Get Started workflow is broken for MacOS

[SuicideBlonde]

Hi!
I'm trying to install quarkus following this instructions https://quarkus.io/get-started/
and got a problem literally from the first step.
After entering the following command:
curl -Ls https://sh.jbang.dev | bash -s - app install --fresh --force quarkus@quarkusio
i got error:

[jbang] https://repo1.maven.org/maven2/io/quarkus/quarkus-cli/2.6.1.Final/quarkus-cli-2.6.1.Final-runner.jar is not from a trusted source thus not running it automatically.

If you trust the url to be safe to run you can do one of the following:
0) Trust once: Add no trust, just run this time

1. Trust limited url in future:
   jbang trust add https://repo1.maven.org/maven2/io/quarkus/quarkus-cli/

Any other response will result in exit.

[jbang] Type in your choice (0 or 1) and hit enter. Times out after 10 seconds.
[jbang] [ERROR] Could not parse answer as a number. Aborting
[jbang] [ERROR] https://repo1.maven.org/maven2/io/quarkus/quarkus-cli/2.6.1.Final/quarkus-cli-2.6.1.Final-runner.jar is not from a trusted source and user did not confirm trust thus aborting.
If you trust the url to be safe to run are here a few suggestions:
Limited trust:
jbang trust add https://repo1.maven.org/maven2/io/quarkus/quarkus-cli/
Trust all subdomains:
jbang trust add *.repo1.maven.org
Trust all sources (WARNING! disables url protection):
jbang trust add *

For more control edit ~/.jbang/trusted-sources.json

[jbang] Run with --verbose for more details

My OS is macOS Monterey 12.0.1
Is it expected error for new quarkus users?))

[gsmet]

/cc @maxandersen

[alexcheng1982]

You can simply type 1 to trust the source. This is a security feature of JBang. Maybe the documentation should be updated.

[maxandersen]

I can see how it makes our CLI installation story a bit less compelling though.

Yeah - i'm sure we can find a way to improve it.

Shouldn't we be able to say to JBang that https://repo1.maven.org/maven2/io/quarkus/quarkus-cli/ is a trusted source altogether when installing quarkus@quarkusio?

Yeah so how to tell jbang it should trust some url as okey to run code from is what the cli prints out:

jbang trust add https://repo1.maven.org/maven2/io/quarkus/quarkus-cli/

But it is like a chickin' and egg problem as you need jbang installed first.

You might then ask - can't you just have a flag to jbang to express trust automatically but then the trust mechanism is basically circumvented.

I added it to jbang as feeback (and reality) was that if you can run jbang <url> with no checks it is as bad as what curl based installs are (which ironically is what we have here :)

I've considered adding a env var to exactly ease this install but its not pretty, it would be something like

JBANG_TRUST=https://repo1.maven.org/maven2/io/quarkus/quarkus-cli/ curl -Ls https://sh.jbang.dev | bash -s - app install --fresh --force quarkus@quarkusio

or even

JBANG_TRUST=* curl -Ls https://sh.jbang.dev | bash -s - app install --fresh --force quarkus@quarkusio

but it just feels wrong to do that.

So that said with jbang the issue for quarkus is a bit worse as you get asked about the trust the first time you run quarkus
instead of being asked during install. I think I could make the app install actually do the check early - then it is not this delayed. What do you think?

Alternatively we can update the instructions to be:

curl -Ls https://sh.jbang.dev | bash -s - app setup
jbang trust add https://repo1.maven.org/maven2/io/quarkus
jbang app install quarkus@quarkusio

which is then just much more complex where it doesn't need to be....thought its about the same steps you'll need for most packagemanagers

1. install package manger (i.e. scoop,brew, sdkman)
2. add source for quarkus (unless where it is part of default package manger repo)
3. install quarkus

I tried finding the balance between having something that does not run random code on the internet
without requiring fully centralized packaging system like sdkman.

comments on the above suggestions welcome as i'm not sure which is best option yet.

[maxandersen]

suggestion from @ebullient : have jbang trust maven central by default.

[alexcheng1982]

I think the confusion part is here:

When Quarkus CLI is installed, the user is not providing a URL like https://repo1.maven.org/maven2/io/quarkus/quarkus-cli/2.6.1.Final/quarkus-cli-2.6.1.Final-runner.jar, but simply the name quarkus@quarkusio.

When a URL is provided, the user knows this is an arbitrary URL which may have security risks, so the security warning makes sense.

When a name like quarkus@quarkusio is provided, the user understands that the name may be translated to some URL. But this is implementation details and should be transparent to the user. The tool should be responsible to make sure that the acutal downloaded JAR file is safe, because only the tool knows the actual URL. The user doesn't have enough information to justify whether the download JAR is safe or not, because the actual JAR URL is not explicitly provided by the user.

[maxandersen]

Yeah you are right that's the confusion or at least big part of it.

Issue is that at the time where quarkus gets executed the alias is no longer known.

But we could improve that by making jbang app install verify the alias at install time.

Or have a way to refer maven GAV without getting transitive dependencies.

That + possibly trusting maven central by default should make it less confusing.

I'm wondering though if can make the message simpler/better as many seem to miss the ask to type something.

[alexcheng1982]

How about adding a extra command line flag to suppress the security warning, like the -k flag in curl. When this flag is present, trust the source once only for the current installation, but not saving it to the trust store. Then the doc can be changed to always including the flag, because we know the source of Quarkus CLI is trusted.

curl -Ls https://sh.jbang.dev | bash -s - app install --fresh --force -k quarkus@quarkusio

[maxandersen]

fyi, same issue at #22723