[feat] Setup end-user environment - #1029

scripts/user_setup_env.sh (5)

27-29: Quote logged messages for safety.
In log(), consider quoting $1 to safely handle messages with special characters.

-function log() {
-    echo "$(date '+%d-%m-%Y %H:%M:%S') - $1"
-}
+function log() {
+    echo "$(date '+%d-%m-%Y %H:%M:%S') - \"$1\""
+}

---

49-59: Make krew installation idempotent and clean up temp artifacts.
If /tmp/krew already exists, mkdir will fail, and leftover files may persist across runs. Use mktemp -d or clear the directory, and remove temp folders after installation. Also, instead of sourcing .bashrc directly, instruct the user to restart their shell or append a notice.

-function install_krew() {
-    mkdir /tmp/krew && tar -xzf "/tmp/${KREW}.tar.gz" -C /tmp/krew/
-    "/tmp/krew/${KREW}" install krew
+function install_krew() {
+    local tmpdir
+    tmpdir=$(mktemp -d)
+    tar -xzf "/tmp/${KREW}.tar.gz" -C "$tmpdir"
+    "$tmpdir/${KREW}" install krew
+    rm -rf "$tmpdir"
     printf '# krew\nexport PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"\n' >> ~/.bashrc
-    source ~/.bashrc
+    log "Added krew to PATH; restart your shell to apply."
 }  

🧰 Tools

🪛 Shellcheck (0.10.0)

[warning] 58-58: ShellCheck can't follow non-constant source. Use a directive to specify location.

(SC1090)

---

88-96: Clean up Helm temp directory and prevent collisions.
/tmp/helm may persist between runs. Use mktemp -d and remove it after moving the binary.

-function install_helm() {
+function install_helm() {
     log "Installing Helm"
-    mkdir /tmp/helm && tar -xzf /tmp/helm.tar.gz -C /tmp/helm/
-    sudo mv "/tmp/helm/${OS}-${ARCH}/helm" /usr/local/bin/helm
+    local tmphelm
+    tmphelm=$(mktemp -d)
+    tar -xzf /tmp/helm.tar.gz -C "$tmphelm"
+    sudo mv "$tmphelm/${OS}-${ARCH}/helm" /usr/local/bin/helm
     sudo chown 0:0 /usr/local/bin/helm
     sudo chmod 0755 /usr/local/bin/helm
+    rm -rf "$tmphelm"
 }  

---

105-113: Use temporary directory for FluxCD extraction.
Similar to Helm and krew, protect against stale /tmp/flux folders by leveraging mktemp -d and cleanup.

-function install_fluxcd() {
+function install_fluxcd() {
     log "Installing FluxCD"
-    mkdir /tmp/flux && tar -xzf /tmp/flux.tar.gz -C /tmp/flux/
-    sudo mv /tmp/flux/flux /usr/local/bin/flux
+    local tmpflux
+    tmpflux=$(mktemp -d)
+    tar -xzf /tmp/flux.tar.gz -C "$tmpflux"
+    sudo mv "$tmpflux/flux" /usr/local/bin/flux
     sudo chown 0:0 /usr/local/bin/flux
     sudo chmod 0755 /usr/local/bin/flux
+    rm -rf "$tmpflux"
 }  

---

116-116: Guard script execution when sourced.
Directly calling user_setup_env on load prevents safe sourcing. Wrap in:

if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    user_setup_env
fi

packages/apps/vm-instance/templates/vm.yaml (1)

97-118: Suggest DRY’ing repeated cloudinitdisk blocks.
The three conditional branches each declare identical keys (- name: cloudinitdisk, cloudInitNoCloud:). Consider collapsing common YAML structure and vary only secretRef vs. userData.

For example, extract the disk name and volume into a single block and template the inner fields.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

scripts/user_setup_env.sh (4)

43-47: Remove conflicting curl flags

Avoid using both -o and -O together. Keep -o for specifying the output path:

-    curl -o /tmp/kubectl -fsLO "https://dl.k8s.io/release/${kubectl_version}/bin/${OS}/${ARCH}/kubectl"
+    curl -o /tmp/kubectl -fsL "https://dl.k8s.io/release/${kubectl_version}/bin/${OS}/${ARCH}/kubectl"

---

52-54: Fix curl invocation when downloading krew

Similarly, drop -O to ensure the output file is named correctly:

-    curl -o "/tmp/${KREW}.tar.gz" -fsLO "https://github.com/kubernetes-sigs/krew/releases/download/${krew_version}/${KREW}.tar.gz"
+    curl -o "/tmp/${KREW}.tar.gz" -fsL "https://github.com/kubernetes-sigs/krew/releases/download/${krew_version}/${KREW}.tar.gz"

---

1-2: 🛠️ Refactor suggestion

Add strict mode for robust error handling

Enable fail-fast behavior and protect against unset variables by adding set -euo pipefail and IFS immediately after the shebang.

 #!/bin/bash
+set -euo pipefail
+IFS=$'\n\t'

---

10-10: ⚠️ Potential issue

Correct architecture normalization to handle all variants

Add mapping for 32-bit x86 (i[3-6]86) and reorder patterns to avoid mis-normalizing aarch64. For example:

-ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')"
+ARCH="$(uname -m | sed \
+  -e 's/x86_64/amd64/' \
+  -e 's/i[3-6]86/386/' \
+  -e 's/aarch64$/arm64/' \
+  -e 's/\(arm\)\(64\)\?.*/\1\2/')"

scripts/user_setup_env.sh (3)

31-38: Use temporary files safely

Avoid static /tmp names to prevent race conditions. Use mktemp for downloads:

 function install_talm() {
     log "Installing talm"
-
-    curl -o /tmp/talm -fsL "https://github.com/cozystack/talm/releases/download/${talm_version}/talm-${OS}-${ARCH}"
-    sudo mv /tmp/talm /usr/local/bin/talm
+    tmp=$(mktemp)
+    curl -fsL "https://github.com/cozystack/talm/releases/download/${talm_version}/talm-${OS}-${ARCH}" -o "$tmp"
+    sudo mv "$tmp" /usr/local/bin/talm
     sudo chown 0:0 /usr/local/bin/talm
     sudo chmod 0755 /usr/local/bin/talm
 }

---

57-59: Prevent duplicate PATH entries and guide shell reload

Guard against multiple .bashrc appends and inform the user to reload:

-    printf '# krew\nexport PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"\n' >> ~/.bashrc
-    source ~/.bashrc
+    grep -qxF 'export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"' ~/.bashrc || \
+      printf '# krew\nexport PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"\n' >> ~/.bashrc
+    echo "Run 'source ~/.bashrc' or reopen your shell to activate krew."

🧰 Tools

🪛 Shellcheck (0.10.0)

[warning] 58-58: ShellCheck can't follow non-constant source. Use a directive to specify location.

(SC1090)

---

27-29: Enhance log function to support multiple arguments

Switch from $1 to $* so all passed parameters are logged:

 function log() {
-    echo "$(date '+%d-%m-%Y %H:%M:%S') - $1"
+    echo "$(date '+%d-%m-%Y %H:%M:%S') - $*"
 }

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

hack/user_setup_env.sh (6)

3-12: Standardize version variables
You're mixing v-prefixed (e.g. talm_version="v0.13.0") and bare versions (fluxcd_version="2.6.1"). This inconsistency can lead to invalid URLs or redundant v characters. Either include the v prefix in all version vars or strip it when constructing URLs.

---

14-25: Halt on installer failure
All installers are chained without handling individual failures. With set -euo pipefail (per above), the script will exit on a failed install, but it's worth documenting this or wrapping calls to provide clearer context on which step failed.

---

27-29: Fix typo in log message
log "Start setuping user environment" → typo “setuping”. Consider:

-log "Start setuping user environment"
+log "Starting setup of user environment"

---

31-38: DRY up repetitive install functions
Each install_* repeats download → mv → chown → chmod. Extract a helper:

install_binary() {
  local name=$1 url=$2
  curl -fsSL "$url" -o "/tmp/$name"
  sudo mv "/tmp/$name" "/usr/local/bin/$name"
  sudo chown 0:0 "/usr/local/bin/$name"
  sudo chmod 0755 "/usr/local/bin/$name"
}

Then call:

install_binary talm "https://.../${talm_version}/talm-${OS}-${ARCH}"

This reduces duplication and eases future maintenance.

Also applies to: 40-47, 79-86, 88-96, 105-113

---

98-103: Idempotent Helm plugin installation
Re-running will fail if diff is already installed. Wrap with:

helm plugin list | grep -q '^diff ' || \
  helm plugin install https://github.com/databus23/helm-diff

---

116-116: Prevent unintended execution on sourcing
If someone sources this script, it will auto-run. Wrap the invocation:

if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
  user_setup_env
fi

This clarifies entrypoint behavior.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

hack/user_setup_env.sh (4)

74-89: Robust check & idempotent plugin installation

[[ ! $(kubectl krew version) ]] mis-interprets output; rely on exit status.
Also skip plugins already present to avoid error spam.

-if [[ ! $(kubectl krew version) ]]; then
+if ! kubectl krew version >/dev/null 2>&1; then
     …
 fi
 …
-kubectl krew install node-shell
+kubectl krew list | grep -q '^node-shell$' || kubectl krew install node-shell

(repeat for other plugins)

---

1-3: Add strict error-handling & root guard at script entry
The script still risks silent failures and uninitialised variables, and CI shows “permission denied”. Add set -euo pipefail and a root / sudo guard right after the she-bang.

 #!/bin/bash
+set -euo pipefail
+
+if [[ $EUID -ne 0 ]]; then
+  echo "Please run as root or with sudo"
+  exit 1
+fi

---

56-57: Conflicting curl flags (-o + -O)
-O overrides -o ⇒ the file lands in the current dir, not /tmp. Drop -O.

-curl -o /tmp/kubectl -fsLO …
+curl -fsSL -o /tmp/kubectl …

---

62-72: Make krew install idempotent, fix curl flags & satisfy SC1090

1. mkdir fails second run; use mkdir -p and wipe stale files.
2. Same -o/-O flag issue.
3. Appending to ~/.bashrc on every run duplicates PATH.
4. Add ShellCheck directive before source.

 KREW="krew-${OS}_${ARCH}"
-curl -o "/tmp/${KREW}.tar.gz" -fsLO "https://github.com/kubernetes-sigs/krew/releases/download/${krew_version}/${KREW}.tar.gz"
-mkdir /tmp/krew && tar -xzf "/tmp/${KREW}.tar.gz" -C /tmp/krew/
+curl -fsSL -o "/tmp/${KREW}.tar.gz" "https://github.com/kubernetes-sigs/krew/releases/download/${krew_version}/${KREW}.tar.gz"
+mkdir -p /tmp/krew && rm -rf /tmp/krew/*
+tar -xzf "/tmp/${KREW}.tar.gz" -C /tmp/krew/
 …
-printf '# krew\nexport PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"\n' >> ~/.bashrc
- source ~/.bashrc
+# Guard duplicate PATH entry
+grep -qxF 'export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"' ~/.bashrc || \
+  printf '\n# krew\nexport PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"\n' >> ~/.bashrc
+# shellcheck source=/dev/null
+source ~/.bashrc

hack/user_setup_env.sh (3)

11-14: Remove noisy unconditional echo
echo $ARCH spams every invocation (including CI logs) and provides no functional value.

-echo $ARCH

---

30-32: Quote log payload to preserve whitespace
Protect against word-splitting in the log helper.

-echo "$(date '+%d-%m-%Y %H:%M:%S') - $1"
+echo "$(date '+%d-%m-%Y %H:%M:%S') - $*"

---

62-62: Inconsistent function definition style
Every other function uses function name(), but install_krew() omits the function keyword. Stick to one style.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

hack/user_setup_env.sh (5)

1-3: Add strict mode & privilege guard at script start
Without set -euo pipefail, failures go unnoticed; uninitialised vars or broken pipes will silently continue. Also, many installs require root – abort early when the user is non-root instead of letting sudo prompts break CI.

 #!/bin/bash
+set -euo pipefail
+if [[ $EUID -ne 0 ]]; then
+  echo "Please run with sudo or as root"
+  exit 1
+fi

---

37-41: Broken extraction path: cozypkg never ends up in /tmp
tar xzvf - cozypkg extracts into CWD yet you later mv /tmp/cozypkg …, which fails on fresh machines.

-curl -sSL … | tar xzvf - cozypkg
-sudo mv /tmp/cozypkg /usr/local/bin/cozypkg
+curl -sSL … | tar -xzvf - -C /tmp
+sudo mv /tmp/cozypkg /usr/local/bin/cozypkg

---

56-56: Conflicting curl flags overwrite target file
-o /tmp/kubectl and -O together cause -O to win, the binary lands in $PWD. Use one flag:

-curl -o /tmp/kubectl -fsLO "https://dl.k8s.io/release/${kubectl_version}/bin/${OS}/${ARCH}/kubectl"
+curl -fsSL -o /tmp/kubectl "https://dl.k8s.io/release/${kubectl_version}/bin/${OS}/${ARCH}/kubectl"

---

65-72: Make krew setup idempotent & silence ShellCheck SC1090
Repeated runs keep appending PATH lines and sourcing non-constant paths trips SC1090.

-mkdir /tmp/krew && tar -xzf "/tmp/${KREW}.tar.gz" -C /tmp/krew/
+mkdir -p /tmp/krew && rm -rf /tmp/krew/*
+tar -xzf "/tmp/${KREW}.tar.gz" -C /tmp/krew/

-printf '# krew\nexport PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"\n' >> ~/.bashrc
+# Guard against duplicates
+grep -qxF 'export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"' ~/.bashrc || \
+  printf '\n# krew\nexport PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"\n' >> ~/.bashrc
+# shellcheck source=/dev/null

---

77-80: Use exit code to detect krew instead of output test
[[ ! $(kubectl krew version) ]] mis-fires when command prints to stderr. Prefer exit status:

-if [[ ! $(kubectl krew version) ]]; then
+if ! kubectl krew version >/dev/null 2>&1; then

hack/user_setup_env.sh (1)

12-12: Remove stray debug echo
echo $ARCH pollutes stdout and interferes with callers piping the output.

-echo $ARCH
+# echo "$ARCH"   # Uncomment for debugging if needed

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

Learnt from: lllamnyp
PR: cozystack/cozystack#1025
File: packages/apps/kafka/charts/cozy-lib:1-1
Timestamp: 2025-06-04T06:22:17.306Z
Learning: Files in packages/apps/*/charts/cozy-lib that contain the path "../../../library/cozy-lib" are symbolic links, not regular files. Git diffs may display symlinks as regular files with their target path as content, which can be misleading in code review.