make machine-setup.sh and officer-setup.sh actually run on macOS
Both scripts had real macOS branches already — MACOS_SKIP, Xcode CLT, Docker Desktop
detection — but neither had ever run past its own library load on a real Mac, and
verifying that live is what this commit is. This machine is the Mac.
The root cause was the interpreter, not missing OS coverage: macOS's stock /bin/bash is
3.2.57 (Apple stopped shipping newer once bash went GPLv3) and this machine has no newer
one installed. Both scripts used bash 4+/4.3+ syntax with zero version guard, so a real
run died in seconds — declare -A (base.sh, associative array), local -n (packages.sh,
nameref), mapfile (5 sites), ${var,,} (both scripts' own step() — confirmed --only killed
the ENTIRE run), and machine-setup.sh's own pre-flight hard-refused brew outright ("this
script does not implement yet") even once the bash-4 crash was fixed. Each got rewritten
to its bash-3.2-safe equivalent rather than requiring a newer bash and re-executing under
it — nine call sites, a bounded fix, and one less thing that can go wrong before the
script can report what's wrong.
Past that gate, a live probe run (real account/path prompts, killed before Database/
Services could touch this machine's actual state) reproduced a second bug in the first
few seconds: resolve_user_home used getent (Linux/glibc, absent on macOS) with a
hardcoded /home/<user> fallback, so Layout tried `install -d /home/pastilhas` and failed
with "Operation not supported". Fixed with the portable `eval echo ~user` tilde-expansion
idiom, re-ran the same probe, and it correctly created /Users/pastilhas/officerdev/ and
started a real git clone.
Everything else follows the same shape — an unguarded Linux-only tool with a portable or
brew-based macOS equivalent:
- grep -oP (4 sites: both --list flags, env.sh's tailnet lookup, build.sh's schema
table count) — BSD grep has no -P at all. Portable ERE+sed where regex was enough;
jq where the input was already JSON (tailnet lookup) — jq is already an unconditional
dependency elsewhere in this script, so that's a correctness fix, not just a port.
- ss (postgres.sh, proxy.sh — is anything listening on this port, and is it bound wide
enough for NPM's container to reach) — both silently mis-reported on macOS, since the
"command not found" was swallowed by 2>/dev/null and read as "nothing's listening".
New shared `listening_addrs()` in officer-setup's base.sh, branching to lsof.
- getent hosts (proxy.sh's DNS-wait loop) — same silent-failure shape, would have spun
its full 30-minute timeout regardless of whether the record actually resolved. macOS
branch uses dscacheutil.
- stat -c (layout.sh's ownership check) — BSD stat has no -c, confirmed live ("illegal
option -- c"), and the failure was VISIBLE and made every layout directory report as
wrong-owner. Portable file_owner() tries -c then falls back to -f %Su.
- apt-only Postgres client, NodeSource's Debian-only setup script, lazydocker/lazygit's
installers (one literally named install_update_linux.sh, the other hardcoding
"_Linux_" into the release asset URL) — each gets a brew branch, formula names
verified against the live Homebrew catalog rather than assumed.
- sudo -u "$USERNAME" to become the SAME account the process already is — real on
Linux, where this whole script runs as root and dropping to the owner needs no
password; on macOS the process never escalates in the first place, so re-invoking
sudo for yourself asks for a real password on every call, or fails outright without
sudo rights. machine-setup's dev.sh had ~10 inline call sites (git, bun, deno, claude,
opencode, editor detection) rerouted through a new shared run_as_owner(); officer-
setup's own as_owner() (already the shared entry point there) got the same branch,
and six direct sudo call sites in build.sh/secrets.sh/services.sh that bypassed it
were rerouted through it too.
Three things stay Linux-only rather than getting an unverified macOS implementation,
each skipped with a stated reason at the point it would otherwise run: pm2's boot-
persistence hook (needs a launchd plist generated and loaded, not a systemd unit
printed and eval'd — real, separate work), the Tailscale exit-node NIC/sysctl tuning
(no macOS equivalent concept, and advertising a laptop as an exit node is already the
edge case MACOS_SKIP treats it as), and ufw's bridge-to-host firewall rule (pf is a
different rule language entirely, and Docker Desktop's own VM-based networking may not
even have the problem this rule exists to solve — guessing at a firewall rule felt like
the wrong place to be wrong).
Verified: both --list flags print step names instead of a grep usage error. A bounded
officer-setup.sh run (killed before Database) resolved the real macOS home directory,
created the layout with correct ownership, and began a real git clone — cleaned up
after (rm -rf the test directory, the gitignored .setup-progress file, the stray
install-report). machine-setup.sh's pre-flight now reports "Packages: brew" and reaches
the account/path prompts instead of refusing the OS outright. bash -n clean on all 16
files under bash 3.2, the actual interpreter these scripts run under on a Mac.
Not run further live: Database, Secrets, Services and Proxy would mutate this machine's
real state (a live Postgres, a live set of pm2 processes this session runs through) and
were left for a deliberate, supervised run rather than folded into validation.
This commit is contained in:
@@ -165,25 +165,39 @@ ONLY_STEP="${ONLY_STEP:-}"
|
||||
# Keyed on the step title, so the sections themselves stay Linux code with no
|
||||
# `if macos` branches threaded through them. The reason is printed, because a
|
||||
# silent skip and a missing step look identical.
|
||||
declare -A MACOS_SKIP=(
|
||||
["User account"]="accounts are System Settings' business on a Mac, not a script's"
|
||||
["Disk space"]="ballast and swap tuning are server concerns"
|
||||
["Locale"]="macOS manages locale itself"
|
||||
["Timezone"]="macOS manages the timezone itself"
|
||||
["Swap"]="macOS sizes its own swap dynamically"
|
||||
["Emergency disk ballast"]="a server trick for a machine nobody is sitting at"
|
||||
["earlyoom"]="Linux OOM killer tuning; macOS has its own memory pressure handling"
|
||||
["inotify watch limit"]="Linux inotify; macOS watches files through FSEvents"
|
||||
["Sleep and suspend"]="a laptop SHOULD sleep — this stops a server from doing it"
|
||||
["Boot hang"]="a systemd boot ordering fix"
|
||||
["SSH access"]="hardening a door a dev machine should not be opening"
|
||||
["DNS"]="systemd-resolved"
|
||||
["Network address"]="netplan, and a laptop moves between networks by design"
|
||||
["fail2ban"]="brute-force protection for an exposed SSH port"
|
||||
["Unattended upgrades"]="apt; macOS updates through Software Update"
|
||||
["Firewall"]="ufw; macOS has its own application firewall"
|
||||
["Shell"]="zsh is already the default, and tmux is a choice you make yourself"
|
||||
)
|
||||
#
|
||||
# A `case` rather than an associative array — `declare -A` is bash 4+, and macOS's own
|
||||
# stock `/bin/bash` is 3.2 (Apple hasn't shipped a newer one since bash went GPLv3), with
|
||||
# nothing newer installed on a fresh machine. An array keyed on the step title would parse-
|
||||
# fail the instant this file is sourced, before a single step could run — which is exactly
|
||||
# what happened here until it was measured. Prints the reason on stdout, so the caller reads
|
||||
# it with `$(...)`; exit status says whether the title matched anything at all.
|
||||
macos_skip_reason() {
|
||||
case "$1" in
|
||||
"User account") echo "accounts are System Settings' business on a Mac, not a script's" ;;
|
||||
"Disk space") echo "ballast and swap tuning are server concerns" ;;
|
||||
"Locale") echo "macOS manages locale itself" ;;
|
||||
"Timezone") echo "macOS manages the timezone itself" ;;
|
||||
"Swap") echo "macOS sizes its own swap dynamically" ;;
|
||||
"Emergency disk ballast") echo "a server trick for a machine nobody is sitting at" ;;
|
||||
"earlyoom") echo "Linux OOM killer tuning; macOS has its own memory pressure handling" ;;
|
||||
"inotify watch limit") echo "Linux inotify; macOS watches files through FSEvents" ;;
|
||||
"Sleep and suspend") echo "a laptop SHOULD sleep — this stops a server from doing it" ;;
|
||||
"Boot hang") echo "a systemd boot ordering fix" ;;
|
||||
"SSH access") echo "hardening a door a dev machine should not be opening" ;;
|
||||
"DNS") echo "systemd-resolved" ;;
|
||||
"Network address") echo "netplan, and a laptop moves between networks by design" ;;
|
||||
"fail2ban") echo "brute-force protection for an exposed SSH port" ;;
|
||||
"Unattended upgrades") echo "apt; macOS updates through Software Update" ;;
|
||||
"Firewall") echo "ufw; macOS has its own application firewall" ;;
|
||||
"Shell") echo "zsh is already the default, and tmux is a choice you make yourself" ;;
|
||||
*) return 1 ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# `${var,,}` (case-insensitive compare below) is bash 4+ too — this is the portable
|
||||
# pre-4 substitute, not a style choice.
|
||||
lower() { tr '[:upper:]' '[:lower:]' <<<"$1"; }
|
||||
|
||||
step() {
|
||||
CURRENT_STEP="$1"
|
||||
@@ -191,16 +205,19 @@ step() {
|
||||
# which one it is. Twenty-six sections, one place.
|
||||
declare -F report_section >/dev/null && report_section "$1"
|
||||
|
||||
if [[ "${OS:-}" == "macos" && -n "${MACOS_SKIP[$1]:-}" ]]; then
|
||||
echo ""
|
||||
echo -e "${BOLD}── $1 ──${NC}"
|
||||
echo -e " ${GREEN}SKIP${NC}: not on macOS — ${MACOS_SKIP[$1]}"
|
||||
SKIP_STEP=true
|
||||
return
|
||||
if [[ "${OS:-}" == "macos" ]]; then
|
||||
local _skip_reason
|
||||
if _skip_reason="$(macos_skip_reason "$1")"; then
|
||||
echo ""
|
||||
echo -e "${BOLD}── $1 ──${NC}"
|
||||
echo -e " ${GREEN}SKIP${NC}: not on macOS — ${_skip_reason}"
|
||||
SKIP_STEP=true
|
||||
return
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ -n "$ONLY_STEP" ]]; then
|
||||
if [[ "${1,,}" == "${ONLY_STEP,,}" ]]; then
|
||||
if [[ "$(lower "$1")" == "$(lower "$ONLY_STEP")" ]]; then
|
||||
SKIP_STEP=false
|
||||
echo ""
|
||||
echo -e "${BOLD}── $1 ──${NC}"
|
||||
@@ -508,6 +525,24 @@ ask_officer_root() {
|
||||
# both of which abort the step.
|
||||
user_group() { id -gn "${1:-$USERNAME}" 2>/dev/null || echo "${1:-$USERNAME}"; }
|
||||
|
||||
# Run a command as the created account, e.g. `run_as_owner git clone ...`.
|
||||
#
|
||||
# On Linux this whole script runs as root — refused otherwise, see the pre-flight check
|
||||
# above — so `sudo -u "$USERNAME"` from root needs no password; sudo lets root become
|
||||
# anyone freely. On macOS the script deliberately never escalates (Homebrew refuses to run
|
||||
# as root), so the process already IS "$USERNAME", and re-invoking sudo for the SAME
|
||||
# account asks for a real password — potentially many times in one run, dev.sh calls this
|
||||
# shape roughly ten times — or fails outright on an account with no sudo rights at all.
|
||||
# `dev.sh`'s git/bun/deno/claude/opencode/editor helpers all route through this rather than
|
||||
# hand-rolling `sudo -H -u "$USERNAME" ...` each time, so macOS behaviour lives in one place.
|
||||
run_as_owner() {
|
||||
if [[ "${OS:-}" == "macos" ]]; then
|
||||
"$@"
|
||||
else
|
||||
sudo -H -u "$USERNAME" "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
# Run a block as the created user (login shell, inherits HOME)
|
||||
as_user() {
|
||||
sudo -u "$USERNAME" -i bash -c "$1"
|
||||
|
||||
Reference in New Issue
Block a user