Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chezmoi – Manage your dotfiles across multiple diverse machines, securely

chezmoi.io

Post reply on HN
Print view View original

41–50 of 62 posts

Re: Chezmoi – Manage your dotfiles across multiple diverse machines, securely

#41

Post by aliqot »

klysm wrote: post #21
PurpleRamen wrote: post #14

I just use a boring python-script for this job, which links everything from my repo to the correct location. This has the benefit that I can also add some personal tweak to some configs, like linking my userchrome from Firefox to my profile. Similar solution for packages and other settings, just a bunch of shell script doing stuff. I tried using Ansible in the past, but maintaining a rarely used tool with many update…

I doubt the scripts are simple, it’s not easy to make such things idempotent.

idempotent is about the most useless word ever.

When all the words are sitting around at the end of the day, you got a few good ones making dinner, and maybe a clever contraction sitting on the couch, then you have little Idempotent, chewing on a fucking crayon in the corner with a finger in the light socket.

Re: Chezmoi – Manage your dotfiles across multiple diverse machines, securely

#42

Post by 3np »

gjulianm wrote: post #39
varl wrote: post #22

Chezmoi has some interesting features, that go beyond simply managing dot-files in a Git-repo, that allows it too deepen in a way that makes it quite capable: - templating for any configuration file built-in - support for password managers - can download and unpack an archive, or clone a repo, and refresh it e.g. once a week - run scripts when applying config changes (either once, or every time) - can handle config f…

Honestly, that's quite the list. From the title and even the home page, it looks like yet another dotfiles manager, but it looks like it can replace what I've gotten with half-baked scripts. Integration with password managers is great!

If you're the kind of person to use ansible or equivalent, anything user-specific is most likely a better experience in czm.

You can get away with doing stuff like package installation as well but anything more advanced on system-level and you probably want to keep/introduce configuration management for that.

Re: Chezmoi – Manage your dotfiles across multiple diverse machines, securely

#43

Post by ElectricalUnion »

pjerem wrote: post #35
andrewla wrote: post #34

> Manage your dotfiles across multiple diverse machines, securely. > $ sh -c "$(curl -fsLS https://chezmoi.io/get )" -- init --apply $GITHUB_USERNAME That this is even suggested as an installation command means that they might as well strike "securely" from the tagline. For someone interested in security the foul odor that this line emits is enough to make me stop reading.

I don't get the issue here. This command basically downloads and execute something. Yes, it requires you to trust the author but that's what you always need to do anyway alas you don't read and compile yourself anything you install on your computer. Or did I miss something ?

Given that this is supposed to be "secure management", one would expect something fail-safe, not fail-deadly.

It also requires you to trust that the underlying http server/dns record server infrastructure did not change between runs of the command.

Re: Chezmoi – Manage your dotfiles across multiple diverse machines, securely

#44

Post by konart »

gregwebs wrote: post #32
konart wrote: post #12

Gave it a try a few months ago and realized I can't stomach its approach of copying everything into its own folder and editing your configs over there. I'd rather tell the tool to watch for changes in my local files. Yes, most of them are in .config, so no big change, but still... Matter of habbit I guess.

I felt the same way and pared down the workflow. I edit my files directly. Then when done, I do a single `chezmoi add`, which pushes it to the git repo because I have auto commit/push enabled in ~/.config/chezmoi/chezmoi.toml [git] autoCommit = true autoPush = true

Yes but this can be just a very simple (z\ba\fi)sh function. What's the point of keeping yet another tool for this?)

Re: Chezmoi – Manage your dotfiles across multiple diverse machines, securely

#45

Post by rgoulter »

doubled112 wrote: post #37
pjerem wrote: post #35

Earlier quoted context omitted.

I don't get the issue here. This command basically downloads and execute something. Yes, it requires you to trust the author but that's what you always need to do anyway alas you don't read and compile yourself anything you install on your computer. Or did I miss something ?

Yes, the trust but verify step where you are supposed to check that the script you received is the one you expected.

Two examples of malicious behaviour:

(1) I have the server you're curling-into-bash. I write my server to check if it's piped into sh; if so, I instead pipe malicious statements.

(2) I have the server you're downloading from. I write the binary you're downloading so that it later executes malicious statements.

The "don't curl into sh" is worried about the former.

But, the latter seems a much more practical attack, that reading the script you curl is insufficient to protect you from.

It seems weird to mention (1) without at least mentioning (2).

Re: Chezmoi – Manage your dotfiles across multiple diverse machines, securely

#46

Post by folkrav »

rovr138 wrote: post #26

2 weeks ago someone asked > Ask HN: Can I see your scripts?[1] I really like this[2] solution from /u/hoechst, > Not really a script, but a `.ssh/config` to automatically deploy parts of my local cli environment to every server i connect to (if username and ip/hostname matches my rules). > On first connect to a server, this sync all the dotfiles i want to a remote host and on subsequent connects, it updates the dotfi…

I could see both being really useful. I don't want my full dotfiles available on arbitrary remote servers. But being able to setup a new dev environment by just cloning my dotfiles and linking them back is also invaluable.

Re: Chezmoi – Manage your dotfiles across multiple diverse machines, securely

#47

Post by pjerem »

doubled112 wrote: post #37
pjerem wrote: post #35

Earlier quoted context omitted.

I don't get the issue here. This command basically downloads and execute something. Yes, it requires you to trust the author but that's what you always need to do anyway alas you don't read and compile yourself anything you install on your computer. Or did I miss something ?

Yes, the trust but verify step where you are supposed to check that the script you received is the one you expected.

Why is this discussion always happening when we talk about downloading and executing scripts when otoh, nobody bats an eye when you need to download and execute some binary ?

I'm not saying that you should trust anything coming from anywhere, but you have no other choice than to trust the author of any software you run on your computer.

Even if the Chezmoi's author was a malicious guy, why would he hide something in the installation script when this script literally permanently installs a program on your computer.

Re: Chezmoi – Manage your dotfiles across multiple diverse machines, securely

#48

Post by cybrox »

Tajnymag wrote: post #8
cybrox wrote: post #5

I just use Ansible for this purpose. All my work machines are set up using a single, parameterized Ansible playbook.

Can you share it?

Unfortunately, I can't share it "as is", as it has grown a lot over the years and contains a lot of information about my home and work network topology and setups. (I host it on a private git server)

I copied some of it into an example repository to showcase the structure and left the playbook.yaml intact for reference. You can find it on: https://github.com/cybrox/ansible-setup-example

I don't want to claim that this structure is in any way better or worse than anything else, it's just one that works for me. There's a lot of discussion on how Ansible projects should be structured. This allows me to simply run `WORKSTATION=home DESKTOP=wayland ansible-playbook playbook.yaml` on a fresh Arch Linux install and everything is ready to go.

For maintaining the repository, I got used to changing things in there and deploying them instead of changing dotfiles directly. However, I do also deploy a bash script to copy all the files from the system back to the repo to catch dotfile edits I did hastily at 3am.

An example of dotfiles being deployed with this approach is roles/shell/tasks/zsh.yaml

Re: Chezmoi – Manage your dotfiles across multiple diverse machines, securely

#49

Post by cybrox »

mxuribe wrote: post #20
cybrox wrote: post #5

I just use Ansible for this purpose. All my work machines are set up using a single, parameterized Ansible playbook.

Oh, if you wouldn't mind sharing, that would be greatly appreciated! For set up of my machine(s), I was going to go the route of using a bash or python script...but when i learned (a high level summary) of ansible, figured that might be a skill that i can leverage for work in the future too. So, I'm trying to play, learn about ansible. (I already have basics of python, so ansible was an add-on for me.) The more that…

I've shared an example based on what I currently use here: https://news.ycombinator.com/item?id=32639329 :)

I used to use bash scripts myself, however, I did transition to Ansible because I often ran into problems with replayability of scripts (running them multiple times).

Ansible (and other tools like it) handle stuff like "change a line in this config file to that" or "add this flag here when xyz" easily and you can run it as many times as you like.

Also, Ansible Galaxy offers a lot of roles ready-to-use such as docker setup or asdf version manager plugin management. Though a lot of it is often not that well maintained.

Re: Chezmoi – Manage your dotfiles across multiple diverse machines, securely

#50

Post by mustache_kimono »

andrewla wrote: post #34

> Manage your dotfiles across multiple diverse machines, securely. > $ sh -c "$(curl -fsLS https://chezmoi.io/get )" -- init --apply $GITHUB_USERNAME That this is even suggested as an installation command means that they might as well strike "securely" from the tagline. For someone interested in security the foul odor that this line emits is enough to make me stop reading.

> That this is even suggested as an installation command means that they might as well strike "securely" from the tagline. For someone interested in security the foul odor that this line emits is enough to make me stop reading.

I don't know. I always think this line smacks of paternalism. For instance, plenty of projects suggest for installation something like:

  git clone https://github.com/twpayne/chezmoi/; cd chezmoi; make; sudo make install
Of course, "curl | bash" is not always preferable. Re: security, "curl | bash" may be preferable here given the superuser privileges, or the privileges required by dpkg upon install of a stray deb package. But is the implication one reads the makefile and the source code before installing when one git clones a repo, but doesn't when the instructions say pipe to bash?

I also think many are afraid to admit FOSS packaging security is mostly smoke and mirrors. Sure, it's nice re: trusting a mirror. It's nice for keeping track of packages and dependencies. But its technical security story vs "curl | bash" would seem only marginally better/worse depending on the circumstances.

Because trust is the great problem. "curl | bash" may have a smell, but it's mostly the smell of the sewer we live in.

Another question one might/should ask is -- what is the cross platform alternative? If it's "Build 10 packages for everyone," I'm not sure how happy that will make anyone. Just specifically re: this tool, imagine wanting to use it everywhere, however, you have a Mac dev laptop and your servers are a mix of Linux/FreeBSD. How much easier is it just to say "I trust chezmoi (because I would have had to trust it anyway) and 'curl | bash' is secure enough?"

Post reply on HN