Why does new install.python-poetry.org script not add poetry to PATH?

[johnthagen]

The legacy get-poetry.py install script adds poetry to the PATH on Windows. When trying out the new https://install.python-poetry.org script, I noticed that it no longer adds poetry to the PATH, but instructs that the user must do this manually. I feel this is a pretty big UX step backwards, especially for novice developers for whom this could trip up.

get-poetry.py output:

...
This path will then be added to your `PATH` environment variable by
modifying the `HKEY_CURRENT_USER/Environment/PATH` registry key.
...

install.python-poetry.org output:

...
To get started you need Poetry's bin directory (...) in your `PATH`
environment variable.
...

On a clean Windows 10 VM, get-poetry.org allowed using poetry directly from a new Powershell after installation, but install.python-poetry.org did not. A default installation of Python 3.10.5 was used to test with.

I'm curious what the reasoning for this change was?

Related to

• #5915

Ubuntu (22.04) has a similar workflow:

$ sudo apt install curl python3-venv

get-poetry.py output:

$ curl -sSL https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py | python3 -
...
$HOME/.poetry/bin

This path will then be added to your `PATH` environment variable by
modifying the profile file located at:

...

To get started you need Poetry's bin directory ($HOME/.poetry/bin) in your `PATH`
environment variable. Next time you log in this will be done
automatically.

install.python-poetry.org output:

$ curl -sSL https://install.python-poetry.org | python3 -
...
Add `export PATH="/home/user/.local/bin:$PATH"` to your shell configuration file.

[neersighted]

The reason for this is that atomically altering the user's shell configuration files is hazardous/fraught at best, and unexpected and harmful at worst. Many users manage their shell configuration explicitly and do not appreciate any program tampering. For those that don't, it's still difficult to modify a script in an idempotent and robust manner, all to save a little bit of manual text editing that any user of a CLI program should be familiar with. Poetry additionally makes this easier by not using an unusual path, but instead using the bin directory that is part of the XDG spec (~/.local/bin).

I hesitate to say we will never adjust this behavior, but experience from other projects as well as maintaining and providing support for the old installer have led us to reject this as an anti-feature.

[AlexeyFeigin]

While we are on this topic:

Is it not the case that prepending ~/.local/bin to PATH is a security vulnerability?

It allows a process with user permissions to write a file to ~/.local/bin which will then take precedence over a system command (e.g. ls).

I would suggest advising the user to append to PATH:

Add `export PATH="$PATH:/home/user/.local/bin"` to your shell configuration file.

While this might results in poetry to be over-shadowed by some other binary, at least it does not introduce a vulnerability.

Or has some thought been put into this benefit/risk trade-off and a considered decision made for this configuration advice?

[edit: @neersighted ]

[neersighted]

We leave the order in the PATH as an exercise for the user. It is true that you could maybe do bad things by overriding a command here, but it's just as easy to overwrite the Poetry binary with something malicious if you see the user uses Poetry, even if it's appended to the path. At the end of the day I think that this attack vector is purely hypothetical as if you're in a position to use it, you can already do more straightforward/evil things. That being said there is no reason you can't append instead of prepend if you're worried.

[AlexeyFeigin]

The fact that the way Poetry itself is installed is a security vulnerability is a good point... I guess...

Generally, over time it just became more usual to install executable files under the user's directory. I guess it's the world we're livin' in.

[dmyersturnbull]

Perhaps this could be solved by adding a message at the end of the install, like:

This installer has not modified your PATH. Refer to https://microsoft.com/windows/whatever/documentation/whatever for how to add it.

[johnthagen]

See

• Add PowerShell snippets for postinstall install.python-poetry.org#22

[Lodimup]

I teach Python, and found out today about this issue. This is a huge step backward. This slows down adoption. I wouldn't want to tech new
developer about how to edit shell in their first classes.

an option "do you want to add poetry to ...[Y\n] would be nice

In real work environment I use poetry within dev container so there is no issue there.

[abn]

I don't think it is the responsibility of the application installer to modify shell configuration. Rather, it tries its best to place the required files in the appropriate locations for the environment. The explicit addition to PATH shouldn't be required for majority cases.