Build one thing, and plan its removal first

short · 35 min · Objective 2.4

Task

Compile a small program from source into a prefix you can delete, having verified its signature rather than only its checksum. The removal plan comes first, because nothing will track the installation for you.

Steps

  1. Choose a small project with published signatures -- GNU hello is ideal. Download the tarball, its .sig file and the project's signing key.
  2. Verify the checksum, then verify the SIGNATURE with gpg --verify. Note what each one proves, and state the difference in one sentence before continuing.
  3. Attempt ./configure and let it fail on a missing development header if it does. Install the -devel package it needs and read the error message again -- the library was present all along; the headers were not.
  4. Configure with an explicit, versioned prefix: ./configure --prefix=/opt/hello-2.12. Read ./configure --help first and note at least two options you might have wanted.
  5. Build as your ordinary user with make. Do not use sudo for this step.
  6. Install with sudo make install, which is the only step needing privilege.
  7. Add the prefix to your PATH, run the program, and confirm it works.
  8. Remove it: rm -rf /opt/hello-2.12. That deletion is clean only because of the decision made in step 4.

Verify

gpg --verify hello-*.tar.gz.sig hello-*.tar.gz 2>&1 | grep -qi 'good signature' && echo "signature ok"
/opt/hello-2.12/bin/hello
ls -d /opt/hello-2.12
rm -rf /opt/hello-2.12 && test ! -d /opt/hello-2.12 && echo "removed cleanly"
rpm -qf /opt/hello-2.12/bin/hello 2>&1 | grep -qi 'not owned' && echo "package manager never knew"

The last check is the point of the whole lab: the package manager has no record of the software you just installed, which is why the prefix decision and the removal plan had to come first.

Notes

Had you configured with the default --prefix=/usr/local, the binary, its manual page and its locale files would now be scattered across four directories with nothing recording which ones were yours. That is the state people find themselves in, and the reason checkinstall and stow exist.