nvidia-holoscan / holoscan-cli / 29020739415

79%

main: 79%

Build Type

push

github

Committed by web-flow

Commit Message

fix: install CLI in one env and elevate only per-operation (#193)

* fix: install CLI in one env and elevate only per-operation

`./holohub setup` regressed on PEP 668 hosts (Jetson AGX Thor / IGX Thor):
`sudo ./holohub setup` failed with `externally-managed-environment`, and a
venv install then died in `sccache.sh` writing `/opt/sccache` unprivileged.

Rework the setup privilege model around two rules:

- One Python environment. The CLI runs in the interpreter you're already in
  (active venv, or the wrapper-managed venv), so build/run/setup and
  `sys.executable` stay consistent, and setup never installs into system
  Python.

- Elevate only the system steps. Replace the command-text sudo heuristic in
  `utils/io.py` with an explicit `run_command(..., as_root=True)` and a
  `write_system_file()` helper; delete `_classify_sudo_requirement` /
  `_process_command_with_sudo`. Route apt, the Kitware keyring/apt source,
  and the bash-completion copy through explicit elevation; install the ngc
  CLI into `~/.local/bin` (no root).

Setup scripts are plain, familiar bash (no helper library): they run as the
invoking user in the project's Python environment with sudo available --
`sudo apt-get ...` for system packages, `python3 -m pip ...` for Python. The
CLI runs them with the venv on PATH and prompts for sudo once on the default
path. `sccache` installs to a user-owned dir on the host (system-wide only
when root), so no elevation is needed to close the bug; `Dockerfile.util`
installs sudo so the scripts work in-container.

Signed-off-by: Wenqi Li <wenqil@nvidia.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Coverage Stats

158 of 201 new or added lines in 8 files covered. (78.61%)

4 existing lines in 2 files now uncovered.

3129 of 3981 relevant lines covered (78.6%)

0.79 hits per line