Are there any guidelines for when pants should handle the installation of an external tool vs when users should be required to install the tools themselves? For instance, pants will handle installing binaries for terraform, helm and shellcheck, but requires users to already have docker, python, and java installed. The reason I ask is because I created a feature request this morning for adding a backend for trunk. When I started writing the plugin code I realized that trunk uses an installer script with a lot of the same features pants has - namely, a separate launcher binary that will handle installing and upgrading different versions of trunk itself, and validating the SHA to prevent supply chain attacks. Additionally, most people using this tool will also probably be using the VSCode extension, which requires a global installation, and the provided github actions, which handle installation. Suffice to say, I'm leaning towards not handling installation as part of pants itself and just using a

SystemBinary

instance a la git or docker.

I think trying to have independent, standalone, hermetic builds - maybe with an opt-out to SystemBinary (for those who do it) would be ideal… Unless the downloadable size is just ridiculous (e.g. clang/llvm) My reason for that preference is that our CI and any future example repos are made a lot cleaner and easier to use, rather than having to provision the running machine as well.

Yeah, I think Python, Docker, Java and Go are somewhat special cases that's not the preferred approach: there's even effort to have Pants be able to provide python interpreters via the

pants.backend.python.providers.experimental.pyenv

backends. That is, Pants-provided is better if posisble/reasonable.

FWIW, that doesn’t mean that rev1 couldn’t just use SystemBinary, but it would be nice if the configs were already in place assuming that SystemBinary would be a fallback option, with a future default just pulling in the CLI using the NPMTool backend (or whatever it would be in the end)

Checking for the system binary and only installing if it isn't already there seems ideal from my perspective. For this particular case, do you think it's better to rely on the provided installer script or to recreate the logic in Pants? I'm think what I could do is have a subsystem for the installer, which will SHA-match on the installer script, and then let the installer script handle actually installing the tool. With either a preference or fallback to system binary if one exists.

My inclination would be use the installer script as is, if that can be made to work sensibly with the rest of the caching infrastructure.

Checking for the system binary and only installing if it isn't already there seems ideal from my perspective.

Do you have specific benefits in mind for using the system binary for this use case? If Pants needs to have the hermetic-install code available anyway, I'd be inclined to just always use that

I guess if we could verify it's the exact same system binary as we'd be installing but...we'd probably have to install it to do that, so moot point 😅