`opam init --disable-sandboxing` doesn't update `~/.opam/config`

[Isweet]

# opam config report
# opam-version      2.0.1
# self-upgrade      no
# system            arch=x86_64 os=macos os-distribution=homebrew os-version=10.13.4
# solver            builtin-mccs+glpk
# install-criteria  -removed,-count[version-lag,request],-count[version-lag,changed],-changed
# upgrade-criteria  -removed,-count[version-lag,solution],-new
# jobs              4
# repositories      2 (http) (default repo at 27ae4ff1)
# pinned            1 (git)
# current-switch    4.07.0

Perhaps this is the expected behavior, but perhaps not. I expected that opam init --disable-sandboxing would update ~/.opam/config to remove the lines:

wrap-build-commands:
  ["%{hooks}%/sandbox.sh" "build"] {os = "linux" | os = "macos"}
wrap-install-commands:
  ["%{hooks}%/sandbox.sh" "install"] {os = "linux" | os = "macos"}
wrap-remove-commands:
  ["%{hooks}%/sandbox.sh" "remove"] {os = "linux" | os = "macos"}

[Isweet]

Ah, I missed the --reinit flag. But even with that flag, this behavior persists.

[AltGr]

This is indeed not supported at the moment. The documentation could be more explicit about it, but it does say that the effect of the option is to

Use a default configuration with sandboxing disabled

which indeed wouldn't affect an existing configuration.

[AltGr]

We could add heuristics to detect the sandboxing lines (e.g. scripts referred to as "%{hooks}%/sandbox.sh") and filter them out, but have been a bit reluctant to since it is highly discouraged to disable sandboxing (and the init won't put it in place if the required tools are not detected).

[Isweet]

Okay, thanks for confirming. I don't think this is pressing -- it is useful for now, to be able to install packages that you trust but haven't been updated to follow sandboxing best-practices.

It is likely this will only be less and less useful as packages are updated to support OPAM 2.

I agree that the right move is to not add this functionality.

[rjbou]

Doc updated with a note about the option --disable-sandboxing.