[ananos]

A user on a fresh Ubuntu 26.04 ran curl -fsSL brig.sh/install | sh (brig v0.5.0, rc19) and got the rootless refusal. The refusal itself is right: the host had no uidmap, no acl and no vhost_vsock. Three parts of the message did not hold for them, though:

  Nothing was downloaded: the installer does not install packages or add subuid ranges.
  Run the commands below as root, or ask an admin to, and then run this
  installer again. It needs no sudo after that.
  ...
  See docs/rootless.md.

brig's installer had already fetched cosign (about 130 MB), the brig archive and this script. docs/rootless.md is a path in a checkout they do not have. "this installer" is a script they never ran directly.

This is on top of #36, which installs the packages itself when sudo can run. The refusal is still what a user without sudo, or without a terminal, gets.

Changes

• The refusal says the installer stopped before it downloaded the bundle. This also holds when the sudo step of fix(install): Set up the host with sudo, with the host's own package manager #36 fails.
• The refusal, the install summary's group notes and --help give the guide's URL (ROOTLESS_DOC).
• New INSTALL_BRIG_RERUN: the caller passes the command that runs the install again, and the refusal prints it after the root commands. Unset, nothing extra is printed. brig's install.sh will pass curl -fsSL https://brig.sh/install | sh (fix(install): Keep cosign across runs and say how to run again brig-sh/brig#555).
• The modules-load.d comment, in install.sh and in the generated brig-rootless-setup.sh, says "brig's rootless setup" instead of naming a script the root commands do not run.
• docs/rootless.md: the sample refusal matches the new text.
• tests/install-preflight.sh: checks the new reason, the URL, that no command is printed without INSTALL_BRIG_RERUN, and that it is printed after BRIG_ROOT when set.

Tested

Locally (macOS): sh -n and shellcheck over install.sh scripts/build-bundle.sh tests/*.sh. In a Debian trixie container without uidmap and acl, as a normal user, every tests/*.sh passes, including #36's sudo and password cases (CI skips those, since its runner has both packages).

Not tested: the printed root commands on Ubuntu 26.04 itself.

Release sequence

For rc21. The brig side only sets an environment variable, so either can merge first.