Skip to content

Add shortened links to install commands #1244

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
May 19, 2025
Merged

Add shortened links to install commands #1244

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a75885d
Add shortened links to install commands
theletterf May 12, 2025
167a5d8
Update docs/contribute/locally.md
theletterf May 12, 2025
162461b
Update locally.md
theletterf May 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/contribute/locally.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ This guide uses the first option. If you'd like to clone the repository and buil
Run this command to download and install the latest version of `docs-builder`:

```sh
sudo curl -L https://raw.githubusercontent.com/elastic/docs-builder/refs/heads/main/install.sh | sh
sudo curl -sL https://ela.st/docs-builder-install | sh
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 If I'm honest, I'm rather concerned about this being a recommendation:

  • generally as a curl | sh
  • then also throwing in sudo here
  • the fact that this is a short URL that could be modified to point to any random location
  • not teaching Elasticians to audit the scripts they're executing with superuser privileges

Looking up this pattern generally results in many articles such as https://lukespademan.com/blog/the-dangers-of-curlbash/ and https://security.stackexchange.com/questions/213401/is-curl-something-sudo-bash-a-reasonably-safe-installation-method and https://macarthur.me/posts/curl-to-bash/

Copy link
Contributor Author

@theletterf theletterf May 12, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand the concern (and thanks for the suggestion, I've already applied it). It's a popular debate. However:

  • We need a convenient, fast way of installing and updating docs-builder until we've packages set up.
  • We control the ela.st links. Should Elasticians not trust Elastic links? Will the same happens with packages?
  • We're not asking folks to run these instructions for CI/CD.

See https://gnu.moe/wallofshame.md for counterarguments. Even Rust uses this method for local installs.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've removed sudo from the command, as the user will be prompted interactively anyway.

```
This downloads the latest binary, makes it executable, and installs it to your user PATH.

Expand All @@ -58,7 +58,7 @@ To download and install the binary file manually, refer to [Releases](https://gi
Run this command to download and install the latest version of `docs-builder`:

```powershell
iex (New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/elastic/docs-builder/refs/heads/main/install.ps1')
iex (New-Object System.Net.WebClient).DownloadString('https://ela.st/docs-builder-install-win')
```

This downloads the latest binary, makes it executable, and installs it to your user PATH.
Expand Down
Loading