diff --git a/cmd/setup/doctor.go b/cmd/setup/doctor.go index ab55846..42e94a0 100644 --- a/cmd/setup/doctor.go +++ b/cmd/setup/doctor.go @@ -4,7 +4,6 @@ import ( "fmt" "os" "path/filepath" - "slices" "github.com/safedep/pmg/config" "github.com/safedep/pmg/internal/alias" @@ -120,12 +119,6 @@ func runCoreChecks(cfg *config.RuntimeConfig) []doctor.CheckResult { Name: checkShellAliases, Category: "Shell Integration", Run: func() doctor.CheckResult { - if shim.SystemShimsInstalled() { - return doctor.CheckResult{ - Status: doctor.StatusPass, - Message: "System shims installed (aliases optional)", - } - } aliasCfg := alias.DefaultConfig() rcFileManager, err := alias.NewDefaultRcFileManager(aliasCfg.RcFileName) if err != nil { @@ -142,15 +135,21 @@ func runCoreChecks(cfg *config.RuntimeConfig) []doctor.CheckResult { Message: fmt.Sprintf("Could not determine alias status: %v", err), } } - if !installed { + if installed { return doctor.CheckResult{ - Status: doctor.StatusFail, - Message: "Aliases not installed", + Status: doctor.StatusPass, + Message: "Shell aliases installed", + } + } + if shim.SystemShimsInstalled() { + return doctor.CheckResult{ + Status: doctor.StatusWarn, + Message: "Aliases not installed (optional with system shims)", } } return doctor.CheckResult{ - Status: doctor.StatusPass, - Message: "Shell aliases installed", + Status: doctor.StatusFail, + Message: "Aliases not installed", } }, }, @@ -190,33 +189,29 @@ func runCoreChecks(cfg *config.RuntimeConfig) []doctor.CheckResult { Category: "Shell Integration", Run: func() doctor.CheckResult { pathEntries := filepath.SplitList(os.Getenv("PATH")) - if shim.SystemShimsInstalled() { - systemDir := shim.SystemBinDir() - if slices.Contains(pathEntries, systemDir) { - return doctor.CheckResult{ - Status: doctor.StatusPass, - Message: "System shim directory is in PATH", - } - } + systemDir := shim.SystemBinDir() + if shim.SystemShimsInstalled() && pathContainsDir(pathEntries, systemDir) { return doctor.CheckResult{ - Status: doctor.StatusFail, - Message: fmt.Sprintf("System shim directory not in PATH (add ENV PATH=\"%s:$PATH\" for Docker RUN)", systemDir), + Status: doctor.StatusPass, + Message: "System shim directory is in PATH", } } - sm, err := shim.NewDefaultShimManager() - if err != nil { - return doctor.CheckResult{ - Status: doctor.StatusWarn, - Message: fmt.Sprintf("Could not check shims: %v", err), - } + userDir := "" + if home, err := os.UserHomeDir(); err == nil { + userDir = filepath.Join(home, ".pmg", "bin") } - shimDir := sm.GetBinDir() - if slices.Contains(pathEntries, shimDir) { + if pathContainsDir(pathEntries, userDir) { return doctor.CheckResult{ Status: doctor.StatusPass, Message: "Shim directory is in PATH", } } + if shim.SystemShimsInstalled() { + return doctor.CheckResult{ + Status: doctor.StatusFail, + Message: "System shim directory not in PATH", + } + } return doctor.CheckResult{ Status: doctor.StatusFail, Message: "Shim directory not in PATH", @@ -307,6 +302,19 @@ func runCoreChecks(cfg *config.RuntimeConfig) []doctor.CheckResult { return doctor.RunChecks(checks) } +func pathContainsDir(pathEntries []string, dir string) bool { + if dir == "" { + return false + } + cleanDir := filepath.Clean(dir) + for _, entry := range pathEntries { + if filepath.Clean(entry) == cleanDir { + return true + } + } + return false +} + func runProtectionChecks(coreResults []doctor.CheckResult) []doctor.CheckResult { if !isInterceptionActive(coreResults) { var results []doctor.CheckResult @@ -366,15 +374,15 @@ var checkDisplayNames = map[string]string{ var checkFixes = map[string]string{ checkConfigFile: "pmg setup install", checkEventLogDir: "pmg setup install", - checkShellAliases: "pmg setup install [--system]", - checkShimDirectory: "pmg setup install [--system]", - checkShimInPath: "Restart shell, source profile, or set ENV PATH for Docker", + checkShellAliases: "pmg setup install", + checkShimDirectory: "pmg setup install", + checkShimInPath: "Restart shell or source profile", checkProxyMode: "Set proxy.enabled: true in config", checkSandbox: "Set sandbox.enabled: true in config", checkDependencyCooldown: "Set dependency_cooldown.enabled: true in config", checkEventLogging: "Set skip_event_logging: false in config", - checkProtectionNpm: "pmg setup install [--system]", - checkProtectionPip: "pmg setup install [--system]", + checkProtectionNpm: "pmg setup install", + checkProtectionPip: "pmg setup install", checkCA: "pmg setup cert install", } diff --git a/cmd/setup/doctor_system_test.go b/cmd/setup/doctor_system_test.go new file mode 100644 index 0000000..b7b5eeb --- /dev/null +++ b/cmd/setup/doctor_system_test.go @@ -0,0 +1,23 @@ +package setup + +import ( + "testing" + + "github.com/safedep/pmg/internal/doctor" + "github.com/stretchr/testify/assert" +) + +func TestPathContainsDir(t *testing.T) { + assert.True(t, pathContainsDir([]string{"/usr/local/lib/pmg/bin/"}, "/usr/local/lib/pmg/bin")) + assert.False(t, pathContainsDir([]string{"/usr/local/bin"}, "/usr/local/lib/pmg/bin")) + assert.False(t, pathContainsDir([]string{"/usr/bin"}, "")) +} + +func TestSystemShimsWithoutPathDoNotActivateInterception(t *testing.T) { + results := []doctor.CheckResult{ + {Name: checkShellAliases, Status: doctor.StatusWarn}, + {Name: checkShimInPath, Status: doctor.StatusFail}, + } + + assert.False(t, isInterceptionActive(results)) +} diff --git a/cmd/setup/info.go b/cmd/setup/info.go index b2390dc..da3b61c 100644 --- a/cmd/setup/info.go +++ b/cmd/setup/info.go @@ -80,10 +80,10 @@ func executeSetupInfo() error { shellEntries["Detected Shell"] = shell shellEntries["Alias Installed"] = strconv.FormatBool(isInstalled) shellEntries["User Shims"] = strconv.FormatBool(shim.UserShimsInstalled()) - shellEntries["System Shims"] = strconv.FormatBool(shim.SystemShimsInstalled()) - shellEntries["System Profile"] = strconv.FormatBool(shim.SystemProfileInstalled()) if shim.SystemShimsInstalled() { - shellEntries["System Shim Dir"] = shim.SystemBinDir() + shellEntries["System Shims"] = shim.SystemBinDir() + } else { + shellEntries["System Shims"] = "not installed" } ui.PrintInfoSection("Shell Integration", shellEntries) diff --git a/cmd/setup/setup.go b/cmd/setup/setup.go index 858c8d7..9e818cf 100644 --- a/cmd/setup/setup.go +++ b/cmd/setup/setup.go @@ -16,12 +16,6 @@ import ( "github.com/spf13/cobra" ) -var ( - setupRemoveConfigFile bool - setupInstallSystem bool - setupRemoveSystem bool -) - var setupGeteuid = os.Geteuid func NewSetupCommand() *cobra.Command { @@ -45,21 +39,22 @@ func NewSetupCommand() *cobra.Command { } func NewInstallCommand() *cobra.Command { + var system bool cmd := &cobra.Command{ Use: "install", Short: "Setup PMG config, aliases, and shims for package managers (npm, pnpm, pip, and more)", SilenceUsage: true, RunE: func(cmd *cobra.Command, args []string) error { fmt.Print(ui.GeneratePMGBanner(version.Version, version.Commit)) - return install() + return install(system) }, } - cmd.Flags().BoolVar(&setupInstallSystem, "system", false, "Install system-wide for all users (Linux, requires root)") + cmd.Flags().BoolVar(&system, "system", false, "Install system-wide for all users (Linux, requires root)") return cmd } -func install() error { - if setupInstallSystem { +func install(system bool) error { + if system { return installSystem() } @@ -114,45 +109,50 @@ func installSystem() error { return err } - if err := config.WriteSystemTemplateConfig(); err != nil { - return fmt.Errorf("failed to write system config: %w", err) - } - shimMgr, err := shim.NewSystemShimManager() if err != nil { return fmt.Errorf("failed to create system shim manager: %w", err) } + // Shims/profile first so a failed config write does not leave a managed + // config active without interception. if err := shimMgr.Install(); err != nil { return fmt.Errorf("failed to install system shims: %w", err) } + if err := config.WriteSystemTemplateConfig(); err != nil { + return fmt.Errorf("failed to write system config: %w", err) + } ui.PrintSetupSystemInstallCmdInfo(shimMgr.GetBinDir(), config.SystemConfigDir(), shim.SystemProfilePath()) return nil } func NewRemoveCommand() *cobra.Command { + var ( + removeConfig bool + system bool + ) cmd := &cobra.Command{ Use: "remove", Short: "Removes pmg aliases and shims from the user's shell config.", SilenceUsage: true, RunE: func(cmd *cobra.Command, args []string) error { fmt.Print(ui.GeneratePMGBanner(version.Version, version.Commit)) - return remove() + return remove(system, removeConfig) }, } - cmd.Flags().BoolVar(&setupRemoveConfigFile, "config-file", false, "Remove the config file") - cmd.Flags().BoolVar(&setupRemoveSystem, "system", false, "Remove system-wide install (Linux, requires root)") + cmd.Flags().BoolVar(&removeConfig, "config-file", false, "Remove the config file") + cmd.Flags().BoolVar(&system, "system", false, "Remove system-wide install (Linux, requires root)") return cmd } -func remove() error { - if setupRemoveSystem { - return removeSystem() +func remove(system, removeConfig bool) error { + if system { + return removeSystem(removeConfig) } - if setupRemoveConfigFile { + if removeConfig { // Only ever remove the per-user file; the globally managed // config is not ours to delete from a per-user uninstall. if err := config.RemoveUserConfigFile(); err != nil { @@ -189,17 +189,11 @@ func remove() error { return nil } -func removeSystem() error { +func removeSystem(removeConfig bool) error { if err := errIfSystemInstallAllowed(); err != nil { return err } - if setupRemoveConfigFile { - if err := config.RemoveSystemConfigFile(); err != nil { - return err - } - } - shimMgr, err := shim.NewSystemShimManager() if err != nil { return fmt.Errorf("failed to create system shim manager: %w", err) @@ -208,6 +202,11 @@ func removeSystem() error { if err := shimMgr.Remove(); err != nil { return fmt.Errorf("failed to remove system shims: %w", err) } + if removeConfig { + if err := config.RemoveSystemConfigFile(); err != nil { + return err + } + } fmt.Printf("%s %s\n", ui.Colors.Green("✓"), "PMG system install removed") return nil diff --git a/cmd/setup/setup_test.go b/cmd/setup/setup_test.go index d3bd2ca..a1f1447 100644 --- a/cmd/setup/setup_test.go +++ b/cmd/setup/setup_test.go @@ -37,30 +37,19 @@ func TestErrIfSystemInstallAllowed(t *testing.T) { } } -func TestInstallSystemRequiresLinuxAndRoot(t *testing.T) { +func TestInstallSystemRequiresRoot(t *testing.T) { orig := setupGeteuid - t.Cleanup(func() { - setupGeteuid = orig - setupInstallSystem = false - }) + t.Cleanup(func() { setupGeteuid = orig }) - setupInstallSystem = true - setupGeteuid = func() int { return 0 } - - err := install() - if runtime.GOOS == "linux" { - if err != nil { - usefulErr, ok := usefulerror.AsUsefulError(err) - if ok { - assert.NotEqual(t, errcodes.UnsupportedPlatform, usefulErr.Code()) - assert.NotEqual(t, errcodes.PermissionDenied, usefulErr.Code()) - } - } - return - } + setupGeteuid = func() int { return 1000 } + err := install(true) require.Error(t, err) usefulErr, ok := usefulerror.AsUsefulError(err) require.True(t, ok) - assert.Equal(t, errcodes.UnsupportedPlatform, usefulErr.Code()) + if runtime.GOOS == "linux" { + assert.Equal(t, errcodes.PermissionDenied, usefulErr.Code()) + } else { + assert.Equal(t, errcodes.UnsupportedPlatform, usefulErr.Code()) + } } diff --git a/docs/system-install.md b/docs/system-install.md index a949f40..ddc1662 100644 --- a/docs/system-install.md +++ b/docs/system-install.md @@ -14,6 +14,7 @@ sudo pmg setup remove --system --config-file # also remove the system config f ``` Per-user `pmg setup install` remains available and does not conflict with a system install. +The PMG executable used during setup must be executable by every user. Install PMG under a system path such as `/usr/local/bin`. ## Files created @@ -56,7 +57,7 @@ pmg setup doctor Docker `RUN` does not load `/etc/profile.d`. After system install you **must** set `ENV PATH` so build steps and the runtime container see the shims: ```dockerfile -FROM ubuntu:24.04 +FROM node:22-bookworm RUN curl -fsSL https://raw.githubusercontent.com/safedep/pmg/main/install.sh | sh \ && pmg setup install --system @@ -65,7 +66,10 @@ RUN curl -fsSL https://raw.githubusercontent.com/safedep/pmg/main/install.sh | s ENV PATH="/usr/local/lib/pmg/bin:$PATH" # Optional: switch user; PATH from ENV still applies -USER appuser +RUN mkdir -p /app && chown node:node /app +WORKDIR /app +USER node +COPY --chown=node:node package*.json ./ RUN npm ci ``` @@ -73,6 +77,8 @@ Derived images inherit that `ENV`. Later `RUN npm install` / `RUN pip install` g If a child Dockerfile sets `ENV PATH=...` again, keep `/usr/local/lib/pmg/bin` ahead of the real `npm`/`pip` directories. Leaving it out (or behind those toolchains) drops interception. +PMG running on the Docker host cannot inspect package installations inside `docker build`. PMG must be installed in the image as shown above. + ## Configuration The system config file is authoritative for every user. A per-user `config.yml` is ignored while `/etc/safedep/pmg/config.yml` exists. @@ -86,8 +92,8 @@ Optional lockdown (`global_lockdown: true`) is documented in [config.md](./confi - **Virtualenv.** After `source .venv/bin/activate`, bare `pip` uses the venv binary and skips PMG shims. Call `pmg pip …` explicitly. - **No shell aliases.** System install only installs PATH shims. There is no `~/.pmg.rc` alias layer. - **Config changes.** `pmg config set` and `pmg config edit` are unavailable while the system config is active. Edit `/etc/safedep/pmg/config.yml` as root, or redeploy the file. -- **Custom sandbox** `policy_templates`**.** Relative paths in the system config resolve under each user's config directory, not `/etc/safedep/pmg`. Prefer absolute paths. -- `pmg sandbox allow`**.** Blocked when the system config sets `global_lockdown: true`. +- **Custom sandbox `policy_templates`.** Relative paths in the system config resolve under each user's config directory, not `/etc/safedep/pmg`. Prefer absolute paths. +- **`pmg sandbox allow`.** Blocked when the system config sets `global_lockdown: true`. ## User data directories diff --git a/internal/shim/path.go b/internal/shim/path.go index 62fd5f7..2ec173a 100644 --- a/internal/shim/path.go +++ b/internal/shim/path.go @@ -50,6 +50,9 @@ func FilterPMGFromPath(pathEnv string) string { if strings.HasSuffix(entry, pmgBinSuffix) { continue } + if filepath.Clean(entry) == filepath.Clean(SystemBinDir()) { + continue + } if shimDir != "" && filepath.Clean(entry) == shimDir { continue } diff --git a/internal/shim/path_test.go b/internal/shim/path_test.go index f57449f..27298e9 100644 --- a/internal/shim/path_test.go +++ b/internal/shim/path_test.go @@ -58,6 +58,11 @@ func TestFilterPMGFromPath(t *testing.T) { shimEnv: "/usr/local/lib/pmg/bin/npm", expected: "/usr/local/bin:/usr/bin", }, + { + name: "system shim dir is stripped without env var", + path: "/usr/local/lib/pmg/bin:/usr/local/bin:/usr/bin", + expected: "/usr/local/bin:/usr/bin", + }, { name: "env var strips arbitrary shim dir", path: "/shims:/usr/local/bin:/usr/bin", diff --git a/internal/shim/shim.go b/internal/shim/shim.go index 90c5b06..b724bfe 100644 --- a/internal/shim/shim.go +++ b/internal/shim/shim.go @@ -10,7 +10,10 @@ import ( "github.com/safedep/pmg/internal/alias" ) -const shimMarker = "PMG shims" +const ( + shimMarker = "PMG shims" + shimScriptMarker = "# PMG shim - do not edit, managed by pmg setup" +) type ShimConfig struct { BinDir string @@ -91,8 +94,8 @@ func (m *ShimManager) Install() error { } func (m *ShimManager) Remove() error { - if err := os.RemoveAll(m.config.BinDir); err != nil && !os.IsNotExist(err) { - log.Warnf("Warning: failed to remove shim directory: %v", err) + if err := os.RemoveAll(m.config.BinDir); err != nil { + return fmt.Errorf("failed to remove shim directory %s: %w", m.config.BinDir, err) } if m.config.ManageProfile { @@ -142,7 +145,7 @@ func (m *ShimManager) writeShimScript(pm string) error { pmgBin := shellQuote(m.config.PMGBin) content := fmt.Sprintf(`#!/bin/sh -# PMG shim - do not edit, managed by pmg setup +%s PMG_BIN=%s if [ ! -x "$PMG_BIN" ]; then echo "[pmg] error: PMG binary not found or not executable: $PMG_BIN" >&2 @@ -152,7 +155,7 @@ fi PMG_SHIM_PATH=$(cd -- "$(dirname -- "$0")" && pwd)/$(basename -- "$0") export PMG_SHIM_PATH exec "$PMG_BIN" %s "$@" -`, pmgBin, pm) +`, shimScriptMarker, pmgBin, pm) return os.WriteFile(shimPath, []byte(content), 0o755) } diff --git a/internal/shim/shim_test.go b/internal/shim/shim_test.go index 2dcf3cb..532ace6 100644 --- a/internal/shim/shim_test.go +++ b/internal/shim/shim_test.go @@ -68,6 +68,18 @@ func TestShimManagerInstall(t *testing.T) { assert.Contains(t, string(fishContent), ".pmg/bin") } +func TestShimManagerRemoveReturnsDirectoryError(t *testing.T) { + root := t.TempDir() + blocker := filepath.Join(root, "blocker") + require.NoError(t, os.WriteFile(blocker, []byte("not a directory"), 0o644)) + + mgr := NewShimManager(ShimConfig{ + BinDir: filepath.Join(blocker, "bin"), + }) + + assert.Error(t, mgr.Remove()) +} + func TestShimManagerInstallIdempotent(t *testing.T) { homeDir := t.TempDir() binDir := filepath.Join(homeDir, ".pmg", "bin") diff --git a/internal/shim/system.go b/internal/shim/system.go index 1d31ae0..b74fb21 100644 --- a/internal/shim/system.go +++ b/internal/shim/system.go @@ -15,9 +15,8 @@ const ( systemProfileMarker = "PMG system shims" ) -// systemBinDirOverride and systemProfilePathOverride replace the OS-level -// system install paths. They exist only for tests within this package. There -// is intentionally no env var or flag for them. +// These overrides replace OS-level system install paths in tests. There is +// intentionally no env var or flag for them. var ( systemBinDirOverride string systemProfilePathOverride string @@ -48,6 +47,10 @@ func NewSystemShimManager() (*ShimManager, error) { return nil, err } + if err := validateSystemExecutable(pmgBin); err != nil { + return nil, err + } + return &ShimManager{ config: ShimConfig{ BinDir: SystemBinDir(), @@ -59,6 +62,19 @@ func NewSystemShimManager() (*ShimManager, error) { }, nil } +// validateSystemExecutable rejects binaries other users cannot execute. System shims hard-code this path. +func validateSystemExecutable(path string) error { + info, err := os.Stat(path) + if err != nil { + return fmt.Errorf("failed to inspect pmg executable %s: %w", path, err) + } + + if info.Mode().Perm()&0o001 == 0 { + return fmt.Errorf("pmg executable %s is not executable by all users", path) + } + return nil +} + // SystemShimsInstalled reports whether the system shim directory contains at // least one shim script. func SystemShimsInstalled() bool { @@ -71,7 +87,11 @@ func shimsPresent(dir string) bool { return false } for _, e := range entries { - if !e.IsDir() { + if e.IsDir() { + continue + } + content, err := os.ReadFile(filepath.Join(dir, e.Name())) + if err == nil && strings.Contains(string(content), shimScriptMarker) { return true } } @@ -91,19 +111,25 @@ func SystemProfileInstalled() bool { func writeSystemProfile() error { binDir := SystemBinDir() path := SystemProfilePath() + if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil { return fmt.Errorf("failed to create profile.d directory: %w", err) } - if data, err := os.ReadFile(path); err == nil && strings.Contains(string(data), systemProfileMarker) { - return nil - } - content := fmt.Sprintf(`# %s - managed by pmg setup install --system # remove by running: pmg setup remove --system export PATH="%s:$PATH" `, systemProfileMarker, binDir) + data, err := os.ReadFile(path) + if err == nil && string(data) == content { + return nil + } + + if err != nil && !os.IsNotExist(err) { + return fmt.Errorf("failed to read system profile %s: %w", path, err) + } + if err := os.WriteFile(path, []byte(content), 0o644); err != nil { return fmt.Errorf("failed to write system profile %s: %w", path, err) } diff --git a/internal/shim/system_test.go b/internal/shim/system_test.go index bd70f8e..e3f707c 100644 --- a/internal/shim/system_test.go +++ b/internal/shim/system_test.go @@ -37,6 +37,8 @@ func TestSystemShimManagerInstallAndRemove(t *testing.T) { content, err := os.ReadFile(npmShim) require.NoError(t, err) assert.Contains(t, string(content), "export PMG_SHIM_PATH") + assert.Contains(t, string(content), "pmg setup install") + assert.Contains(t, string(content), "pmg setup remove") profile, err := os.ReadFile(SystemProfilePath()) require.NoError(t, err) @@ -71,3 +73,48 @@ func TestSystemShimManagerDoesNotTouchUserRc(t *testing.T) { require.NoError(t, err) assert.Equal(t, "# user bashrc\n", string(content)) } + +func TestSystemShimsInstalledIgnoresUnmanagedFiles(t *testing.T) { + root := t.TempDir() + useSystemPaths(t, root) + require.NoError(t, os.MkdirAll(SystemBinDir(), 0o755)) + require.NoError(t, os.WriteFile(filepath.Join(SystemBinDir(), "README"), []byte("not a shim"), 0o644)) + + assert.False(t, SystemShimsInstalled()) + + require.NoError(t, os.WriteFile( + filepath.Join(SystemBinDir(), "npm"), + []byte("#!/bin/sh\n# PMG shim - do not edit, managed by pmg setup\n"), + 0o755, + )) + assert.True(t, SystemShimsInstalled()) +} + +func TestWriteSystemProfileRepairsStalePath(t *testing.T) { + root := t.TempDir() + useSystemPaths(t, root) + require.NoError(t, os.MkdirAll(filepath.Dir(SystemProfilePath()), 0o755)) + require.NoError(t, os.WriteFile( + SystemProfilePath(), + []byte("# PMG system shims\nexport PATH=\"/stale/path:$PATH\"\n"), + 0o644, + )) + + require.NoError(t, writeSystemProfile()) + + content, err := os.ReadFile(SystemProfilePath()) + require.NoError(t, err) + assert.Contains(t, string(content), SystemBinDir()) + assert.NotContains(t, string(content), "/stale/path") +} + +func TestValidateSystemExecutableRejectsPrivateBinary(t *testing.T) { + privateDir := t.TempDir() + privateExecutable := filepath.Join(privateDir, "pmg") + require.NoError(t, os.WriteFile(privateExecutable, []byte("binary"), 0o700)) + + err := validateSystemExecutable(privateExecutable) + + require.Error(t, err) + assert.Contains(t, err.Error(), "not executable by all users") +} diff --git a/main.go b/main.go index ff72803..8383b87 100644 --- a/main.go +++ b/main.go @@ -103,9 +103,10 @@ func main() { } if eventlogErr != nil { - // Soft-fail: unusable HOME (e.g. system accounts, some containers) - // must not prevent package-manager commands from running. log.Warnf("failed to initialize event logging: %v", eventlogErr) + // Soft-fail: unusable HOME must not block package-manager commands. + ui.Infof("%s Event logging unavailable (%v); continuing without recording this run", + ui.Colors.Yellow("⚠"), eventlogErr) } if err := audit.Initialize(config.Get()); err != nil {