From b92d0167b27b80a35bca749163e50a52992d42f5 Mon Sep 17 00:00:00 2001
From: Kyle J Strand <kstrand@rigetti.com>
Date: Wed, 26 Aug 2026 14:42:28 -0600
Subject: [PATCH] fix: stop a piped install.sh from silently skipping the
 install

install.sh is documented to be run as `curl ... | bash`, where the script text
is itself standard input. A child process that reads stdin therefore consumes
the rest of the script, after which bash reaches EOF and exits 0 -- having
skipped everything that had not been read yet, and reporting success.

That is what `sudo -u "$SUDO_USER" brew install` did. With --install-deps on
macOS the prerequisites were installed, the script ended there, and libquil was
never downloaded. The step passed; the failure surfaced later and elsewhere, as
HeaderNotFound in libquil-sys's build script, because /usr/local/include/libquil
did not exist. See rigetti/libquil-sys#68.

Every command that could read stdin now gets </dev/null: both brew calls, the
two apt-get calls, and unzip, which prompts on an existing file. The script
cannot simply redirect its own stdin, because bash is still reading itself from
there.

This is a regression from replacing the consumers' wrapper scripts with a direct
`curl ... | bash`. Those wrappers downloaded the installer to a temporary file
and ran it from disk, which never had this problem.

Verified by piping the script into bash: it now runs to completion and installs
all seven files, where the shape of the old failure is reproducible with any
stdin-reading child.
---
 scripts/install.sh | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/scripts/install.sh b/scripts/install.sh
index e74caf1..078833a 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -167,6 +167,16 @@ do
         "    install.sh --prefix \"\${HOME}/.local\""
 done
 
+# Every command below that could read standard input is given </dev/null. This
+# script is documented to be run as `curl ... | bash`, where the script text *is*
+# stdin: a child that reads it consumes the rest of the script, and bash then hits
+# EOF and exits 0 having silently skipped everything after. That is not
+# hypothetical -- `sudo brew install` did exactly this, leaving prerequisites
+# installed and libquil not.
+#
+# The whole script cannot simply redirect its own stdin: bash is still reading
+# itself from there.
+
 # Installing prerequisites is opt-in. The default is to check and report, because
 # this script is commonly run as `curl ... | sudo bash` and a package manager
 # invocation there has a much wider blast radius than copying files into
@@ -201,12 +211,13 @@ install_prerequisites() {
     local formula
     for formula in openblas libffi
     do
-      "${brew_cmd[@]}" list --formula "${formula}" >/dev/null 2>&1 || missing+=("${formula}")
+      "${brew_cmd[@]}" list --formula "${formula}" >/dev/null 2>&1 </dev/null ||
+        missing+=("${formula}")
     done
     if [[ "${#missing[@]}" -gt 0 ]]
     then
       echo "Installing prerequisites with Homebrew: ${missing[*]}"
-      "${brew_cmd[@]}" install "${missing[@]}"
+      "${brew_cmd[@]}" install "${missing[@]}" </dev/null
     fi
     return
   fi
@@ -230,8 +241,8 @@ install_prerequisites() {
   if [[ "${#missing[@]}" -gt 0 ]]
   then
     echo "Installing prerequisites with apt: ${missing[*]}"
-    apt-get update
-    apt-get install -y "${missing[@]}"
+    apt-get update </dev/null
+    apt-get install -y "${missing[@]}" </dev/null
   fi
 }
 
@@ -359,7 +370,7 @@ else
   curl -fL "${LIBQUIL_RELEASE_URL}" -o "${LIBQUIL_RELEASE_FILE}" ||
     err "Could not download ${LIBQUIL_RELEASE_URL}" \
         "Check that the requested version exists: https://github.com/${LIBQUIL_RELEASE_REPO}/releases"
-  unzip "${LIBQUIL_RELEASE_FILE}"
+  unzip "${LIBQUIL_RELEASE_FILE}" </dev/null
   LIBQUIL_SOURCE_DIR="${LIBQUIL_TEMP_DIR}/libquil"
 fi