Add shortened links to install commands #1244
Conversation
This adds shortened ela.st script to install commands.
docs/contribute/locally.md
Outdated
| @@ -35,7 +35,7 @@ This guide uses the first option. If you'd like to clone the repository and buil | |||
| Run this command to download and install the latest version of `docs-builder`: | |||
|
|
|||
| ```sh | |||
| sudo curl -L https://raw.githubusercontent.com/elastic/docs-builder/refs/heads/main/install.sh | sh | |||
| sudo curl -sL https://ela.st/docs-builder-install | sh | |||
There was a problem hiding this comment.
🛑 If I'm honest, I'm rather concerned about this being a recommendation:
- generally as a
curl | sh - then also throwing in
sudohere - the fact that this is a short URL that could be modified to point to any random location
- not teaching Elasticians to audit the scripts they're executing with superuser privileges
Looking up this pattern generally results in many articles such as https://lukespademan.com/blog/the-dangers-of-curlbash/ and https://security.stackexchange.com/questions/213401/is-curl-something-sudo-bash-a-reasonably-safe-installation-method and https://macarthur.me/posts/curl-to-bash/
There was a problem hiding this comment.
I understand the concern (and thanks for the suggestion, I've already applied it). It's a popular debate. However:
- We need a convenient, fast way of installing and updating docs-builder until we've packages set up.
- We control the ela.st links. Should Elasticians not trust Elastic links? Will the same happens with packages?
- We're not asking folks to run these instructions for CI/CD.
See https://gnu.moe/wallofshame.md for counterarguments. Even Rust uses this method for local installs.
There was a problem hiding this comment.
I've removed sudo from the command, as the user will be prompted interactively anyway.
Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>
|
This makes the script a little more robust and makes the sentence about manual downloads more visible. #1255 |
|
Can you add us to the ela.st links as maintainers? Thank you! 🚀 |
|
Sure! Doing that now |
|
@reakaleek @Mpdreamz You're now co-owners of the ela.st links! |
This adds shortened ela.st script to install commands. It also makes the first curl command silent.