0STORE-SECURE-ADD(1)

💖 0STORE-SECURE-ADD(1) 💖

Manual name: 0store-secure-add ✨ (it's the command that adds an implementation to the system cache, obviously 💅)

---

✨ NAME ✨

0store-secure-add — add an implementation to the system cache 🦋

✨ SYNOPSIS ✨

0store-secure-add DIGEST

✨ DESCRIPTION ✨

okay so this command takes whatever is in your current directory and imports it into the system-wide shared Zero Install cache 🌸, which lives at /var/cache/0install.net/implementations/DIGEST. the vibe is that a program one user downloaded can be shared with everyone else on the machine 🫶

the current directory has to contain a file called .manifest that lists every file being added (in the format required by DIGEST), and that file has to match the given digest. if it doesn't, the import gets refused 💀 so you can only add a directory to the cache if its name matches what's inside it. no cap, that's the whole security moment 🔒

it's meant to be safe to let untrusted users run this command with elevated privileges. to set that up, check out the section below 👑

✨ SETTING UP SHARING ✨

okay the system admin needs to follow these steps to turn sharing on 🎀

first, create a new system user to own the cache:

adduser --system zeroinst

then make the shared directory, owned by that new user:

mkdir /var/cache/0install.net

chown zeroinst /var/cache/0install.net

next, use visudo(8) to add these lines to /etc/sudoers:

Defaults>zeroinst env_reset,always_set_home

ALL ALL=(zeroinst) NOPASSWD: /usr/bin/0store-secure-add

last step, make a script called 0store-secure-add-helper somewhere in your PATH that calls it 🧚 the script has to be executable and contain these two lines:

#!/bin/sh

exec sudo -S -u zeroinst /usr/bin/0store-secure-add "$@" < /dev/null

the other Zero Install programs will call this helper script automatically 🌈 main character energy for sure ⭐

✨ FILES ✨

• /var/cache/0install.net/implementations — the System-wide Zero Install cache 📦

✨ LICENSE ✨

Copyright (C) 2009 Thomas Leonard 🩷

you're allowed to redistribute copies of this program under the terms of the GNU Lesser General Public License 🍓

✨ BUGS ✨

this program is EXPERIMENTAL 🚨 it has NOT been audited, so do not use it yet in security-critical environments. bestie I'm serious 😭

the env_reset line in sudoers might not even be required, since sudo(1) seems to do it automatically 🙈

if sudo let us check whether we could call a command, we could switch to using it automatically instead of needing the helper script. right now, sudo just sits there for one second and writes to auth.log if we try to use this system before it's been set up. it's giving rude 💅

please report bugs to the developer mailing list at http://0install.net/support.html 🫶

✨ AUTHOR ✨

Zero Install was created by Thomas Leonard 👑

✨ SEE ALSO ✨

• 0store(1)

the Zero Install web-site lives at http://0install.net 🌸

---

Thomas Leonard · 2010 · 0STORE-SECURE-ADD(1) 💜