projects/guix·blob master · refs

1152 lines · 34.7 KiB

1#!/bin/sh
2# GNU Guix --- Functional package management for GNU
3# Copyright © 2017 sharlatan <[email protected]>
4# Copyright © 2018 Ricardo Wurmus <[email protected]>
5# Copyright © 2018 Efraim Flashner <[email protected]>
6# Copyright © 2019–2020, 2022 Tobias Geerinckx-Rice <[email protected]>
7# Copyright © 2020 Morgan Smith <[email protected]>
8# Copyright © 2020 Simon Tournier <[email protected]>
9# Copyright © 2020 Daniel Brooks <[email protected]>
10# Copyright © 2021 Jakub Kądziołka <[email protected]>
11# Copyright © 2021 Chris Marusich <[email protected]>
12# Copyright © 2021, 2022, 2023 Maxim Cournoyer <[email protected]>
13# Copyright © 2022 Prafulla Giri <[email protected]>
14# Copyright © 2023 Andrew Tropin <[email protected]>
15# Copyright © 2020 David A. Redick <[email protected]>
16# Copyright © 2024 Janneke Nieuwenhuizen <[email protected]>
17# Copyright © 2024 Tomas Volf <[email protected]>
18# Copyright © 2024 Richard Sent <[email protected]>
19# Copyright © 2025 Denis 'GNUtoo' Carikli <[email protected]>
20# Copyright © 2025 Noé Lopez <[email protected]>
21# Copyright © 2026 Owen T. Heisler <[email protected]>
22#
23# This file is part of GNU Guix.
24#
25# GNU Guix is free software; you can redistribute it and/or modify it
26# under the terms of the GNU General Public License as published by
27# the Free Software Foundation; either version 3 of the License, or (at
28# your option) any later version.
29#
30# GNU Guix is distributed in the hope that it will be useful, but
31# WITHOUT ANY WARRANTY; without even the implied warranty of
32# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
33# GNU General Public License for more details.
34#
35# You should have received a copy of the GNU General Public License
36# along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
37
38# We require Bash but for portability we'd rather not use /bin/bash or
39# /usr/bin/env in the shebang, hence this hack.
40
41# Environment variables
42#
43# GUIX_BINARY_FILE_NAME
44#
45# Can be used to override the automatic download mechanism and point
46# to a local Guix binary archive filename like
47# "/tmp/guix-binary-1.4.0rc2.armhf-linux.tar.xz"
48#
49# GUIX_ALLOW_OVERWRITE
50#
51# Instead of aborting to avoid overwriting a previous installations,
52# allow copying over /var/guix or /gnu. This can be useful when the
53# installation required the user to extract Guix packs under /gnu to
54# satisfy its dependencies.
55
56# shellcheck shell=bash
57
58# shellcheck disable=2268 # try to support vintage shells
59if [ "x$BASH_VERSION" = "x" ]; then
60 exec bash "$0" "$@"
61fi
62
63set -eo pipefail
64
65[ "$UID" -eq 0 ] || { echo "This script must be run as root."; exit 1; }
66
67REQUIRE=(
68 "dirname"
69 "readlink"
70 "wget"
71 "gpg"
72 "grep"
73 "sed"
74 "sort"
75 "getent"
76 "mktemp"
77 "rm"
78 "chmod"
79 "uname"
80 "groupadd"
81 "groupdel"
82 "useradd"
83 "userdel"
84 "tail"
85 "tr"
86 "xz"
87)
88
89# Add variables using form FOO_INIT_REQUIRE when init system FOO dependencies
90# should be checked.
91# shellcheck disable=2034 # interpolated by add_init_sys_require
92SYSV_INIT_REQUIRE=(
93 "daemonize"
94)
95
96# Unprivileged guix-daemon requires 'newgidmap'.
97SYSTEMD_REQUIRE=(
98 "newgidmap"
99)
100
101PAS=$'[ \033[32;1mPASS\033[0m ] '
102ERR=$'[ \033[31;1mFAIL\033[0m ] '
103WAR=$'[ \033[33;1mWARN\033[0m ] '
104INF="[ INFO ] "
105
106DEBUG=0
107GNU_URL="https://ftp.gnu.org/gnu/guix/"
108
109# The following associative array holds set of GPG keys used to sign the
110# releases, keyed by their corresponding Codeberg user name.
111declare -A GPG_SIGNING_KEYS
112GPG_SIGNING_KEYS["civodul"]=3CE464558A84FDC69DB40CFB090B11993D9AEBB5 # ludo
113GPG_SIGNING_KEYS["apteryx"]=27D586A4F8900854329FF09F1260E46482E63562 # maxim
114GPG_SIGNING_KEYS["efraim"]=A28BF40C3E551372662D14F741AAE7DCCA3D8351 # efraim
115PUBLIC_KEYSERVERS="keys.openpgp.org pgpkeys.eu keyserver.ubuntu.com"
116
117# ------------------------------------------------------------------------------
118#+UTILITIES
119
120_err()
121{ # All errors go to stderr.
122 printf "[%s]: ${ERR}%s\n" "$(date +%s.%3N)" "$1"
123}
124
125_msg()
126{ # Default message to stdout.
127 printf "[%s]: %s\n" "$(date +%s.%3N)" "$1"
128}
129
130_msg_pass()
131{
132 _msg "$PAS$1"
133}
134
135_msg_warn()
136{
137 _msg "$WAR$1"
138}
139
140_msg_info()
141{
142 _msg "$INF$1"
143}
144
145_debug()
146{
147 if [ "${DEBUG}" = '1' ]; then
148 printf "[%s]: %s\n" "$(date +%s.%3N)" "$1"
149 fi
150}
151
152die()
153{
154 _err "$*"
155 exit 1
156}
157
158# Return true if user answered yes, false otherwise. The prompt is
159# yes-biased, that is, when the user simply enter newline, it is equivalent to
160# answering "yes".
161# $1: The prompt question.
162prompt_yes_no() {
163 local -l yn
164 read -rp "$1 [Y/n]" yn
165 [[ ! $yn || $yn = y || $yn = yes ]] || return 1
166}
167
168chk_require()
169{ # Check that every required command is available.
170 declare -a warn
171 local c
172
173 _debug "--- [ ${FUNCNAME[0]} ] ---"
174
175 for c in "$@"; do
176 command -v "$c" &>/dev/null || warn+=("$c")
177 done
178
179 [ "${#warn}" -ne 0 ] && die "Missing commands: ${warn[*]}."
180
181 _msg_pass "verification of required commands completed"
182}
183
184add_init_sys_require()
185{ # Add the elements of FOO_INIT_SYS to REQUIRE
186
187 # Convert the init system command name captured in INIT_SYS in
188 # chk_init_sys to uppercase, with hyphens replaced by underscores.
189 local init_require=${INIT_SYS^^}_REQUIRE[@]
190 init_require=${init_require//-/_}
191
192 if [[ -n "$init_require" ]]; then
193 # Have to add piecemeal because ${!foo[@]} performs direct array key
194 # expansion, not indirect plain array expansion.
195 for r in "${!init_require}"; do
196 REQUIRE+=("$r")
197 done
198 fi
199}
200
201chk_gpg_keyring()
202{ # Check whether the Guix release signing public key is present.
203 _debug "--- [ ${FUNCNAME[0]} ] ---"
204 local user_id
205 local gpg_key_id
206 local exit_flag
207
208 for user_id in "${!GPG_SIGNING_KEYS[@]}"; do
209 gpg_key_id=${GPG_SIGNING_KEYS[$user_id]}
210 codeberg_username=$user_id
211 # Without --dry-run this command will create a ~/.gnupg owned by root on
212 # systems where gpg has never been used, causing errors and confusion.
213 if gpg --dry-run --list-keys "$gpg_key_id" >/dev/null 2>&1; then
214 continue
215 fi
216 if prompt_yes_no "${INF}The following OpenPGP public key is \
217required to verify the Guix binary signature: $gpg_key_id.
218Would you like me to fetch it for you?"; then
219 if wget "https://codeberg.org/$codeberg_username.gpg" \
220 --tries=1 --timeout=30 --no-verbose -O- | gpg --import -; then
221 continue
222 fi
223
224 key_obtained=false
225 # Try to fetch keys from an available keyserver
226 for key_server in $PUBLIC_KEYSERVERS; do
227 if gpg --keyserver $key_server --recv-key $gpg_key_id; then
228 key_obtained=true
229 break
230 fi
231 done
232
233 if $key_obtained; then
234 continue
235 fi
236 fi
237 # If we reach this point, the key is (still) missing. Report further
238 # missing keys, if any, but then abort the installation.
239 _err "Missing OpenPGP public key ($gpg_key_id).
240Fetch it with codeberg username:
241
242 wget \"https://codeberg.org/$codeberg_username.gpg\" -O - | \
243sudo -i gpg --import -
244
245If this fails, try to fetch it via a keyserver:
246
247 for key_server in $PUBLIC_KEYSERVERS; do
248 if sudo -i gpg --keyserver $key_server --recv-key $gpg_key_id; then
249 break
250 fi
251 done"
252 exit_flag=yes
253 done
254 if [ "$exit_flag" = yes ]; then
255 exit 1
256 fi
257}
258
259chk_term()
260{ # Check for ANSI terminal for color printing.
261 if [ -t 2 ]; then
262 if [ "${TERM+set}" = 'set' ]; then
263 case "$TERM" in
264 xterm*|rxvt*|urxvt*|linux*|vt*|eterm*|screen*)
265 ;;
266 *)
267 ERR="[ FAIL ] "
268 PAS="[ PASS ] "
269 WAR="[ WARN ] "
270 ;;
271 esac
272 fi
273 fi
274}
275
276chk_init_sys()
277{ # Return init system type name.
278 if [[ $(/sbin/init --version 2>/dev/null) =~ upstart ]]; then
279 _msg_info "init system is: upstart"
280 INIT_SYS="upstart"
281 return 0
282 elif [[ $(systemctl 2>/dev/null) =~ -\.mount ]]; then
283 _msg_info "init system is: systemd"
284 INIT_SYS="systemd"
285 return 0
286 elif [[ -f /etc/init.d/cron && ! -h /etc/init.d/cron ]]; then
287 _msg_info "init system is: sysv-init"
288 INIT_SYS="sysv-init"
289 return 0
290 elif [[ $(openrc --version 2>/dev/null) =~ \(OpenRC ]]; then
291 _msg_info "init system is: OpenRC"
292 INIT_SYS="openrc"
293 return 0
294 else
295 INIT_SYS="NA"
296 _err "Init system could not be detected."
297 fi
298}
299
300chk_sys_arch()
301{ # Check for operating system and architecture type.
302 local os
303 local arch
304
305 os="$(uname -s)"
306 arch="$(uname -m)"
307
308 case "$arch" in
309 i386 | i486 | i686 | i786 | x86)
310 local arch=i686
311 ;;
312 x86_64 | x86-64 | x64 | amd64)
313 local arch=x86_64
314 ;;
315 aarch64)
316 local arch=aarch64
317 ;;
318 armv7l)
319 local arch=armhf
320 ;;
321 ppc64le | powerpc64le)
322 local arch=powerpc64le
323 ;;
324 riscv64)
325 local arch=riscv64
326 ;;
327 *)
328 die "Unsupported CPU type: ${arch}"
329 esac
330
331 case "$os" in
332 Linux | linux)
333 local os=linux
334 ;;
335 *)
336 die "Your operation system (${os}) is not supported."
337 esac
338
339 ARCH_OS="${arch}-${os}"
340}
341
342chk_sys_nscd()
343{ # Check if nscd is up and suggest to start it or install it
344 if [ "$(type -P pidof)" ]; then
345 if [ ! "$(pidof nscd)" ]; then
346 _msg_warn "We recommend installing and/or starting your distribution 'nscd' service"
347 _msg_warn "Please read 'info guix \"Application Setup\"' about \"Name Service Switch\""
348 fi
349 else
350 _msg_info "We cannot determine if your distribution 'nscd' service is running"
351 _msg_info "Please read 'info guix \"Application Setup\"' about \"Name Service Switch\""
352 fi
353}
354
355chk_existing()
356{ # Avoid clobbering existing installations.
357 _debug "--- [ ${FUNCNAME[0]} ] ---"
358
359 if [[ -e /var/guix && -e /gnu ]]; then
360 if [ -n "$GUIX_ALLOW_OVERWRITE" ]; then
361 _msg_warn "Overwriting existing installation!"
362 else
363 die "A previous Guix installation was found. Refusing to overwrite."
364 fi
365 fi
366}
367
368# Configure substitute discovery according to user's preferences.
369# $1 is the installed service file to edit.
370configure_substitute_discovery() {
371 if grep -q -- '--discover=no' "$1" && \
372 prompt_yes_no "Would you like the Guix daemon to automatically \
373discover substitute servers on the local network?"; then
374 sed -i 's/--discover=no/--discover=yes/' "$1"
375 fi
376}
377
378# ------------------------------------------------------------------------------
379#+MAIN
380
381guix_get_bin_list()
382{ # Scan GNU archive and save list of binaries
383 local gnu_url="$1"
384 local -a bin_ver_ls
385 local latest_ver
386 local default_ver
387
388 _debug "--- [ ${FUNCNAME[0]} ] ---"
389
390 # Filter only version and architecture
391 bin_ver_ls=("$(wget "$gnu_url" --no-verbose -O- \
392 | sed -n -e 's/.*guix-binary-\([0-9.]*[a-z0-9]*\)\..*.tar.xz.*/\1/p' \
393 | sort -Vu)")
394
395 latest_ver="$(echo "${bin_ver_ls[0]}" \
396 | grep -oE "([0-9]{1,2}\.){2}[0-9]{1,2}[a-z0-9]*" \
397 | tail -n1)"
398
399 default_ver="guix-binary-${latest_ver}.${ARCH_OS}"
400
401 if [[ "${#bin_ver_ls}" -ne "0" ]]; then
402 _msg_pass "Release for your system: ${default_ver}"
403 else
404 die "Could not obtain list of Guix releases."
405 fi
406
407 # Use default to download according to the list and local ARCH_OS.
408 BIN_VER="${default_ver}"
409}
410
411guix_get_bin()
412{ # Download and verify binary package.
413 local url="$1"
414 local bin_ver="$2"
415 local dl_path="$3"
416 local wget_args=()
417
418 _debug "--- [ ${FUNCNAME[0]} ] ---"
419
420 _msg_info "Downloading Guix release archive"
421
422 wget --help | grep -q '\--show-progress' \
423 && wget_args=("--no-verbose" "--show-progress")
424
425 if wget "${wget_args[@]}" -P "$dl_path" \
426 "${url}/${bin_ver}.tar.xz" "${url}/${bin_ver}.tar.xz.sig"; then
427 _msg_pass "download completed."
428 else
429 die "could not download ${url}/${bin_ver}.tar.xz."
430 fi
431
432 pushd "${dl_path}" >/dev/null
433 if gpg --verify "${bin_ver}.tar.xz.sig" >/dev/null 2>&1; then
434 _msg_pass "Signature is valid."
435 popd >/dev/null
436 else
437 die "could not verify the signature."
438 fi
439}
440
441sys_create_store()
442{ # Unpack and install /gnu/store and /var/guix
443 local pkg="$1"
444 local tmp_path="$2"
445
446 cd "$tmp_path"
447 _msg_info "Installing /var/guix and /gnu..."
448 # Strip (skip) the leading ‘.’ component, which fails on read-only ‘/’.
449 #
450 # TODO: Eventually extract with ‘--owner=guix-daemon’ when installing
451 # and unprivileged guix-daemon service; for now, this script may install
452 # from both an old release that does not support unprivileged guix-daemon
453 # and a new release that does, so ‘chown -R’ later if needed.
454 tar --extract --strip-components=1 --file "$pkg" -C /
455
456 _msg_info "Linking the root user's profile"
457 mkdir -p ~root/.config/guix
458 ln -sf /var/guix/profiles/per-user/root/current-guix \
459 ~root/.config/guix/current
460
461 GUIX_PROFILE=~root/.config/guix/current
462 # The profile just prepends to search paths, which is not needed for
463 # effective linting.
464 # shellcheck disable=SC1091
465 source "${GUIX_PROFILE}/etc/profile"
466 _msg_pass "activated root profile at ${GUIX_PROFILE}"
467}
468
469sys_delete_store()
470{
471 _msg_info "removing /var/guix"
472 rm -rf /var/guix
473
474 _msg_info "removing /gnu"
475 rm -rf /gnu
476
477 _msg_info "removing ~root/.config/guix"
478 rm -rf ~root/.config/guix
479}
480
481create_account()
482{
483 local user="$1"
484 local group="$2"
485 local supplementary_groups="$3"
486 local comment="$4"
487
488 if id "$user" &>/dev/null; then
489 _msg_info "user '$user' is already in the system, reset"
490 usermod -g "$group" -G "$supplementary_groups" \
491 -d /var/empty -s "$(command -v nologin)" \
492 -c "$comment" "$user"
493 else
494 useradd -g "$group" -G "$supplementary_groups" \
495 -d /var/empty -s "$(command -v nologin)" \
496 -c "$comment" --system "$user"
497 _msg_pass "user added <$user>"
498 fi
499}
500
501install_unprivileged_daemon()
502{ # Return true when installing guix-daemon running without privileges.
503 [ "$INIT_SYS" = systemd ] && \
504 grep -q "User=guix-daemon" \
505 ~root/.config/guix/current/lib/systemd/system/guix-daemon.service
506}
507
508sys_create_build_user()
509{ # Create the group and user accounts for build users.
510
511 _debug "--- [ ${FUNCNAME[0]} ] ---"
512
513 if getent group kvm > /dev/null; then
514 _msg_info "group kvm exists and build users will be added to it"
515 local KVMGROUP=,kvm
516 fi
517
518 if install_unprivileged_daemon
519 then
520 _msg_info "installing guix-daemon to run as an unprivileged user"
521
522 # Installing guix-daemon to run as a non-root user requires
523 # unprivileged user namespaces.
524 if [ -f /proc/sys/kernel/unprivileged_userns_clone ] \
525 && [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" -ne 1 ]
526 then
527 echo 1 > /proc/sys/kernel/unprivileged_userns_clone || \
528 _err "failed to enable unprivileged user namespaces"
529
530 _msg_warn "Unprivileged user namespaces were disabled and have been enabled now."
531 _msg_warn "This Linux feature is required by guix-daemon. To enable it permanently, run:"
532 _msg_warn ' echo 1 > /proc/sys/kernel/unprivileged_userns_clone'
533 _msg_warn "from the relevant startup script."
534 fi
535
536
537 if getent group guix-daemon > /dev/null; then
538 _msg_info "group guix-daemon exists"
539 else
540 groupadd --system guix-daemon
541 _msg_pass "group guix-daemon created"
542 fi
543
544 create_account guix-daemon guix-daemon \
545 guix-daemon"$KVMGROUP" \
546 "Unprivileged Guix Daemon User"
547
548 if getent group kvm > /dev/null; then
549 # Allow 'newgidmap' to map the "kvm" group.
550 local kvmgid="$(getent group kvm | cut -f3 -d:)"
551 _msg_info "allowing kvm mapping (GID $kvmgid) for unprivileged guix-daemon"
552 echo "guix-daemon:$kvmgid:1" >> /etc/subgid
553 fi
554
555 # ‘tar xf’ creates root:root files. Change that.
556 chown -R guix-daemon:guix-daemon /gnu /var/guix
557 chown -R root:root /var/guix/profiles/per-user/root
558
559 # The unprivileged daemon cannot create the log directory by itself.
560 mkdir -p /var/log/guix
561 chown guix-daemon:guix-daemon /var/log/guix
562 chmod 755 /var/log/guix
563 else
564 if getent group guixbuild > /dev/null; then
565 _msg_info "group guixbuild exists"
566 else
567 groupadd --system guixbuild
568 _msg_pass "group <guixbuild> created"
569 fi
570
571 for i in $(seq -w 1 10); do
572 create_account "guixbuilder${i}" "guixbuild" \
573 "guixbuild${KVMGROUP}" \
574 "Guix build user $i"
575 done
576 fi
577}
578
579sys_delete_build_user()
580{
581 for i in $(seq -w 1 10); do
582 if id -u "guixbuilder${i}" &>/dev/null; then
583 userdel -f guixbuilder"$i"
584 fi
585 done
586
587 _msg_info "delete group guixbuild"
588 if getent group guixbuild &>/dev/null; then
589 groupdel -f guixbuild
590 fi
591
592 _msg_info "remove guix-daemon user"
593 if id guix-daemon &>/dev/null; then
594 userdel -f guix-daemon
595 fi
596 if getent group guix-daemon &>/dev/null; then
597 groupdel -f guix-daemon
598 fi
599}
600
601sys_enable_guix_daemon()
602{ # Run the daemon, and set it to automatically start on boot.
603
604 local info_path
605 local local_bin
606 local var_guix
607
608 _debug "--- [ ${FUNCNAME[0]} ] ---"
609
610 info_path="/usr/local/share/info"
611 local_bin="/usr/local/bin"
612 var_guix="/var/guix/profiles/per-user/root/current-guix"
613
614 case "$INIT_SYS" in
615 upstart)
616 { initctl reload-configuration;
617 cp ~root/.config/guix/current/lib/upstart/system/guix-daemon.conf \
618 /etc/init/ &&
619 configure_substitute_discovery /etc/init/guix-daemon.conf &&
620 start guix-daemon; } &&
621 _msg_pass "enabled Guix daemon via upstart"
622 ;;
623 systemd)
624 { install_unit()
625 {
626 local dest="/etc/systemd/system/$1"
627 rm -f "$dest"
628 cp ~root/.config/guix/current/lib/systemd/system/"$1" "$dest"
629 chmod 664 "$dest"
630 systemctl daemon-reload
631 systemctl enable "$1"
632 }
633
634 install_unit guix-daemon.service
635
636 configure_substitute_discovery \
637 /etc/systemd/system/guix-daemon.service
638
639 # Install after guix-daemon.service to avoid a harmless warning.
640 # systemd .mount units must be named after the target directory.
641 install_unit gnu-store.mount
642
643 systemctl daemon-reload &&
644 systemctl start guix-daemon &&
645 systemctl start gnu-store.mount; } &&
646 _msg_pass "enabled Guix daemon via systemd"
647 ;;
648 sysv-init)
649 { mkdir -p /etc/init.d;
650 cp ~root/.config/guix/current/etc/init.d/guix-daemon \
651 /etc/init.d/guix-daemon;
652 chmod 775 /etc/init.d/guix-daemon;
653
654 configure_substitute_discovery /etc/init.d/guix-daemon
655
656 update-rc.d guix-daemon defaults &&
657 update-rc.d guix-daemon enable &&
658 service guix-daemon start; } &&
659 _msg_pass "enabled Guix daemon via sysv"
660 ;;
661 openrc)
662 { mkdir -p /etc/init.d;
663 cp ~root/.config/guix/current/etc/openrc/guix-daemon \
664 /etc/init.d/guix-daemon;
665 chmod 775 /etc/init.d/guix-daemon;
666
667 configure_substitute_discovery /etc/init.d/guix-daemon
668
669 rc-update add guix-daemon default &&
670 rc-service guix-daemon start; } &&
671 _msg_pass "enabled Guix daemon via OpenRC"
672 ;;
673 NA|*)
674 _err "unsupported init system; run the daemon manually:"
675 echo " ~root/.config/guix/current/bin/guix-daemon --build-users-group=guixbuild"
676 ;;
677 esac
678
679 _msg_info "making the guix command available to other users"
680
681 [ -e "$local_bin" ] || mkdir -p "$local_bin"
682 ln -sf "${var_guix}/bin/guix" "$local_bin"
683
684 [ -e "$info_path" ] || mkdir -p "$info_path"
685 for i in "${var_guix}"/share/info/*; do
686 ln -sf "$i" "$info_path"
687 done
688}
689
690sys_delete_guix_daemon()
691{ # Disabled, stop and remove the various guix daemons.
692
693 local info_path
694 local local_bin
695 local var_guix
696
697 _debug "--- [ ${FUNCNAME[0]} ] ---"
698
699 info_path="/usr/local/share/info"
700 local_bin="/usr/local/bin"
701
702
703 case "$INIT_SYS" in
704 upstart)
705 _msg_info "stopping guix-daemon"
706 stop guix-daemon
707 _msg_info "removing guix-daemon"
708 rm /etc/init/guix-daemon.conf
709 ;;
710
711 systemd)
712 if [ -f /etc/systemd/system/guix-daemon.service ]; then
713 _msg_info "disabling guix-daemon"
714 systemctl disable guix-daemon
715 _msg_info "stopping guix-daemon"
716 systemctl stop guix-daemon
717 _msg_info "removing guix-daemon"
718 rm -f /etc/systemd/system/guix-daemon.service
719 fi
720
721 if [ -f /etc/systemd/system/gnu-store.mount ]; then
722 _msg_info "disabling gnu-store.mount"
723 systemctl disable gnu-store.mount
724 _msg_info "stopping gnu-store.mount"
725 systemctl stop gnu-store.mount
726 _msg_info "removing gnu-store.mount"
727 rm -f /etc/systemd/system/gnu-store.mount
728 fi
729 systemctl daemon-reload
730 ;;
731
732 sysv-init)
733 update-rc.d guix-daemon disable
734 service guix-daemon stop
735 rm -rf /etc/init.d/guix-daemon
736 ;;
737 NA|*)
738 _err "unsupported init system; disable, stop and remove the daemon manually:"
739 echo " ~root/.config/guix/current/bin/guix-daemon --build-users-group=guixbuild"
740 ;;
741 esac
742
743
744 _msg_info "removing $local_bin/guix"
745 rm -f "$local_bin"/guix
746
747 _msg_info "removing $info_path/guix*"
748 rm -f "$info_path"/guix*
749}
750
751sys_authorize_build_farms()
752{ # authorize the public key(s) of the build farm(s)
753 local hosts=(
754 bordeaux.guix.gnu.org
755 ci.guix.gnu.org
756 )
757
758 if prompt_yes_no "Permit downloading pre-built package binaries from the \
759project's build farms?"; then
760 for host in "${hosts[@]}"; do
761 local key=~root/.config/guix/current/share/guix/$host.pub
762 [ -f "$key" ] \
763 && guix archive --authorize < "$key" \
764 && _msg_pass "Authorized public key for $host"
765 done
766 if id guix-daemon &>/dev/null; then
767 # /etc/guix/acl must be readable by the unprivileged guix-daemon.
768 chown -R guix-daemon:guix-daemon /etc/guix
769 fi
770 else
771 _msg_info "Skipped authorizing build farm public keys"
772 fi
773}
774
775sys_create_init_profile()
776{ # Define for better desktop integration
777 # This will not take effect until the next shell or desktop session!
778 [ -d "/etc/profile.d" ] || mkdir /etc/profile.d # Just in case
779 cat <<"EOF" > /etc/profile.d/zzz-guix.sh
780# Explicitly initialize XDG base directory variables to ease compatibility
781# with Guix System: see <https://issues.guix.gnu.org/56050#3>.
782export XCURSOR_PATH="${XCURSOR_PATH:-$HOME/.local/share/icons:$HOME/.icons:/usr/local/share/icons:/usr/share/icons}"
783export XDG_DATA_HOME="${XDG_DATA_HOME:-$HOME/.local/share}"
784export XDG_CONFIG_HOME="${XDG_CONFIG_HOME:-$HOME/.config}"
785export XDG_STATE_HOME="${XDG_STATE_HOME:-$HOME/.local/state}"
786export XDG_DATA_DIRS="${XDG_DATA_DIRS:-/usr/local/share/:/usr/share/}"
787export XDG_CONFIG_DIRS="${XDG_CONFIG_DIRS:-/etc/xdg}"
788export XDG_CACHE_HOME="${XDG_CACHE_HOME:-$HOME/.cache}"
789# no default for XDG_RUNTIME_DIR (depends on foreign distro for semantics)
790
791# `guix pull` profile
792GUIX_PROFILE="$HOME/.config/guix/current"
793export PATH="$GUIX_PROFILE/bin${PATH:+:}$PATH"
794# Add to INFOPATH and MANPATH so the latest Guix documentation is available to
795# info and man readers. When INFOPATH is unset, add a trailing colon so Emacs
796# searches 'Info-default-directory-list'. When MANPATH is unset, add a
797# trailing colon so the system default search path is used.
798export INFOPATH="$GUIX_PROFILE/share/info:${INFOPATH:-}"
799export MANPATH="$GUIX_PROFILE/share/man:${MANPATH:-}"
800# Expose the latest Guix modules to Guile so guix shell and repls spawned by
801# e.g. Geiser work out of the box.
802export GUILE_LOAD_PATH="$GUIX_PROFILE/share/guile/site/3.0${GUILE_LOAD_PATH:+:$GUILE_LOAD_PATH}"
803export GUILE_LOAD_COMPILED_PATH="$GUIX_PROFILE/lib/guile/3.0/site-ccache${GUILE_LOAD_COMPILED_PATH:+:$GUILE_LOAD_COMPILED_PATH}"
804
805# User's default profile, if it exists
806GUIX_PROFILE="$HOME/.guix-profile"
807if [ -f "$GUIX_PROFILE/etc/profile" ]; then
808 . "$GUIX_PROFILE/etc/profile"
809
810 # see info '(guix) Application Setup'
811 export GUIX_LOCPATH="$GUIX_PROFILE/lib/locale${GUIX_LOCPATH:+:}$GUIX_LOCPATH"
812
813 # Documentation search paths may be handled by $GUIX_PROFILE/etc/profile if
814 # the user installs info and man readers via Guix. If the user doesn’t,
815 # explicitly add to them so documentation for software from ‘guix install’
816 # is available to the system info and man readers.
817 case $INFOPATH in
818 *$GUIX_PROFILE/share/info*) ;;
819 *) export INFOPATH="$GUIX_PROFILE/share/info:$INFOPATH" ;;
820 esac
821 case $MANPATH in
822 *$GUIX_PROFILE/share/man*) ;;
823 *) export MANPATH="$GUIX_PROFILE/share/man:$MANPATH"
824 esac
825
826 case $XDG_DATA_DIRS in
827 *$GUIX_PROFILE/share*) ;;
828 *) export XDG_DATA_DIRS="$GUIX_PROFILE/share:$XDG_DATA_DIRS"
829 esac
830fi
831
832# NOTE: Guix Home handles its own profile initialization in ~/.profile. See
833# info '(guix) Configuring the Shell'.
834
835# Clean up after ourselves.
836unset GUIX_PROFILE
837EOF
838}
839
840sys_create_shell_completion()
841{ # Symlink supported shell completions system-wide
842
843 var_guix=/var/guix/profiles/per-user/root/current-guix
844 bash_completion=/etc/bash_completion.d
845 zsh_completion=/usr/share/zsh/site-functions
846 fish_completion=/usr/share/fish/vendor_completions.d
847
848 { # Just in case
849 for dir_shell in $bash_completion $zsh_completion $fish_completion; do
850 [ -d "$dir_shell" ] || mkdir -p "$dir_shell"
851 done;
852
853 # Don't use globing here as we also need to delete the files when
854 # uninstalling Guix
855 ln -sf ${var_guix}/etc/bash_completion.d/guix "$bash_completion";
856 ln -sf ${var_guix}/etc/bash_completion.d/guix-daemon "$bash_completion";
857 ln -sf ${var_guix}/share/zsh/site-functions/_guix "$zsh_completion";
858 ln -sf ${var_guix}/share/fish/vendor_completions.d/guix.fish "$fish_completion"; } &&
859 _msg_pass "installed shell completion"
860}
861
862sys_delete_shell_completion()
863{ # Symlink supported shell completions system-wide
864
865 var_guix=/var/guix/profiles/per-user/root/current-guix
866 bash_completion=/etc/bash_completion.d
867 zsh_completion=/usr/share/zsh/site-functions
868 fish_completion=/usr/share/fish/vendor_completions.d
869
870 _msg_info "removing shell completion"
871
872 rm -f "$bash_completion"/guix;
873 rm -f "$bash_completion"/guix-daemon;
874 rm -f "$zsh_completion"/_guix;
875 rm -f "$fish_completion"/guix.fish;
876}
877
878sys_customize_bashrc()
879{
880 prompt_yes_no "Customize users Bash shell prompt for Guix?" || return 0
881
882 for bashrc in /home/*/.bashrc /root/.bashrc; do
883 test -f "$bashrc" || continue
884 # shellcheck disable=SC2016 # intended search for variable reference
885 grep -Fq '$GUIX_ENVIRONMENT' "$bashrc" && continue
886 cp "${bashrc}" "${bashrc}.bak"
887 # shellcheck disable=SC2016,SC2028 # intended literal shell output
888 echo '
889# Automatically added by the Guix install script.
890if [ -n "$GUIX_ENVIRONMENT" ]; then
891 if [[ $PS1 =~ (.*)"\\$" ]]; then
892 PS1="${BASH_REMATCH[1]} [env]\\\$ "
893 fi
894fi
895' >> "$bashrc"
896 done
897 _msg_pass "Bash shell prompt successfully customized for Guix"
898}
899
900sys_maybe_setup_selinux()
901{
902 if ! [ -f /sys/fs/selinux/policy ]
903 then
904 return
905 fi
906
907 local c
908 for c in semodule restorecon
909 do
910 if ! command -v "$c" &>/dev/null
911 then
912 return
913 fi
914 done
915
916 prompt_yes_no "Install SELinux policy that might be required to run guix-daemon?" \
917 || return 0
918
919 local var_guix=/var/guix/profiles/per-user/root/current-guix
920 semodule -i "${var_guix}/share/selinux/guix-daemon.cil"
921 restorecon -R /gnu /var/guix
922}
923
924sys_maybe_setup_apparmor()
925{
926 if ! [ -f /sys/module/apparmor/parameters/enabled ]
927 then
928 return
929 fi
930
931 if ! command -v apparmor_parser &> /dev/null
932 then
933 return
934 fi
935
936 prompt_yes_no "Install AppArmor profile that might be required to run guix-daemon?" \
937 || return 0
938
939 local var_guix=/var/guix/profiles/per-user/root/current-guix
940 local apparmor_sources="${var_guix}/etc/apparmor.d/"
941
942 if ! [ -d "$apparmor_sources" ]
943 then
944 _err "This version of Guix doesn’t contain AppArmor profiles."
945 return
946 fi
947
948 cp -f -t /etc/apparmor.d/tunables "$apparmor_sources/tunables/guix"
949 cp -f -t /etc/apparmor.d "$apparmor_sources/guix-daemon"
950 cp -f -t /etc/apparmor.d "$apparmor_sources/guix"
951 apparmor_parser --warn=all -r /etc/apparmor.d/guix-daemon
952 apparmor_parser --warn=all -r /etc/apparmor.d/guix
953
954 _msg_pass "apparmor profiles installed and loaded"
955}
956
957sys_delete_apparmor_profiles()
958{
959 # Not a big deal if the apparmor_parser commands fail as they only apply
960 # for the current boot, we still want to go on and remove the files.
961 if [ -f "/etc/apparmor.d/guix" ]
962 then
963 _msg_info "removing /etc/apparmor.d/guix"
964 apparmor_parser -R /etc/apparmor.d/guix || true
965 rm -f "/etc/apparmor.d/guix"
966 fi
967
968 if [ -f "/etc/apparmor.d/guix-daemon" ]
969 then
970 _msg_info "removing /etc/apparmor.d/guix-daemon"
971 apparmor_parser -R /etc/apparmor.d/guix-daemon || true
972 rm -f "/etc/apparmor.d/guix-daemon"
973 fi
974
975 if [ -f "/etc/apparmor.d/tunables/guix" ]
976 then
977 _msg_info "removing /etc/apparmor.d/tunables/guix"
978 rm -f "/etc/apparmor.d/tunables/guix"
979 fi
980}
981
982sys_delete_init_profile()
983{
984 _msg_info "removing /etc/profile.d/zzz-guix.sh"
985 rm -f /etc/profile.d/zzz-guix.sh
986}
987
988sys_delete_user_profiles()
989{
990 _msg_info "removing ~root/.guix-profile"
991 rm -f ~root/.guix-profile
992 rm -rf ~root/.cache/guix
993
994 _msg_info "removing .guix-profile, .cache/guix and .config/guix of all /home users"
995 rm -rf /home/*/{.guix-profile,{.cache,.config}/guix}
996}
997
998welcome()
999{
1000 local uninstall_flag="$1"
1001 local char
1002 cat<<"EOF"
1003 ░░░ ░░░
1004 ░░▒▒░░░░░░░░░ ░░░░░░░░░▒▒░░
1005 ░░▒▒▒▒▒░░░░░░░ ░░░░░░░▒▒▒▒▒░
1006 ░▒▒▒░░▒▒▒▒▒ ░░░░░░░▒▒░
1007 ░▒▒▒▒░ ░░░░░░
1008 ▒▒▒▒▒ ░░░░░░
1009 ▒▒▒▒▒ ░░░░░
1010 ░▒▒▒▒▒ ░░░░░
1011 ▒▒▒▒▒ ░░░░░
1012 ▒▒▒▒▒ ░░░░░
1013 ░▒▒▒▒▒░░░░░
1014 ▒▒▒▒▒▒░░░
1015 ▒▒▒▒▒▒░
1016 _____ _ _ _ _ _____ _
1017 / ____| \ | | | | | / ____| (_)
1018 | | __| \| | | | | | | __ _ _ ___ __
1019 | | |_ | . ' | | | | | | |_ | | | | \ \/ /
1020 | |__| | |\ | |__| | | |__| | |_| | |> <
1021 \_____|_| \_|\____/ \_____|\__,_|_/_/\_\
1022
1023https://www.gnu.org/software/guix/
1024EOF
1025
1026 if [ '--uninstall' = "$uninstall_flag" ]; then
1027 echo "${WARN}This script will uninstall GNU Guix from your system"
1028 echo "To install, run this script with no parameters."
1029 else
1030 echo "This script installs GNU Guix on your system"
1031 echo "To uninstall, pass in the '--uninstall' parameter."
1032 fi
1033
1034 # Don't use ‘read -p’ here! It won't display when run non-interactively.
1035 echo -n "Press return to continue..."$'\r'
1036 if ! read -r char; then
1037 echo
1038 die "Can't read standard input. Hint: don't pipe scripts into a shell."
1039 fi
1040 if [ "$char" ]; then
1041 echo
1042 echo "...that ($char) was not a return!"
1043 _msg_warn "Use newlines to automate installation, e.g.: yes '' | ${0##*/}"
1044 _msg_warn "Any other method is unsupported and likely to break in future."
1045 fi
1046}
1047
1048main_install()
1049{
1050 local tmp_path
1051 welcome
1052
1053 _msg "Starting installation ($(date))"
1054
1055 chk_term
1056 chk_init_sys
1057 add_init_sys_require
1058 chk_require "${REQUIRE[@]}"
1059 chk_sys_arch
1060 chk_sys_nscd
1061 chk_existing
1062
1063 _msg_info "system is ${ARCH_OS}"
1064
1065 umask 0022
1066 tmp_path="$(mktemp -t -d guix.XXXXXX)"
1067
1068 if [ -z "${GUIX_BINARY_FILE_NAME}" ]; then
1069 chk_gpg_keyring
1070 guix_get_bin_list "${GNU_URL}"
1071 guix_get_bin "${GNU_URL}" "${BIN_VER}" "$tmp_path"
1072 GUIX_BINARY_FILE_NAME=${BIN_VER}.tar.xz
1073 else
1074 if ! [[ $GUIX_BINARY_FILE_NAME =~ $ARCH_OS ]]; then
1075 _err "$ARCH_OS not in ${GUIX_BINARY_FILE_NAME}; aborting"
1076 fi
1077 _msg_info "Using manually provided binary ${GUIX_BINARY_FILE_NAME}"
1078 GUIX_BINARY_FILE_NAME=$(realpath "$GUIX_BINARY_FILE_NAME")
1079 fi
1080
1081 sys_create_store "${GUIX_BINARY_FILE_NAME}" "${tmp_path}"
1082 sys_create_build_user
1083 sys_maybe_setup_selinux
1084 sys_maybe_setup_apparmor
1085 sys_enable_guix_daemon
1086 sys_authorize_build_farms
1087 sys_create_init_profile
1088 sys_create_shell_completion
1089 sys_customize_bashrc
1090
1091 _msg_info "cleaning up ${tmp_path}"
1092 rm -r "${tmp_path}"
1093
1094 _msg_pass "Guix has successfully been installed!"
1095 _msg_info "Run 'info guix' to read the manual."
1096
1097 # Required to source /etc/profile in desktop environments.
1098 _msg_info "Please log out and back in to complete the installation."
1099 }
1100
1101main_uninstall()
1102{
1103 welcome --uninstall
1104 _msg "Starting uninstall process ($(date))"
1105
1106 chk_term
1107 chk_require "${REQUIRE[@]}"
1108 # it's ok to leave the gpg key
1109 chk_init_sys
1110 chk_sys_arch
1111
1112 _msg_info "system is ${ARCH_OS}"
1113
1114 # stop the build, package system.
1115 sys_delete_guix_daemon
1116 # stop people from accessing their profiles.
1117 sys_delete_user_profiles
1118 sys_delete_apparmor_profiles
1119 # kill guix off all the guts of guix
1120 sys_delete_store
1121 # clean up the system
1122 sys_delete_init_profile
1123 sys_delete_build_user
1124 sys_delete_shell_completion
1125
1126 # these directories are created on the fly during usage.
1127 _msg_info "removing /etc/guix"
1128 rm -rf /etc/guix
1129 _msg_info "removing /var/log/guix"
1130 rm -rf /var/log/guix
1131
1132 _msg_pass "Guix has successfully been uninstalled!"
1133}
1134
1135main()
1136{
1137 # expect no parameters
1138 # or '--uninstall'
1139 if [ 0 -eq $# ]; then
1140 main_install
1141 else
1142 local uninstall_flag="$1"
1143 if [ '--uninstall' = "${uninstall_flag}" ]; then
1144 main_uninstall
1145 else
1146 echo "unsupported parameters: $*"
1147 exit 1
1148 fi
1149 fi
1150}
1151
1152main "$@"