nvidia-holoscan / holoscan-cli / 28530228148

78%

main: 77%

Build Type

Pull #193

github

Committed by wyli

Commit Message

fix: install CLI in one env and elevate only per-operation (NVBug 6336980)

`./holohub setup` regressed on PEP 668 hosts (Jetson AGX Thor / IGX Thor):
`sudo ./holohub setup` failed with `externally-managed-environment`, and a
venv install then died in `sccache.sh` writing `/opt/sccache` unprivileged.

Rework the setup privilege model around two rules:

- One Python environment. The CLI runs in the interpreter you're already in
  (active venv, or the wrapper-managed venv), so build/run/setup and
  `sys.executable` stay consistent, and setup never installs into system
  Python.

- Elevate only the system steps. Replace the command-text sudo heuristic in
  `utils/io.py` with an explicit `run_command(..., as_root=True)` and a
  `write_system_file()` helper; delete `_classify_sudo_requirement` /
  `_process_command_with_sudo`. Route apt, the Kitware keyring/apt source,
  and the bash-completion copy through explicit elevation; install the ngc
  CLI into `~/.local/bin` (no root).

Setup scripts are plain, familiar bash (no helper library): they run as the
invoking user in the project's Python environment with sudo available --
`sudo apt-get ...` for system packages, `python3 -m pip ...` for Python. The
CLI runs them with the venv on PATH and prompts for sudo once on the default
path. `sccache` installs to a user-owned dir on the host (system-wide only
when root), so no elevation is needed to close the bug; `Dockerfile.util`
installs sudo so the scripts work in-container.

Signed-off-by: Wenqi Li <wenqil@nvidia.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Pull Request Pull Request #193: fix: install CLI in one env and elevate only per-operation

Coverage Stats

21 of 63 new or added lines in 3 files covered. (33.33%)

3 existing lines in 2 files now uncovered.

2955 of 3844 relevant lines covered (76.87%)

0.77 hits per line