fix(python): share safe startup and honor explicit virtual environments

back/config/const.ts

@@ -1,3 +1,5 @@
+import { maybeSudo } from './container';
+
 export const LOG_END_SYMBOL = '　　　　　';
 
 export const TASK_COMMAND = 'task';
@@ -49,6 +51,8 @@ export const NotificationModeStringMap = {
   18: 'chronocat',
   19: 'ntfy',
   20: 'wxPusherBot',
+  21: 'wxPusherSpt',
+  22: 'wpush',
 } as const;
 
 export const LINUX_DEPENDENCE_COMMAND: Record<
@@ -61,17 +65,17 @@ export const LINUX_DEPENDENCE_COMMAND: Record<
   }
 > = {
   Debian: {
-    install: 'sudo apt-get install -y',
-    uninstall: 'sudo apt-get remove -y',
-    info: 'sudo dpkg-query -s',
+    install: maybeSudo('apt-get install -y'),
+    uninstall: maybeSudo('apt-get remove -y'),
+    info: maybeSudo('dpkg-query -s'),
     check(info: string) {
       return info.includes('install ok installed');
     },
   },
   Ubuntu: {
-    install: 'sudo apt-get install -y',
-    uninstall: 'sudo apt-get remove -y',
-    info: 'sudo dpkg-query -s',
+    install: maybeSudo('apt-get install -y'),
+    uninstall: maybeSudo('apt-get remove -y'),
+    info: maybeSudo('dpkg-query -s'),
     check(info: string) {
       return info.includes('install ok installed');
     },

back/config/container.ts

@@ -0,0 +1,7 @@
+export function isInContainer(): boolean {
+  return process.env.QL_CONTAINER === 'true';
+}
+
+export function maybeSudo(cmd: string): string {
+  return isInContainer() ? `sudo ${cmd}` : cmd;
+}

back/config/grpcCerts.ts

@@ -0,0 +1,198 @@
+import { execFileSync } from 'child_process';
+import * as fs from 'fs/promises';
+import path from 'path';
+import config from './index';
+import { fileExist } from './util';
+import Logger from '../loaders/logger';
+
+export interface GrpcTlsConfig {
+  caCert: string;
+  serverCert: string;
+  serverKey: string;
+  clientCert: string;
+  clientKey: string;
+}
+
+const certDir = path.join(config.configPath, 'grpc');
+const caKeyPath = path.join(certDir, 'ca.key');
+const caCertPath = path.join(certDir, 'ca.crt');
+const serverKeyPath = path.join(certDir, 'server.key');
+const serverCertPath = path.join(certDir, 'server.crt');
+const clientKeyPath = path.join(certDir, 'client.key');
+const clientCertPath = path.join(certDir, 'client.crt');
+
+let cachedConfig: GrpcTlsConfig | null = null;
+
+function run(args: string[]): string {
+  return execFileSync('openssl', args, {
+    stdio: 'pipe',
+    timeout: 30000,
+    encoding: 'utf-8',
+  }).trim();
+}
+
+async function generateAllCerts(): Promise<GrpcTlsConfig> {
+  Logger.info('[boot] Generating gRPC mTLS certificates...');
+  await fs.mkdir(certDir, { recursive: true, mode: 0o700 });
+  // Atomically reserve a private workspace for keys, CSRs and OpenSSL side files.
+  const workspace = await fs.mkdtemp(path.join(certDir, '.generate-'));
+  const caKeyTmp = path.join(workspace, 'ca.key');
+  const caCertTmp = path.join(workspace, 'ca.crt');
+  const serverKeyTmp = path.join(workspace, 'server.key');
+  const serverCsrTmp = path.join(workspace, 'server.csr');
+  const serverExtTmp = path.join(workspace, 'server.ext');
+  const clientKeyTmp = path.join(workspace, 'client.key');
+  const clientCsrTmp = path.join(workspace, 'client.csr');
+  const clientExtTmp = path.join(workspace, 'client.ext');
+
+  const cleanup = async () => {
+    await fs.rm(workspace, { recursive: true, force: true });
+  };
+
+  try {
+    run(['genrsa', '-out', caKeyTmp, '2048']);
+    run([
+      'req',
+      '-new',
+      '-x509',
+      '-days',
+      '3650',
+      '-key',
+      caKeyTmp,
+      '-out',
+      caCertTmp,
+      '-subj',
+      '/CN=qinglong-ca/O=qinglong/C=CN',
+    ]);
+    const caKey = await fs.readFile(caKeyTmp, 'utf-8');
+    const caCert = await fs.readFile(caCertTmp, 'utf-8');
+    await fs.writeFile(caKeyPath, caKey, { mode: 0o600 });
+
+    run(['genrsa', '-out', serverKeyTmp, '2048']);
+    run([
+      'req',
+      '-new',
+      '-key',
+      serverKeyTmp,
+      '-out',
+      serverCsrTmp,
+      '-subj',
+      '/CN=grpc-server',
+    ]);
+    await fs.writeFile(
+      serverExtTmp,
+      'subjectAltName=DNS:localhost,IP:127.0.0.1,IP:::1\n',
+    );
+    const serverCert = run([
+      'x509',
+      '-req',
+      '-days',
+      '3650',
+      '-in',
+      serverCsrTmp,
+      '-CA',
+      caCertTmp,
+      '-CAkey',
+      caKeyTmp,
+      '-CAserial',
+      path.join(workspace, 'ca.srl'),
+      '-CAcreateserial',
+      '-extfile',
+      serverExtTmp,
+    ]);
+    const serverKey = await fs.readFile(serverKeyTmp, 'utf-8');
+
+    run(['genrsa', '-out', clientKeyTmp, '2048']);
+    run([
+      'req',
+      '-new',
+      '-key',
+      clientKeyTmp,
+      '-out',
+      clientCsrTmp,
+      '-subj',
+      '/CN=grpc-client',
+    ]);
+    await fs.writeFile(clientExtTmp, 'extendedKeyUsage=clientAuth\n');
+    const clientCert = run([
+      'x509',
+      '-req',
+      '-days',
+      '3650',
+      '-in',
+      clientCsrTmp,
+      '-CA',
+      caCertTmp,
+      '-CAkey',
+      caKeyTmp,
+      '-CAserial',
+      path.join(workspace, 'ca.srl'),
+      '-CAcreateserial',
+      '-extfile',
+      clientExtTmp,
+    ]);
+    const clientKey = await fs.readFile(clientKeyTmp, 'utf-8');
+
+    Logger.info('[boot] gRPC mTLS certificates generated successfully');
+    return { caCert, serverCert, serverKey, clientCert, clientKey };
+  } finally {
+    await cleanup();
+  }
+}
+
+async function saveCerts(tlsConfig: GrpcTlsConfig): Promise<void> {
+  await fs.mkdir(certDir, { recursive: true });
+
+  await fs.writeFile(caCertPath, tlsConfig.caCert, { mode: 0o644 });
+  await fs.writeFile(serverCertPath, tlsConfig.serverCert, { mode: 0o644 });
+  await fs.writeFile(serverKeyPath, tlsConfig.serverKey, { mode: 0o600 });
+  await fs.writeFile(clientCertPath, tlsConfig.clientCert, { mode: 0o644 });
+  await fs.writeFile(clientKeyPath, tlsConfig.clientKey, { mode: 0o600 });
+
+  Logger.info(`[boot] gRPC mTLS certificates saved to ${certDir}`);
+}
+
+async function loadExistingCerts(): Promise<GrpcTlsConfig | null> {
+  const exists = await Promise.all([
+    fileExist(caCertPath),
+    fileExist(serverCertPath),
+    fileExist(serverKeyPath),
+    fileExist(clientCertPath),
+    fileExist(clientKeyPath),
+  ]);
+
+  if (exists.some((e) => !e)) {
+    return null;
+  }
+
+  const [caCert, serverCert, serverKey, clientCert, clientKey] = await Promise.all([
+    fs.readFile(caCertPath, 'utf-8'),
+    fs.readFile(serverCertPath, 'utf-8'),
+    fs.readFile(serverKeyPath, 'utf-8'),
+    fs.readFile(clientCertPath, 'utf-8'),
+    fs.readFile(clientKeyPath, 'utf-8'),
+  ]);
+
+  Logger.info('[boot] Loaded existing gRPC mTLS certificates from disk');
+  return { caCert, serverCert, serverKey, clientCert, clientKey };
+}
+
+export async function initGrpcCerts(): Promise<GrpcTlsConfig> {
+  if (cachedConfig) {
+    return cachedConfig;
+  }
+
+  let tlsConfig = await loadExistingCerts();
+
+  if (!tlsConfig) {
+    tlsConfig = await generateAllCerts();
+    await saveCerts(tlsConfig);
+  }
+
+  cachedConfig = tlsConfig;
+  return tlsConfig;
+}
+
+export function getGrpcCerts(): GrpcTlsConfig | null {
+  return cachedConfig;
+}

back/config/index.ts

@@ -1,6 +1,5 @@
 import dotenv from 'dotenv';
 import path from 'path';
-import { createRandomString } from './share';
 
 dotenv.config({
   path: path.join(__dirname, '../../.env'),
@@ -110,6 +109,7 @@ const jsEnvFile = path.join(preloadPath, 'env.js');
 const pyEnvFile = path.join(preloadPath, 'env.py');
 const jsNotifyFile = path.join(preloadPath, '__ql_notify__.js');
 const pyNotifyFile = path.join(preloadPath, '__ql_notify__.py');
+const langEnvFile = path.join(preloadPath, 'lang_env.sh');
 const confFile = path.join(configPath, 'config.sh');
 const crontabFile = path.join(configPath, 'crontab.list');
 const authConfigFile = path.join(configPath, 'auth.json');
@@ -118,8 +118,6 @@ const confBakDir = path.join(dataPath, 'config/bak/');
 const sampleFile = path.join(samplePath, 'config.sample.sh');
 const sqliteFile = path.join(samplePath, 'database.sqlite');
 
-const authError = '错误的用户名密码，请重试';
-const loginFaild = '请先登录!';
 const configString = 'config sample crontab shareCode diy';
 const versionFile = path.join(rootPath, 'version.yaml');
 const dataTgzFile = path.join(tmpPath, 'data.tgz');
@@ -141,8 +139,6 @@ export default {
   shareShellFile,
   dependenceProxyFile,
   configString,
-  loginFaild,
-  authError,
   logPath,
   extraFile,
   authConfigFile,
@@ -155,6 +151,7 @@ export default {
   pyEnvFile,
   jsNotifyFile,
   pyNotifyFile,
+  langEnvFile,
   dbPath,
   uploadPath,
   configPath,
@@ -171,6 +168,8 @@ export default {
     'env.js',
     'env.py',
     'token.json',
+    'grpc',
+    '__pycache__',
   ],
   writePathList: [configPath, scriptPath],
   bakPath,

back/config/share.ts

@@ -1,3 +1,5 @@
+import { randomInt } from 'crypto';
+
 export function createRandomString(min: number, max: number): string {
   const num = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9'];
   const english = [
@@ -65,20 +67,20 @@ export function createRandomString(min: number, max: number): string {
   arr.push(getOne(ENGLISH));
   arr.push(getOne(special));
 
-  const len = min + Math.floor(Math.random() * (max - min + 1));
+  const len = min + randomInt(max - min + 1);
 
   for (let i = 4; i < len; i++) {
-    arr.push(config[Math.floor(Math.random() * config.length)]);
+    arr.push(config[randomInt(config.length)]);
   }
 
   const newArr = [];
   for (let j = 0; j < len; j++) {
-    newArr.push(arr.splice(Math.random() * arr.length, 1)[0]);
+    newArr.push(arr.splice(randomInt(arr.length), 1)[0]);
   }
 
   function getOne(arr: any[]) {
-    return arr[Math.floor(Math.random() * arr.length)];
+    return arr[randomInt(arr.length)];
   }
 
   return newArr.join('');
-}
+}

back/config/subscription.ts

@@ -1,5 +1,7 @@
 import { Subscription } from '../data/subscription';
 import isNil from 'lodash/isNil';
+import { shellQuote } from '../shared/shellQuote';
+import { getSubscriptionSshAlias } from '../shared/subscriptionPath';
 
 export function formatUrl(doc: Subscription) {
   let url = doc.url;
@@ -7,7 +9,7 @@ export function formatUrl(doc: Subscription) {
   if (doc.type === 'private-repo') {
     if (doc.pull_type === 'ssh-key') {
       host = doc.url!.replace(/.*\@([^\:]+)\:.*/, '$1');
-      url = doc.url!.replace(host, doc.alias);
+      url = doc.url!.replace(host, getSubscriptionSshAlias(doc.alias));
     } else {
       host = doc.url!.replace(/.*\:\/\/([^\/]+)\/.*/, '$1');
       const { username, password } = doc.pull_option as any;
@@ -18,29 +20,24 @@ export function formatUrl(doc: Subscription) {
 }
 
 export function formatCommand(doc: Subscription, url?: string) {
-  let command = `SUB_ID=${doc.id} ql `;
-  let _url = url || formatUrl(doc).url;
-  const {
-    type,
-    whitelist,
-    blacklist,
-    dependences,
-    branch,
-    extensions,
-    proxy,
-    autoAddCron,
-    autoDelCron,
-  } = doc;
-  if (type === 'file') {
-    command += `raw "${_url}" "${proxy || ''}" "${
-      isNil(autoAddCron) ? true : Boolean(autoAddCron)
-    }" "${isNil(autoDelCron) ? true : Boolean(autoDelCron)}"`;
-  } else {
-    command += `repo "${_url}" "${whitelist || ''}" "${blacklist || ''}" "${
-      dependences || ''
-    }" "${branch || ''}" "${extensions || ''}" "${proxy || ''}" "${
-      isNil(autoAddCron) ? true : Boolean(autoAddCron)
-    }" "${isNil(autoDelCron) ? true : Boolean(autoDelCron)}"`;
-  }
-  return command;
+  const args =
+    doc.type === 'file'
+      ? ['raw', url || formatUrl(doc).url, doc.proxy || '']
+      : [
+          'repo',
+          url || formatUrl(doc).url,
+          doc.whitelist || '',
+          doc.blacklist || '',
+          doc.dependences || '',
+          doc.branch || '',
+          doc.extensions || '',
+          doc.proxy || '',
+        ];
+  args.push(
+    String(isNil(doc.autoAddCron) ? true : Boolean(doc.autoAddCron)),
+    String(isNil(doc.autoDelCron) ? true : Boolean(doc.autoDelCron)),
+  );
+  return `SUB_ID=${shellQuote(String(doc.id))} ql ${args
+    .map((arg) => shellQuote(arg!))
+    .join(' ')}`;
 }

back/config/util.ts

@@ -11,6 +11,9 @@ import { writeFileWithLock } from '../shared/utils';
 import { DependenceTypes } from '../data/dependence';
 import { FormData } from 'undici';
 import os from 'os';
+import { maybeSudo, isInContainer } from './container';
+import { shellQuote } from '../shared/shellQuote';
+import { resolveFileAccess } from '../shared/fileAccess';
 
 export * from './share';
 
@@ -143,7 +146,8 @@ export async function handleLogPath(
   logPath: string,
   data: string = '',
 ): Promise<string> {
-  const absolutePath = path.resolve(config.logPath, logPath);
+  const absolutePath = resolveFileAccess(config.logPath, [logPath]);
+  if (!absolutePath) throw new Error('Log path is outside the log directory');
   const logFileExist = await fileExist(absolutePath);
   if (!logFileExist) {
     await createFile(absolutePath, data);
@@ -213,48 +217,105 @@ export function dirSort(a: IFile, b: IFile): number {
   }
 }
 
+const FILE_SYSTEM_READ_CONCURRENCY = 32;
+
+type FileSystemTaskRunner = <T>(task: () => Promise<T>) => Promise<T>;
+
+function createFileSystemTaskRunner(concurrency: number): FileSystemTaskRunner {
+  let activeCount = 0;
+  const queue: Array<() => void> = [];
+
+  const runNext = () => {
+    while (activeCount < concurrency && queue.length > 0) {
+      activeCount += 1;
+      queue.shift()?.();
+    }
+  };
+
+  return <T>(task: () => Promise<T>) =>
+    new Promise<T>((resolve, reject) => {
+      queue.push(() => {
+        task()
+          .then(resolve, reject)
+          .finally(() => {
+            activeCount -= 1;
+            runNext();
+          });
+      });
+      runNext();
+    });
+}
+
+async function readDirsWithRunner(
+  dir: string,
+  baseDir: string,
+  blacklist: string[],
+  sort: (a: IFile, b: IFile) => number,
+  runFileSystemTask: FileSystemTaskRunner,
+): Promise<IFile[]> {
+  const relativePath = path.relative(baseDir, dir);
+  const entries = await runFileSystemTask(() =>
+    fs.readdir(dir, { withFileTypes: true }),
+  );
+
+  const items = await Promise.all(
+    entries.map(async (entry): Promise<IFile | undefined> => {
+      if (blacklist.includes(entry.name) || entry.isSymbolicLink()) {
+        return undefined;
+      }
+
+      const subPath = path.join(dir, entry.name);
+      const stats = await runFileSystemTask(() => fs.lstat(subPath));
+      if (stats.isSymbolicLink()) {
+        return undefined;
+      }
+      const key = path.join(relativePath, entry.name);
+
+      if (stats.isDirectory()) {
+        const children = await readDirsWithRunner(
+          subPath,
+          baseDir,
+          blacklist,
+          sort,
+          runFileSystemTask,
+        );
+        return {
+          title: entry.name,
+          key,
+          type: 'directory',
+          parent: relativePath,
+          createTime: stats.birthtime.getTime(),
+          children,
+        };
+      }
+
+      return {
+        title: entry.name,
+        type: 'file',
+        key,
+        parent: relativePath,
+        size: stats.size,
+        createTime: stats.birthtime.getTime(),
+      };
+    }),
+  );
+
+  return items.filter((item): item is IFile => Boolean(item)).sort(sort);
+}
+
 export async function readDirs(
   dir: string,
   baseDir: string = '',
   blacklist: string[] = [],
   sort: (a: IFile, b: IFile) => number = dirSort,
 ): Promise<IFile[]> {
-  const relativePath = path.relative(baseDir, dir);
-  const files = await fs.readdir(dir);
-  const result: IFile[] = [];
-
-  for (const file of files) {
-    const subPath = path.join(dir, file);
-    const stats = await fs.lstat(subPath);
-    const key = path.join(relativePath, file);
-
-    if (blacklist.includes(file) || stats.isSymbolicLink()) {
-      continue;
-    }
-
-    if (stats.isDirectory()) {
-      const children = await readDirs(subPath, baseDir, blacklist, sort);
-      result.push({
-        title: file,
-        key,
-        type: 'directory',
-        parent: relativePath,
-        createTime: stats.birthtime.getTime(),
-        children: children.sort(sort),
-      });
-    } else {
-      result.push({
-        title: file,
-        type: 'file',
-        key,
-        parent: relativePath,
-        size: stats.size,
-        createTime: stats.birthtime.getTime(),
-      });
-    }
-  }
-
-  return result.sort(sort);
+  return readDirsWithRunner(
+    dir,
+    baseDir,
+    blacklist,
+    sort,
+    createFileSystemTaskRunner(FILE_SYSTEM_READ_CONCURRENCY),
+  );
 }
 
 export async function readDir(
@@ -429,18 +490,69 @@ export function psTree(pid: number): Promise<number[]> {
   });
 }
 
-export async function killTask(pid: number) {
-  const pids = await psTree(pid);
-
-  if (pids.length) {
+export async function killTask(pid: number, waitForExit = false) {
+  const descendants = await psTree(pid);
+  const signal = (target: number, sig: NodeJS.Signals) => {
     try {
-      [pid, ...pids].reverse().forEach((x) => {
-        process.kill(x, 15);
-      });
-    } catch (error) {}
-  } else {
-    process.kill(pid, 2);
+      process.kill(target, sig);
+    } catch (error: any) {
+      if (error.code !== 'ESRCH') throw error;
+    }
+  };
+  if (!waitForExit) {
+    if (descendants.length) {
+      // A child may exit after psTree; keep signalling the remaining tree.
+      for (const target of [pid, ...descendants].reverse()) {
+        signal(target, 'SIGTERM');
+      }
+    } else signal(pid, 'SIGINT');
+    return;
   }
+  const pids = [...descendants.reverse(), pid];
+  for (const target of pids) signal(target, 'SIGTERM');
+  const alive = async (target: number) => {
+    try {
+      process.kill(target, 0);
+    } catch (error: any) {
+      if (error.code === 'ESRCH') return false;
+      throw error;
+    }
+    if (process.platform === 'linux') {
+      try {
+        const stat = await fs.readFile(`/proc/${target}/stat`, 'utf8');
+        // The command field may contain spaces and parentheses. Zombies have
+        // exited even while their parent has not reaped the PID yet.
+        const state = stat.slice(stat.lastIndexOf(')') + 2).split(' ')[0];
+        if (['Z', 'X', 'x'].includes(state)) return false;
+      } catch {
+        // /proc may be unavailable, or the process may have just exited.
+        // Retain the portable signal probe rather than assuming it is dead.
+        try {
+          process.kill(target, 0);
+        } catch (error: any) {
+          if (error.code === 'ESRCH') return false;
+          throw error;
+        }
+      }
+    }
+    return true;
+  };
+  const wait = async () => {
+    const deadline = Date.now() + 1000;
+    let remaining = pids;
+    while (true) {
+      const states = await Promise.all(remaining.map(alive));
+      remaining = remaining.filter((_, index) => states[index]);
+      if (!remaining.length || Date.now() >= deadline) return remaining;
+      await new Promise((resolve) => setTimeout(resolve, 20));
+    }
+  };
+  let remaining = await wait();
+  if (!remaining.length) return;
+  for (const target of remaining) signal(target, 'SIGKILL');
+  remaining = await wait();
+  if (remaining.length)
+    throw new Error(`Task processes did not exit: ${remaining.join(', ')}`);
 }
 
 export async function getPid(cmd: string) {
@@ -535,11 +647,13 @@ export function safeJSONParse(value?: string) {
   try {
     return JSON.parse(value);
   } catch (error) {
-    Logger.error('[safeJSONParse失败]', error);
+    Logger.error('[safeJSONParse error]', error);
     return {};
   }
 }
 
+export { errStack } from '../shared/errors';
+
 export async function rmPath(path: string) {
   try {
     const _exsit = await fileExist(path);
@@ -547,7 +661,7 @@ export async function rmPath(path: string) {
       await fs.rm(path, { force: true, recursive: true, maxRetries: 5 });
     }
   } catch (error) {
-    Logger.error('[rmPath失败]', error);
+    Logger.error('[rmPath error]', error);
   }
 }
 
@@ -557,12 +671,14 @@ export async function setSystemTimezone(timezone: string): Promise<boolean> {
       throw new Error('Invalid timezone');
     }
 
-    await promiseExec(`sudo ln -sf /usr/share/zoneinfo/${timezone} /etc/localtime`);
-    await promiseExec(`echo "${timezone}" | sudo tee /etc/timezone`);
+    await promiseExec(
+      maybeSudo(`ln -sf /usr/share/zoneinfo/${timezone} /etc/localtime`),
+    );
+    await promiseExec(`echo "${timezone}" | ${maybeSudo('tee /etc/timezone')}`);
 
     return true;
   } catch (error) {
-    Logger.error('[setSystemTimezone失败]', error);
+    Logger.error('[setSystemTimezone error]', error);
     return false;
   }
 }
@@ -571,7 +687,13 @@ export function getGetCommand(type: DependenceTypes, name: string): string {
   const baseCommands = {
     [DependenceTypes.nodejs]: `pnpm ls -g  | grep "${name}" | head -1`,
     [DependenceTypes.python3]: `
-    python3 -c "exec('''
+    ${
+      PYTHON_VENV_DIR
+        ? shellQuote(
+            path.resolve(config.rootPath, PYTHON_VENV_DIR, 'bin/python3'),
+          )
+        : 'python3'
+    } -c "exec('''
 name='${name}'
 try:
     from importlib.metadata import version
@@ -582,9 +704,10 @@ except:
     spec=u.find_spec(name)
     print(name if spec else '')
 ''')"`,
-    [DependenceTypes.linux]: getOsTypeSync() === 'Alpine'
-      ? `apk info -es ${name}`
-      : `sudo dpkg-query -s ${name}`,
+    [DependenceTypes.linux]:
+      getOsTypeSync() === 'Alpine'
+        ? `apk info -es ${name}`
+        : maybeSudo(`dpkg-query -s ${name}`),
   };
 
   return baseCommands[type];
@@ -593,16 +716,26 @@ except:
 export function getInstallCommand(type: DependenceTypes, name: string): string {
   const baseCommands = {
     [DependenceTypes.nodejs]: 'pnpm add -g',
-    [DependenceTypes.python3]:
-      'pip3 install --disable-pip-version-check --root-user-action=ignore',
-    [DependenceTypes.linux]: getOsTypeSync() === 'Alpine'
-      ? 'apk add --no-check-certificate'
-      : 'sudo apt-get install -y',
+    [DependenceTypes.python3]: `${
+      PYTHON_VENV_DIR
+        ? shellQuote(
+            path.resolve(config.rootPath, PYTHON_VENV_DIR, 'bin/python3'),
+          ) + ' -m pip'
+        : 'pip3'
+    } install --disable-pip-version-check --root-user-action=ignore`,
+    [DependenceTypes.linux]:
+      getOsTypeSync() === 'Alpine'
+        ? 'apk add --no-check-certificate'
+        : maybeSudo('apt-get install -y'),
   };
 
   let command = baseCommands[type];
 
-  if (type === DependenceTypes.python3 && PYTHON_INSTALL_DIR && !PYTHON_VENV_DIR) {
+  if (
+    type === DependenceTypes.python3 &&
+    PYTHON_INSTALL_DIR &&
+    !PYTHON_VENV_DIR
+  ) {
     command = `${command} --prefix=${PYTHON_INSTALL_DIR}`;
   }
 
@@ -615,11 +748,15 @@ export function getUninstallCommand(
 ): string {
   const baseCommands = {
     [DependenceTypes.nodejs]: 'pnpm remove -g',
-    [DependenceTypes.python3]:
-      'pip3 uninstall --disable-pip-version-check --root-user-action=ignore -y',
-    [DependenceTypes.linux]: getOsTypeSync() === 'Alpine'
-      ? 'apk del'
-      : 'sudo apt-get remove -y',
+    [DependenceTypes.python3]: `${
+      PYTHON_VENV_DIR
+        ? shellQuote(
+            path.resolve(config.rootPath, PYTHON_VENV_DIR, 'bin/python3'),
+          ) + ' -m pip'
+        : 'pip3'
+    } uninstall --disable-pip-version-check --root-user-action=ignore -y`,
+    [DependenceTypes.linux]:
+      getOsTypeSync() === 'Alpine' ? 'apk del' : maybeSudo('apt-get remove -y'),
   };
 
   return `${baseCommands[type]} ${name.trim()}`;
@@ -732,31 +869,52 @@ async function _updateLinuxMirror(
   osType: string,
   mirrorDomainWithScheme: string,
 ): Promise<string> {
+  const S = isInContainer() ? 'sudo ' : '';
+  // APT otherwise returns zero when index downloads fail with transient errors.
+  const aptUpdate = `${S}apt-get update --error-on=any`;
   let filePath: string, currentDomainWithScheme: string | null;
   switch (osType) {
     case 'Debian':
       filePath = '/etc/apt/sources.list.d/debian.sources';
       currentDomainWithScheme = await getCurrentMirrorDomain(filePath);
       if (currentDomainWithScheme) {
-        return `sudo sed -i 's|${currentDomainWithScheme}|${mirrorDomainWithScheme || 'http://deb.debian.org'}|g' ${filePath} || (sudo mkdir -p /etc/apt/sources.list.d && echo -e "Types: deb\\nURIs: ${mirrorDomainWithScheme || 'http://deb.debian.org'}\\nSuites: \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2) \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-updates\\nComponents: main\\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg" | sudo tee ${filePath}) && sudo apt-get update`;
+        return `${S}sed -i 's|${currentDomainWithScheme}|${
+          mirrorDomainWithScheme || 'http://deb.debian.org'
+        }|g' ${filePath} || (${S}mkdir -p /etc/apt/sources.list.d && echo -e "Types: deb\\nURIs: ${
+          mirrorDomainWithScheme || 'http://deb.debian.org'
+        }\\nSuites: \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2) \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-updates\\nComponents: main\\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg" | ${S}tee ${filePath}) && ${aptUpdate}`;
       } else {
-        return `sudo mkdir -p /etc/apt/sources.list.d && echo -e "Types: deb\\nURIs: ${mirrorDomainWithScheme || 'http://deb.debian.org'}\\nSuites: \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2) \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-updates\\nComponents: main\\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg" | sudo tee ${filePath} && sudo apt-get update`;
+        return `${S}mkdir -p /etc/apt/sources.list.d && echo -e "Types: deb\\nURIs: ${
+          mirrorDomainWithScheme || 'http://deb.debian.org'
+        }\\nSuites: \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2) \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-updates\\nComponents: main\\nSigned-By: /usr/share/keyrings/debian-archive-keyring.gpg" | ${S}tee ${filePath} && ${aptUpdate}`;
       }
     case 'Ubuntu':
       filePath = '/etc/apt/sources.list.d/ubuntu.sources';
       currentDomainWithScheme = await getCurrentMirrorDomain(filePath);
       if (currentDomainWithScheme) {
-        return `sudo sed -i 's|${currentDomainWithScheme}|${mirrorDomainWithScheme || 'http://archive.ubuntu.com'}|g' ${filePath} || (sudo mkdir -p /etc/apt/sources.list.d && echo -e "Types: deb\\nURIs: ${mirrorDomainWithScheme || 'http://archive.ubuntu.com'}\\nSuites: \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2) \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-updates \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-backports\\nComponents: main restricted universe multiverse\\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" | sudo tee ${filePath}) && sudo apt-get update`;
+        return `${S}sed -i 's|${currentDomainWithScheme}|${
+          mirrorDomainWithScheme || 'http://archive.ubuntu.com'
+        }|g' ${filePath} || (${S}mkdir -p /etc/apt/sources.list.d && echo -e "Types: deb\\nURIs: ${
+          mirrorDomainWithScheme || 'http://archive.ubuntu.com'
+        }\\nSuites: \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2) \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-updates \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-backports\\nComponents: main restricted universe multiverse\\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" | ${S}tee ${filePath}) && ${aptUpdate}`;
       } else {
-        return `sudo mkdir -p /etc/apt/sources.list.d && echo -e "Types: deb\\nURIs: ${mirrorDomainWithScheme || 'http://archive.ubuntu.com'}\\nSuites: \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2) \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-updates \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-backports\\nComponents: main restricted universe multiverse\\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" | sudo tee ${filePath} && sudo apt-get update`;
+        return `${S}mkdir -p /etc/apt/sources.list.d && echo -e "Types: deb\\nURIs: ${
+          mirrorDomainWithScheme || 'http://archive.ubuntu.com'
+        }\\nSuites: \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2) \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-updates \\$(grep VERSION_CODENAME /etc/os-release | cut -d= -f2)-backports\\nComponents: main restricted universe multiverse\\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" | ${S}tee ${filePath} && ${aptUpdate}`;
       }
     case 'Alpine':
       filePath = '/etc/apk/repositories';
       currentDomainWithScheme = await getCurrentMirrorDomain(filePath);
       if (currentDomainWithScheme) {
-        return `sed -i 's|${currentDomainWithScheme}|${mirrorDomainWithScheme || 'http://dl-cdn.alpinelinux.org'}|g' ${filePath} || (mkdir -p /etc/apk && echo -e "\\$(grep VERSION_ID /etc/os-release | cut -d= -f2 | cut -d. -f1,2)/main\\n\\$(grep VERSION_ID /etc/os-release | cut -d= -f2 | cut -d. -f1,2)/community" | sed "s|^|${mirrorDomainWithScheme || 'http://dl-cdn.alpinelinux.org'}/alpine/v|" | tee ${filePath}) && apk update`;
+        return `sed -i 's|${currentDomainWithScheme}|${
+          mirrorDomainWithScheme || 'http://dl-cdn.alpinelinux.org'
+        }|g' ${filePath} || (mkdir -p /etc/apk && echo -e "\\$(grep VERSION_ID /etc/os-release | cut -d= -f2 | cut -d. -f1,2)/main\\n\\$(grep VERSION_ID /etc/os-release | cut -d= -f2 | cut -d. -f1,2)/community" | sed "s|^|${
+          mirrorDomainWithScheme || 'http://dl-cdn.alpinelinux.org'
+        }/alpine/v|" | tee ${filePath}) && apk update`;
       } else {
-        return `mkdir -p /etc/apk && echo -e "\\$(grep VERSION_ID /etc/os-release | cut -d= -f2 | cut -d. -f1,2)/main\\n\\$(grep VERSION_ID /etc/os-release | cut -d= -f2 | cut -d. -f1,2)/community" | sed "s|^|${mirrorDomainWithScheme || 'http://dl-cdn.alpinelinux.org'}/alpine/v|" | tee ${filePath} && apk update`;
+        return `mkdir -p /etc/apk && echo -e "\\$(grep VERSION_ID /etc/os-release | cut -d= -f2 | cut -d. -f1,2)/main\\n\\$(grep VERSION_ID /etc/os-release | cut -d= -f2 | cut -d. -f1,2)/community" | sed "s|^|${
+          mirrorDomainWithScheme || 'http://dl-cdn.alpinelinux.org'
+        }/alpine/v|" | tee ${filePath} && apk update`;
       }
     default:
       throw Error('Unsupported OS type for updating mirrors.');