General discussion about Chef

[chef] Re: OS X 10.11, was ChefDK 0.7.0.rc.2 released


Chronological Thread 
  • From: Mike < >
  • To: " " < >
  • Subject: [chef] Re: OS X 10.11, was ChefDK 0.7.0.rc.2 released
  • Date: Sun, 12 Jul 2015 10:37:52 -0400
Hi Joshua,

Thanks for the link to the Chef-related issue - that's informative, for sure.

Re: First:
The 'unsupportedness' of the platform is warranted, for sure - hence the release candidates, beta programs that allow us access to these environments prior to their release - precisely to find these problems before they hit the general public.

Considering that "Rootless" is a big shift in Apple's methodology, it's unlikely that this is a "break" in the beta, rather they are deciding that users should not be able to modify a system-owned directory.

Re: Second:
That's awesome, glad to hear there's a push - there's bugs related to OSX 10.11 popping up all over GitHub for a variety of languages.

Re: Finally:
I understand the use of /usr/bin in environments where you are allowed to modify the contents of this directory.

> On OS X, /usr/local/bin isn't in the $PATH by default...

Ah, but it is! It's not first, which is why Homebrew (and MacPorts, etc) suggest placing it at the front, so that the load order of the packager-installed software will be selected with a higher precendence to prevent cases like this:

# using OSX default path built from unmodified `/etc/paths`
$ echo $PATH
/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin
$ which -a python
/usr/bin/python
/usr/local/bin/python

So in this case, I definitely want to recommend to users to modify the PATH to make /usr/local/bin first, so as not to use OSX's installed `python`.

In the case of Chef and ChefDK, OSX does not provide a built-in version of any Chef-related binaries, so there's no need to ensure that the path is inserted first, and since the $PATH contains /usr/local/bin, this one can likely be used instead of /usr/bin.

In conclusion,

I'm glad to hear that I'm not the first to report this - maybe I'm the first to note it about ChefDK (I looked! Didn't find!).

I'd take a look back at assumptions of the past and see if they are still valid concerns - ChefDK on OSX supports 10.8 and up - I'm betting that your build farm has some of these versions and can validate that the default paths now include /usr/local/bin.

Best,
-M


On Sun, Jul 12, 2015 at 9:52 AM, Joshua Timberman < " target="_blank"> > wrote:
we have an issue open in the chef repo about OS X 10.11. I'd like to note a few things. 

First, it's not a supported platform yet as it isn't GA. So until it's supported, brokenness is likely. Fortunately this seems to be the main issue and may be straightforward. 

Second, we are working on getting a OS X 10.11 build node in our CI infrastructure so that we can properly support it. This is high priority work for our release engineering team. 

Finally, I'd like to address the later query about why /usr/bin instead of /opt/chef. That's because we originally wanted the binaries installed for Chef (and then later ChefDK) to be in the default $PATH. On OS X, /usr/local/bin isn't in the $PATH by default, and /opt/chef certainly isn't. Also, with ChefDK, it's /opt/chefdk, not /opt/chef, where the omnibus package is installed. This isn't a huge deal of course but in the ease of use area it sure is helpful. 



---------- Forwarded message ----------
From: Mike < " target="_blank"> >
Date: Saturday, July 11, 2015
Subject: [chef] ChefDK 0.7.0.rc.2 released
To: Kartik Cating-Subramanian < " target="_blank"> >
Cc: " " target="_blank"> " < " target="_blank"> >, Chef Dev < " target="_blank"> >


Hi Kartik,

Not sure of where you'd want to have bug reports posted, but I tried this package out today and got an error [0] (see lines L58-L59).

This is likely due to the new restriction of OSX 10.11 disallowing user-installed modifications to /usr/bin - I was always curious why chefdk went into /usr/bin and not /usr/local/bin - any insight?

Quoting from the Linux Filesystem Hierarchy [1]:

> The original idea behind '/usr/local' was to have a separate ('local') '/usr' directory on every machine besides '/usr', which might be just mounted read-only from somewhere else. It copies the structure of '/usr'. These days, '/usr/local' is widely regarded as a good place in which to keep self-compiled or third-party programs. The /usr/local hierarchy is for use by the system administrator when installing software locally. It needs to be safe from being overwritten when the system software is updated. It may be used for programs and data that are shareable amongst a group of hosts, but not found in /usr. Locally installed software must be placed within /usr/local rather than /usr unless it is being installed to replace or upgrade software in /usr.

So it seems like OSX is taking a harder stance on the "don't even allow root to write in /usr/bin".

There's more details on this feature on Quora [2].


One hackish way to get around this right now would be to insert another conditional in the postinst and postrm scripts that tests for osx version 10.11 and uses a different path for symlinks, but I don't think that's sustainable.

Another idea is that 0.7.0 could move to using /usr/local/bin as the path for symlinked binaries, don't know how you feel about that. I created a simple script [3] that uses the behavior from the postinst script to run locally to get around it.

This would likely also necessitate changing the test paths in `chef verify` [4].

Hope this helps,
-M




On Thu, Jul 9, 2015 at 4:49 PM, Kartik Cating-Subramanian < > wrote:

On Thu, Jul 9, 2015 at 2:59 PM, Kartik Cating-Subramanian < > wrote:
Apologies - the links provided are to a nightly build and not to the rc.  I'll post the updated links shortly.

On Thu, Jul 9, 2015 at 2:34 PM, Kartik Cating-Subramanian < > wrote:
An updated version of chefdk 0.7.0.rc.2 has been released.  This release updates rc.1 by:

- pulling in chef-12.4.1
- pulling in test-kitchen 1.4.1
- allowing for multiple default_source lines in your policyfile.rb


You can acquire it from omnitruck (https://docs.chef.io/api_omnitruck.html) using 

Here are some direct package links:


--

Kartik Cating-Subramanian — Trouble Maker

314-266-8468 –   - my: Linkedin

CHEF

TM

chef.io   Blog   Facebook   Twitter   Youtube




--

Kartik Cating-Subramanian — Trouble Maker

314-266-8468 –   - my: Linkedin

CHEF

TM

chef.io   Blog   Facebook   Twitter   Youtube




--

Kartik Cating-Subramanian — Trouble Maker

314-266-8468 –   - my: Linkedin

CHEF

TM

chef.io   Blog   Facebook   Twitter   Youtube





Archive powered by MHonArc 2.6.16.

§