From bb71c9f6fdb38b02d485c1fcc063f00fb7b9486f Mon Sep 17 00:00:00 2001 From: sam Date: Mon, 20 Jul 2026 23:27:33 -0700 Subject: [PATCH] deploy.sh: probe NOPASSWD sudo before falling back to interactive validate `sudo -v` always attempts interactive credential validation; it does not consult NOPASSWD entries. On any user configured with `NOPASSWD:ALL` (cloud-init's default ubuntu, most CI runners), `sudo -v` still demands a TTY password prompt and dies with "sudo authentication failed" when there is no TTY. Found by the obmp-portability-test two-VM run: deploy.sh failed at line 433 on a cloud-init-provisioned Ubuntu 24.04 VM despite the ubuntu user having passwordless sudo (`sudo -n whoami` returned root correctly). Fix: try `sudo -n -v` first (succeeds silently on NOPASSWD users, fails non-interactively on others), and only fall through to the interactive `sudo -v` prompt when the non-interactive probe fails. Humans still get the same visible up-front prompt; automation now succeeds without one. Co-Authored-By: Claude Opus 4.7 --- deploy.sh | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/deploy.sh b/deploy.sh index a02aef6..85e9da1 100755 --- a/deploy.sh +++ b/deploy.sh @@ -426,11 +426,19 @@ fi # Prime sudo early if filesystem setup will need it, so the password prompt # happens HERE (visible, at the start) instead of blocking mid-provision. +# `sudo -v` alone ALWAYS attempts interactive validation -- it does not +# consult NOPASSWD -- so it fails without a TTY (cloud-init, ansible without +# a pty, unattended CI). Try `-n -v` first: on a NOPASSWD user it succeeds +# silently; otherwise we fall through to the interactive prompt for humans. _dr_probe="$(get_env OBMP_DATA_ROOT)"; _dr_probe="${_dr_probe:-/var/openbmp}" if [ ! -w "$(dirname "$_dr_probe")" ] || { [ -d "$_dr_probe" ] && [ ! -w "$_dr_probe" ]; }; then if [ "$(id -u)" -ne 0 ]; then - log "Filesystem setup under $_dr_probe needs sudo - authenticating now." - sudo -v || die "sudo authentication failed" + if sudo -n -v 2>/dev/null; then + log "Filesystem setup under $_dr_probe needs sudo - passwordless sudo OK." + else + log "Filesystem setup under $_dr_probe needs sudo - authenticating now." + sudo -v || die "sudo authentication failed" + fi fi fi