fix(install): probe sudo capability instead of guessing from sudoers filename#3129
Merged
Conversation
…filename - run_ansible_playbook only skipped --ask-become-pass when /etc/sudoers.d/010_<user>-nopasswd existed, our own convention file - stock Raspberry Pi OS grants the first user NOPASSWD via 010_pi-nopasswd (fixed name), so the check misfired and Ansible prompted for a password; unattended installs hang forever at "BECOME password:" - probe with sudo -K + sudo -n true: -K drops cached credentials so a password typed for an earlier apt call can't fake passwordless sudo and kill the playbook mid-run once the timestamp expires Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issues Fixed
Unattended/headless installs hang forever at
BECOME password:on stock Raspberry Pi OS:run_ansible_playbookdecides whether Ansible needs--ask-become-passby checking for the installer's own convention file (/etc/sudoers.d/010_<user>-nopasswd), but Raspberry Pi OS grants the first user passwordless sudo via010_pi-nopasswd— a fixed filename whatever the username — so the check misfires and Ansible prompts for a password that is never needed.Description
Replace the filename check with a capability probe:
sudo -Kfollowed bysudo -n true. The-Kmatters — without it, a password typed for an earlierapt-getcall leaves a cached credential that makessudo -nsucceed, the prompt is skipped, and the playbook then dies mid-run with "Missing sudo password" once the sudo timestamp expires.Verified:
010_<user>-nopasswdfile): noBECOME password:prompt appeared, playbook completedok=59 failed=0, all containers healthy after reboot. The unfixed installer on the identical setup hangs at the prompt.--ask-become-passskipped.-Kthe probe wrongly passes; with-Kit correctly falls back to--ask-become-pass.Checklist
🤖 Generated with Claude Code