward for people just wanting to disable quickinstall.

9 changes: 9 additions & 0 deletions main.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -439,6 +439,12 @@ case "${enable_checksum}" in
*) bail "'checksum' input option must be 'true' or 'false': '${enable_checksum}'" ;;
esac

fallback="${INPUT_FALLBACK:-}"
case "${fallback}" in
none | cargo-binstall) ;;
*) bail "'fallback' input option must be 'none' or 'cargo-binstall': '${fallback}'" ;;
esac

# Refs: https://github.com/rust-lang/rustup/blob/HEAD/rustup-init.sh
base_distro=""
exe=""
Expand Down Expand Up @@ -791,6 +797,9 @@ done

if [[ ${#unsupported_tools[@]} -gt 0 ]]; then
IFS=','
case "${fallback}" in
none) bail "install-action does not support ${unsupported_tools[*]} (fallback is disabled by 'fallback: none' input option)" ;;
esac
info "install-action does not support ${unsupported_tools[*]}; fallback to cargo-binstall"
IFS=$'\n\t'
install_cargo_binstall
Expand Down