lager-cli 0.31.2__tar.gz → 0.31.3__tar.gz

{lager_cli-0.31.2/lager_cli.egg-info → lager_cli-0.31.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: lager-cli
-Version: 0.31.2
+Version: 0.31.3
 Summary: Lager CLI - Box and Docker connectivity
 Home-page: https://github.com/lagerdata/lager
 Author: Lager Data

{lager_cli-0.31.2 → lager_cli-0.31.3}/__init__.py

@@ -7,4 +7,4 @@ Lager CLI
 A Command Line Interface for Lager Data
 """
 
-__version__ = '0.31.2'
+__version__ = '0.31.3'

{lager_cli-0.31.2 → lager_cli-0.31.3}/commands/box/_host_ops.py

@@ -16,6 +16,7 @@ branch without a real box.
 
 from __future__ import annotations
 
+import re
 import shlex
 from dataclasses import dataclass
 from typing import Dict, List, Optional
@@ -39,45 +40,123 @@ _UDEV_HEADER = (
     "# Managed by `lager box config udev`; manual edits are overwritten on apply.\n"
 )
 
-UDEV_SUDOERS_BOOTSTRAP = (
-    "Applying user udev rules needs the passwordless-sudo udev grant that the "
-    "box setup script installs. If it's missing (older box), re-run the box "
-    "setup/deploy, or add it ONCE on the box:\n"
-    "\n"
-    "  sudo tee /etc/sudoers.d/lagerdata-udev >/dev/null <<'SUDOERS'\n"
-    "  lagerdata ALL=(ALL) NOPASSWD: /bin/cp /tmp/*.rules /etc/udev/rules.d/\n"
-    "  lagerdata ALL=(ALL) NOPASSWD: /bin/chmod 644 /etc/udev/rules.d/*.rules\n"
-    "  lagerdata ALL=(ALL) NOPASSWD: /usr/bin/udevadm control --reload-rules\n"
-    "  lagerdata ALL=(ALL) NOPASSWD: /usr/bin/udevadm trigger\n"
-    "  SUDOERS\n"
-    "  sudo chmod 440 /etc/sudoers.d/lagerdata-udev\n"
-    "\n"
-    "Then re-run `lager box config apply`."
-)
+# --- Box-config sudoers rule: single source of truth ------------------------
+#
+# `lager install` and `lager update` write this rule to BOXCFG_SUDOERS_PATH
+# so `lager box config apply` can run apt-get/sysctl/mkdir/chown over
+# BatchMode SSH. The rule must name the actual login user: it used to
+# hardcode `lagerdata`, so on boxes with a different user (e.g. the juultest
+# fleet) the grant never matched — install ended with "Sudoers file installed
+# but `sudo -n apt-get` still fails" and every apply needed manual setup.
+#
+# The username lands inside a root-owned sudoers file, so callers must gate
+# interpolation on is_valid_unix_username().
 
-SUDOERS_BOOTSTRAP = (
-    "Box-config apply needs passwordless sudo for a small set of commands. "
-    "Run this ONCE on the box (you'll be prompted for the sudo password "
-    "the one time):\n"
-    "\n"
-    "  printf '%s\\n' \\\n"
-    "    'lagerdata ALL=(root) NOPASSWD: SETENV: /usr/bin/apt-get' \\\n"
-    "    'lagerdata ALL=(root) NOPASSWD: /bin/mkdir, /bin/chown, "
-    "/usr/sbin/sysctl --system, /sbin/sysctl --system, "
-    "/usr/bin/tee /etc/sysctl.d/99-lager-box-config.conf, "
-    "/bin/rm -f /etc/sysctl.d/99-lager-box-config.conf, "
-    "/bin/cp /etc/lager/box_config.applied.json /etc/lager/box_config.json' \\\n"
-    "    | sudo tee /etc/sudoers.d/lager-box-config >/dev/null\n"
-    "  sudo chmod 440 /etc/sudoers.d/lager-box-config\n"
-    "  sudo touch /etc/lager/.boxcfg-sudoers-v2 && sudo chmod 644 /etc/lager/.boxcfg-sudoers-v2\n"
-    "\n"
-    "Then re-run `lager box config apply`. tee/rm/sysctl are path-scoped so a "
-    "compromised lagerdata account cannot escalate to root via them; apt-get "
-    "and mkdir/chown are unscoped because the package list and host paths are "
-    "user-defined. SETENV on apt-get is required so "
-    "`DEBIAN_FRONTEND=noninteractive` propagates and package postinst scripts "
-    "(iptables-persistent, etc.) don't prompt."
-)
+BOXCFG_SUDOERS_PATH = "/etc/sudoers.d/lager-box-config"
+BOXCFG_SUDOERS_MARKER = "/etc/lager/.boxcfg-sudoers-v2"
+
+# useradd's default charset plus uppercase and dots (both appear in real
+# deployments and are harmless in sudoers). Every allowed character is inert
+# inside the single-quoted rule strings and sudoers syntax; anything else
+# (spaces, quotes, $(), newlines, ...) is refused.
+_UNIX_USERNAME_RE = re.compile(r"[A-Za-z_][A-Za-z0-9_.-]*\$?")
+
+
+def is_valid_unix_username(user: Optional[str]) -> bool:
+    """True for plain unix usernames — the gate for interpolating a name
+    into sudoers content."""
+    return bool(user) and _UNIX_USERNAME_RE.fullmatch(user) is not None
+
+
+def boxcfg_sudoers_rules(user: str = "lagerdata") -> List[str]:
+    """The NOPASSWD rule lines for `lager box config apply`. tee/rm/sysctl
+    are path-scoped so a compromised account cannot escalate via them;
+    apt-get and mkdir/chown are unscoped because the package list and host
+    paths are user-defined. SETENV on apt-get is required so
+    DEBIAN_FRONTEND=noninteractive propagates and package postinst scripts
+    (iptables-persistent, etc.) don't prompt.
+
+    Raises ValueError on a non-plain username: callers validate first, so
+    this is a backstop that makes a future caller that forgets fail loudly
+    instead of interpolating into root-owned sudoers content."""
+    if not is_valid_unix_username(user):
+        raise ValueError(f"invalid unix username for sudoers rule: {user!r}")
+    return [
+        f"{user} ALL=(root) NOPASSWD: SETENV: /usr/bin/apt-get",
+        f"{user} ALL=(root) NOPASSWD: /bin/mkdir, /bin/chown, "
+        "/usr/sbin/sysctl --system, /sbin/sysctl --system, "
+        f"/usr/bin/tee {SYSCTL_CONF_PATH}, "
+        f"/bin/rm -f {SYSCTL_CONF_PATH}, "
+        "/bin/cp /etc/lager/box_config.applied.json /etc/lager/box_config.json",
+    ]
+
+
+def boxcfg_sudoers_bootstrap_cmd(user: str = "lagerdata") -> str:
+    """One shell command that installs the box-config sudoers rule plus the
+    versioned marker file. Used verbatim by `lager install` and
+    `lager update`; the manual snippet in sudoers_bootstrap() mirrors it."""
+    quoted_rules = " ".join(f"'{r}'" for r in boxcfg_sudoers_rules(user))
+    return (
+        f"printf '%s\\n' {quoted_rules} "
+        f"| sudo tee {BOXCFG_SUDOERS_PATH} >/dev/null "
+        f"&& sudo chmod 440 {BOXCFG_SUDOERS_PATH} "
+        f"&& sudo touch {BOXCFG_SUDOERS_MARKER} "
+        f"&& sudo chmod 644 {BOXCFG_SUDOERS_MARKER}"
+    )
+
+
+def udev_sudoers_bootstrap(user: str = "lagerdata") -> str:
+    """Manual-fix text for a box missing the udev sudoers grant."""
+    # Error-path text renderer: must never raise (it runs while composing a
+    # failure message). The user comes from local box storage unvalidated
+    # (resolve_box_user), so a non-plain name falls back to the historical
+    # default rather than being interpolated into a paste-into-root-shell
+    # snippet; the operator substitutes their real user.
+    if not is_valid_unix_username(user):
+        user = "lagerdata"
+    return (
+        "Applying user udev rules needs the passwordless-sudo udev grant that the "
+        "box setup script installs. If it's missing (older box), re-run the box "
+        "setup/deploy, or add it ONCE on the box:\n"
+        "\n"
+        "  sudo tee /etc/sudoers.d/lagerdata-udev >/dev/null <<'SUDOERS'\n"
+        f"  {user} ALL=(ALL) NOPASSWD: /bin/cp /tmp/*.rules /etc/udev/rules.d/\n"
+        f"  {user} ALL=(ALL) NOPASSWD: /bin/chmod 644 /etc/udev/rules.d/*.rules\n"
+        f"  {user} ALL=(ALL) NOPASSWD: /usr/bin/udevadm control --reload-rules\n"
+        f"  {user} ALL=(ALL) NOPASSWD: /usr/bin/udevadm trigger\n"
+        "  SUDOERS\n"
+        "  sudo chmod 440 /etc/sudoers.d/lagerdata-udev\n"
+        "\n"
+        "Then re-run `lager box config apply`."
+    )
+
+
+def sudoers_bootstrap(user: str = "lagerdata") -> str:
+    """Manual-fix text for a box missing the box-config sudoers grant."""
+    # Same never-raise rule as udev_sudoers_bootstrap: fall back before
+    # boxcfg_sudoers_rules so its ValueError backstop can't fire mid-error.
+    if not is_valid_unix_username(user):
+        user = "lagerdata"
+    rules = boxcfg_sudoers_rules(user)
+    return (
+        "Box-config apply needs passwordless sudo for a small set of commands. "
+        "Run this ONCE on the box (you'll be prompted for the sudo password "
+        "the one time):\n"
+        "\n"
+        "  printf '%s\\n' \\\n"
+        f"    '{rules[0]}' \\\n"
+        f"    '{rules[1]}' \\\n"
+        f"    | sudo tee {BOXCFG_SUDOERS_PATH} >/dev/null\n"
+        f"  sudo chmod 440 {BOXCFG_SUDOERS_PATH}\n"
+        f"  sudo touch {BOXCFG_SUDOERS_MARKER} && sudo chmod 644 {BOXCFG_SUDOERS_MARKER}\n"
+        "\n"
+        "Then re-run `lager box config apply`. tee/rm/sysctl are path-scoped so a "
+        f"compromised {user} account cannot escalate to root via them; apt-get "
+        "and mkdir/chown are unscoped because the package list and host paths are "
+        "user-defined. SETENV on apt-get is required so "
+        "`DEBIAN_FRONTEND=noninteractive` propagates and package postinst scripts "
+        "(iptables-persistent, etc.) don't prompt."
+    )
 
 _SUDO_BASE_TEXT = "passwordless sudo is not configured on the box for the apply commands."
 
@@ -95,9 +174,11 @@ def apt_install(
     packages: List[str],
     *,
     ssh_runner: Optional[SshRunner] = None,
+    user: str = "lagerdata",
 ) -> HostOpResult:
     """Install the given apt packages on the box host. Idempotent — apt
-    skips packages that are already at the requested version."""
+    skips packages that are already at the requested version. `user` only
+    names the login user in the manual-fix bootstrap text on failure."""
     if not packages:
         return HostOpResult(ok=True, action="noop", message="No apt packages configured.")
     runner = ssh_runner or default_ssh_runner
@@ -111,7 +192,7 @@ def apt_install(
         return HostOpResult(
             ok=False,
             action="failed",
-            message=_sudo_or_apt_error(stderr),
+            message=_sudo_or_apt_error(stderr, user),
             manual_fix=f"sudo apt-get install -y {quoted_pkgs}",
         )
     return HostOpResult(
@@ -127,10 +208,12 @@ def sysctl_apply(
     *,
     conf_path: str = SYSCTL_CONF_PATH,
     ssh_runner: Optional[SshRunner] = None,
+    user: str = "lagerdata",
 ) -> HostOpResult:
     """Write the sysctl conf and run `sysctl --system`. When `sysctl` is
     empty, removes the conf file so the previously-set keys revert to
     defaults on next reboot (and immediately, where the kernel allows it).
+    `user` only names the login user in the bootstrap text on failure.
     """
     runner = ssh_runner or default_ssh_runner
     quoted_path = shlex.quote(conf_path)
@@ -142,7 +225,7 @@ def sysctl_apply(
             return HostOpResult(
                 ok=False,
                 action="failed",
-                message=sudo_error_message(stderr, base_text=_SUDO_BASE_TEXT, bootstrap_text=SUDOERS_BOOTSTRAP),
+                message=sudo_error_message(stderr, base_text=_SUDO_BASE_TEXT, bootstrap_text=sudoers_bootstrap(user)),
                 manual_fix=f"sudo rm -f {quoted_path} && sudo sysctl --system",
             )
         return HostOpResult(ok=True, action="cleared", message=f"Removed {conf_path}.")
@@ -157,7 +240,7 @@ def sysctl_apply(
         return HostOpResult(
             ok=False,
             action="failed",
-            message=sudo_error_message(stderr, base_text=_SUDO_BASE_TEXT, bootstrap_text=SUDOERS_BOOTSTRAP),
+            message=sudo_error_message(stderr, base_text=_SUDO_BASE_TEXT, bootstrap_text=sudoers_bootstrap(user)),
             manual_fix=(
                 f"printf '%s' {shlex.quote(body)} | sudo tee {quoted_path} "
                 "&& sudo sysctl --system"
@@ -201,6 +284,7 @@ def udev_apply(
     rules: List[Dict[str, object]],
     *,
     ssh_runner: Optional[SshRunner] = None,
+    user: str = "lagerdata",
 ) -> HostOpResult:
     """Install the user udev rules file on the box host and reload udev.
 
@@ -230,7 +314,7 @@ def udev_apply(
             ok=False,
             action="failed",
             message=sudo_error_message(
-                stderr, base_text=_SUDO_BASE_TEXT, bootstrap_text=UDEV_SUDOERS_BOOTSTRAP
+                stderr, base_text=_SUDO_BASE_TEXT, bootstrap_text=udev_sudoers_bootstrap(user)
             ),
             manual_fix=(
                 f"printf '%s' {shlex.quote(body)} | sudo tee {quoted_path} >/dev/null "
@@ -249,13 +333,13 @@ def udev_apply(
     )
 
 
-def _sudo_or_apt_error(stderr: str) -> str:
+def _sudo_or_apt_error(stderr: str, user: str = "lagerdata") -> str:
     err = (stderr or "").strip()
     low = err.lower()
     if "a password is required" in low or low.startswith("sudo:"):
-        return sudo_error_message(stderr, base_text=_SUDO_BASE_TEXT, bootstrap_text=SUDOERS_BOOTSTRAP)
+        return sudo_error_message(stderr, base_text=_SUDO_BASE_TEXT, bootstrap_text=sudoers_bootstrap(user))
     if "unable to locate package" in low or "has no installation candidate" in low:
         # apt failed for a real reason — package name typo, missing repo, etc.
         # The bootstrap message would only confuse the user.
         return f"apt-get failed: {err}"
-    return sudo_error_message(stderr, base_text=_SUDO_BASE_TEXT, bootstrap_text=SUDOERS_BOOTSTRAP)
+    return sudo_error_message(stderr, base_text=_SUDO_BASE_TEXT, bootstrap_text=sudoers_bootstrap(user))

{lager_cli-0.31.2 → lager_cli-0.31.3}/commands/box/_mount_prep.py

@@ -25,6 +25,7 @@ import shlex
 from dataclasses import dataclass
 from typing import Optional
 
+from ._host_ops import is_valid_unix_username
 from ._ssh import SshRunner, default_ssh_runner, resolve_box_user, sudo_error_message
 
 CONTAINER_UID = 33
@@ -34,6 +35,11 @@ EXPECTED_OWNER = f"{CONTAINER_UID}:{CONTAINER_GID}"
 
 def sudoers_bootstrap(user: str = "lagerdata") -> str:
     """Copy-pasteable sudoers setup, scoped to the box's actual SSH user."""
+    # Error-path text renderer: never raise, never interpolate a non-plain
+    # username (it comes from local box storage unvalidated) into a
+    # paste-into-root-shell snippet. Same rule as _host_ops.sudoers_bootstrap.
+    if not is_valid_unix_username(user):
+        user = "lagerdata"
     return (
         "Auto-prep needs passwordless sudo for two specific commands. Run this "
         "ONCE on the box (you'll be prompted for the sudo password the one "

{lager_cli-0.31.2 → lager_cli-0.31.3}/commands/box/config.py

@@ -1360,7 +1360,7 @@ def _ensure_apt_packages(
         )
         return True
     click.echo(f"Installing apt packages on {resolved_box}: {', '.join(pkgs)}")
-    result = apt_install(resolved_box, list(pkgs))
+    result = apt_install(resolved_box, list(pkgs), user=resolve_box_user(resolved_box))
     if not result.ok:
         click.secho(f"apt install failed: {result.message}", fg="red", err=True)
         if result.manual_fix:
@@ -1386,7 +1386,7 @@ def _ensure_sysctl(
         click.echo(f"Applying {len(sysctl)} sysctl key(s) on {resolved_box}...")
     else:
         click.echo(f"Clearing sysctl conf on {resolved_box}...")
-    result = sysctl_apply(resolved_box, dict(sysctl))
+    result = sysctl_apply(resolved_box, dict(sysctl), user=resolve_box_user(resolved_box))
     if not result.ok:
         click.secho(f"sysctl apply failed: {result.message}", fg="red", err=True)
         if result.manual_fix:
@@ -1414,7 +1414,7 @@ def _ensure_udev_rules(
         click.echo(f"Installing {len(rules)} udev rule(s) on {resolved_box}...")
     else:
         click.echo(f"Clearing user udev rules on {resolved_box}...")
-    result = udev_apply(resolved_box, list(rules))
+    result = udev_apply(resolved_box, list(rules), user=resolve_box_user(resolved_box))
     if not result.ok:
         click.secho(f"udev apply failed: {result.message}", fg="red", err=True)
         if result.manual_fix:

{lager_cli-0.31.2 → lager_cli-0.31.3}/commands/box/dut.py

@@ -32,6 +32,7 @@ from typing import Any, Optional
 import click
 
 from .config import _resolve_box
+from ._host_ops import is_valid_unix_username
 from ._ssh import (
     default_ssh_runner,
     resolve_box_user,
@@ -56,19 +57,28 @@ _BENCH_SUDO_BASE = (
     "it directly."
 )
 
-_BENCH_SUDOERS_BOOTSTRAP = (
-    "This box is missing the bench.json sudo grant (older box, or not yet "
-    "re-provisioned). Re-provision with `lager update --box <BOX>` (or "
-    "`lager install`), or add it ONCE on the box:\n"
-    "\n"
-    "  sudo tee /etc/sudoers.d/lager-bench-json >/dev/null <<'SUDOERS'\n"
-    "  lagerdata ALL=(ALL) NOPASSWD: /bin/cp /tmp/lager-bench.json.tmp /etc/lager/bench.json\n"
-    "  lagerdata ALL=(ALL) NOPASSWD: /bin/chmod 644 /etc/lager/bench.json\n"
-    "  SUDOERS\n"
-    "  sudo chmod 440 /etc/sudoers.d/lager-bench-json\n"
-    "\n"
-    "Then re-run the command."
-)
+def _bench_sudoers_bootstrap(user: str = "lagerdata") -> str:
+    """Manual-fix text for a box missing the bench.json sudo grant. Names
+    the box's actual login user so the pasted rule matches it (a hardcoded
+    `lagerdata` never matched on e.g. juultest boxes)."""
+    # Error-path text renderer: never raise, never interpolate a non-plain
+    # username (it comes from local box storage unvalidated) into a
+    # paste-into-root-shell snippet. Same rule as _host_ops.sudoers_bootstrap.
+    if not is_valid_unix_username(user):
+        user = "lagerdata"
+    return (
+        "This box is missing the bench.json sudo grant (older box, or not yet "
+        "re-provisioned). Re-provision with `lager update --box <BOX>` (or "
+        "`lager install`), or add it ONCE on the box:\n"
+        "\n"
+        "  sudo tee /etc/sudoers.d/lager-bench-json >/dev/null <<'SUDOERS'\n"
+        f"  {user} ALL=(ALL) NOPASSWD: /bin/cp /tmp/lager-bench.json.tmp /etc/lager/bench.json\n"
+        f"  {user} ALL=(ALL) NOPASSWD: /bin/chmod 644 /etc/lager/bench.json\n"
+        "  SUDOERS\n"
+        "  sudo chmod 440 /etc/sudoers.d/lager-bench-json\n"
+        "\n"
+        "Then re-run the command."
+    )
 
 
 def _read_bench_json(box_ip: str) -> dict:
@@ -136,7 +146,7 @@ def _write_bench_json(box_ip: str, payload: dict) -> bool:
         msg = sudo_error_message(
             stderr,
             base_text=_BENCH_SUDO_BASE,
-            bootstrap_text=_BENCH_SUDOERS_BOOTSTRAP,
+            bootstrap_text=_bench_sudoers_bootstrap(resolve_box_user(box_ip)),
         )
         click.secho(f"Failed to write {_BENCH_JSON_PATH}: {msg}", fg="red", err=True)
         return False

{lager_cli-0.31.2 → lager_cli-0.31.3}/commands/utility/install.py

@@ -21,6 +21,7 @@ from ...box_storage import (
 )
 from ...core.ssh_utils import host_in_known_hosts
 from ...errors import ssh_error, LagerError
+from ..box._host_ops import boxcfg_sudoers_bootstrap_cmd, is_valid_unix_username
 
 
 def get_script_path(script_name: str, subdir: str = "scripts") -> Path:
@@ -461,10 +462,11 @@ def install(ctx, box, ip, user, version, skip_jlink, skip_firewall, skip_verify,
     # `lager box config apply` needs root on the host for apt-get install,
     # sysctl writes, and mount-path mkdir/chown. Those run over SSH in a
     # non-interactive context (no TTY for sudo to prompt against), so the
-    # rule must grant NOPASSWD up front. The rule is narrowly scoped:
-    # tee/rm/sysctl are path-locked to the exact files used so the
-    # lagerdata account can't escalate via them; apt-get and mkdir/chown
-    # are unscoped because the package list and host paths are user-defined.
+    # rule must grant NOPASSWD up front. The rule content lives in
+    # _host_ops.boxcfg_sudoers_rules — it must name the actual login user
+    # (it previously hardcoded `lagerdata`, so on boxes with a different
+    # user, e.g. the juultest fleet, the grant never matched and the verify
+    # below always warned "sudo -n apt-get still fails").
     #
     # Idempotent: re-running install overwrites the file with the same
     # content. Failure here is a warning, not fatal — the box is otherwise
@@ -474,58 +476,81 @@ def install(ctx, box, ip, user, version, skip_jlink, skip_firewall, skip_verify,
     click.echo("(One-time setup. You'll be prompted for the sudo password on the box.)")
     click.echo()
 
-    sudoers_cmd = (
-        "printf '%s\\n' "
-        "'lagerdata ALL=(root) NOPASSWD: SETENV: /usr/bin/apt-get' "
-        "'lagerdata ALL=(root) NOPASSWD: /bin/mkdir, /bin/chown, "
-        "/usr/sbin/sysctl --system, /sbin/sysctl --system, "
-        "/usr/bin/tee /etc/sysctl.d/99-lager-box-config.conf, "
-        "/bin/rm -f /etc/sysctl.d/99-lager-box-config.conf, "
-        "/bin/cp /etc/lager/box_config.applied.json /etc/lager/box_config.json' "
-        "| sudo tee /etc/sudoers.d/lager-box-config >/dev/null "
-        "&& sudo chmod 440 /etc/sudoers.d/lager-box-config "
-        "&& sudo touch /etc/lager/.boxcfg-sudoers-v2 "
-        "&& sudo chmod 644 /etc/lager/.boxcfg-sudoers-v2"
-    )
-
-    try:
-        bootstrap_result = subprocess.run(
-            ["ssh", "-t", ssh_host, sudoers_cmd],
-            timeout=120,
+    if not is_valid_unix_username(user):
+        # The username lands inside a root-owned sudoers file; refuse to
+        # interpolate anything that isn't a plain unix username.
+        click.secho(
+            f"Warning: username {user!r} is not a plain unix username; skipping the "
+            "passwordless-sudo bootstrap. `lager box config apply` will require "
+            "manual sudoers setup on this box. See `lager box config apply --help` "
+            "for the snippet to paste.",
+            fg='yellow', err=True,
         )
-        if bootstrap_result.returncode != 0:
-            click.secho(
-                "Warning: Sudoers rule could not be installed. `lager box config apply` "
-                "will require manual sudoers setup on this box. See `lager box config "
-                "apply --help` for the snippet to paste.",
-                fg='yellow', err=True,
-            )
-        else:
-            # Verify: marker file written by the bootstrap above (means the
-            # current rule shape was installed) + functional apt-get probe
-            # (means the NOPASSWD/SETENV grant is live). Marker name carries
-            # a version suffix so older boxes upgrading to a future rule
-            # shape re-bootstrap automatically.
-            verify_result = subprocess.run(
+    else:
+        # Skip the bootstrap (and its sudo password prompt) when the grant is
+        # already live — marker file present AND `sudo -n apt-get` actually
+        # works as this user, the same functional probe `lager update` uses.
+        # Re-installs then never prompt here at all. This matters because the
+        # prompt lands at the very end of a long install, when the operator
+        # may have stepped away.
+        try:
+            precheck = subprocess.run(
                 ["ssh", "-o", "BatchMode=yes", ssh_host,
                  "test -f /etc/lager/.boxcfg-sudoers-v2 "
                  "&& sudo -n DEBIAN_FRONTEND=noninteractive apt-get --version >/dev/null 2>&1"],
                 capture_output=True, timeout=15,
             )
-            if verify_result.returncode == 0:
-                click.secho("Passwordless sudo for `lager box config` configured", fg='green')
-            else:
+            already_configured = precheck.returncode == 0
+        except Exception:
+            already_configured = False
+
+        if already_configured:
+            click.secho("Passwordless sudo for `lager box config` already configured", fg='green')
+        else:
+            sudoers_cmd = boxcfg_sudoers_bootstrap_cmd(user)
+
+            try:
+                # Interactive: waits on a human typing the box's sudo password
+                # at the end of a long install. A 120s timeout here killed the
+                # bootstrap mid-prompt for a slow (or absent) operator, so give
+                # them 10 minutes; the timeout only guards a genuine hang.
+                bootstrap_result = subprocess.run(
+                    ["ssh", "-t", ssh_host, sudoers_cmd],
+                    timeout=600,
+                )
+                if bootstrap_result.returncode != 0:
+                    click.secho(
+                        "Warning: Sudoers rule could not be installed. `lager box config apply` "
+                        "will require manual sudoers setup on this box. See `lager box config "
+                        "apply --help` for the snippet to paste.",
+                        fg='yellow', err=True,
+                    )
+                else:
+                    # Verify: marker file written by the bootstrap above (means the
+                    # current rule shape was installed) + functional apt-get probe
+                    # (means the NOPASSWD/SETENV grant is live). Marker name carries
+                    # a version suffix so older boxes upgrading to a future rule
+                    # shape re-bootstrap automatically.
+                    verify_result = subprocess.run(
+                        ["ssh", "-o", "BatchMode=yes", ssh_host,
+                         "test -f /etc/lager/.boxcfg-sudoers-v2 "
+                         "&& sudo -n DEBIAN_FRONTEND=noninteractive apt-get --version >/dev/null 2>&1"],
+                        capture_output=True, timeout=15,
+                    )
+                    if verify_result.returncode == 0:
+                        click.secho("Passwordless sudo for `lager box config` configured", fg='green')
+                    else:
+                        click.secho(
+                            "Warning: Sudoers file installed but `sudo -n apt-get` still fails. "
+                            "Check /etc/sudoers.d/lager-box-config on the box for syntax issues.",
+                            fg='yellow', err=True,
+                        )
+            except (subprocess.TimeoutExpired, Exception) as e:
                 click.secho(
-                    "Warning: Sudoers file installed but `sudo -n apt-get` still fails. "
-                    "Check /etc/sudoers.d/lager-box-config on the box for syntax issues.",
+                    f"Warning: Sudoers bootstrap failed: {e}. `lager box config apply` "
+                    "will require manual sudoers setup.",
                     fg='yellow', err=True,
                 )
-    except (subprocess.TimeoutExpired, Exception) as e:
-        click.secho(
-            f"Warning: Sudoers bootstrap failed: {e}. `lager box config apply` "
-            "will require manual sudoers setup.",
-            fg='yellow', err=True,
-        )
 
     click.echo()
 

{lager_cli-0.31.2 → lager_cli-0.31.3}/commands/utility/update.py

@@ -25,6 +25,7 @@ from ...box_storage import (
 )
 from ...context import get_default_box
 from ...core.ssh_utils import get_ssh_connection_pool
+from ..box._host_ops import boxcfg_sudoers_bootstrap_cmd, is_valid_unix_username
 from ..box._ssh import ensure_lager_box_keypair, key_auth_works
 from ...errors import LagerError
 
@@ -1445,33 +1446,35 @@ def _update_logic(ctx, *, box, yes, version, verbose, check, force=False):
     #
     # `lager box config apply` needs root on the host for apt-get install,
     # sysctl writes, and mount-path mkdir/chown — all over BatchMode SSH
-    # where sudo can't prompt. The rule grants narrow NOPASSWD for exactly
-    # those operations. The probe ran the functional check (marker file
-    # present + `sudo -n apt-get` actually works), so we only bootstrap when
-    # it came back negative. Runs on every update so existing boxes
-    # gradually pick up the rule; idempotent.
+    # where sudo can't prompt. The rule (built in
+    # _host_ops.boxcfg_sudoers_bootstrap_cmd) grants narrow NOPASSWD for
+    # exactly those operations, and must name the actual login user — it
+    # previously hardcoded `lagerdata`, so on boxes with a different user
+    # (e.g. the juultest fleet) the grant never matched. The probe ran the
+    # functional check (marker file present + `sudo -n apt-get` actually
+    # works) as that user, so wrong-user boxes come back negative and
+    # re-bootstrap here with the corrected rule. Runs on every update so
+    # existing boxes gradually pick up the rule; idempotent.
     if progress:
         progress.update("Checking box-config sudoers...")
     log('Checking box-config sudoers...', nl=False)
 
     if facts.get('BOXCFG_SUDOERS_OK') == '1':
         log_status('OK', 'green')
+    elif not is_valid_unix_username(username):
+        # The username lands inside a root-owned sudoers file; refuse to
+        # interpolate anything that isn't a plain unix username.
+        log_status('SKIPPED (unusual username)', 'yellow')
+        if verbose:
+            click.echo(
+                f'  Username {username!r} is not a plain unix username; '
+                '`lager box config apply` will need manual sudoers setup.',
+                err=True,
+            )
     else:
         log_status('needs bootstrap', 'yellow')
 
-        boxcfg_sudoers_cmd = (
-            "printf '%s\\n' "
-            "'lagerdata ALL=(root) NOPASSWD: SETENV: /usr/bin/apt-get' "
-            "'lagerdata ALL=(root) NOPASSWD: /bin/mkdir, /bin/chown, "
-            "/usr/sbin/sysctl --system, /sbin/sysctl --system, "
-            "/usr/bin/tee /etc/sysctl.d/99-lager-box-config.conf, "
-            "/bin/rm -f /etc/sysctl.d/99-lager-box-config.conf, "
-            "/bin/cp /etc/lager/box_config.applied.json /etc/lager/box_config.json' "
-            "| sudo tee /etc/sudoers.d/lager-box-config >/dev/null "
-            "&& sudo chmod 440 /etc/sudoers.d/lager-box-config "
-            "&& sudo touch /etc/lager/.boxcfg-sudoers-v2 "
-            "&& sudo chmod 644 /etc/lager/.boxcfg-sudoers-v2"
-        )
+        boxcfg_sudoers_cmd = boxcfg_sudoers_bootstrap_cmd(username)
 
         def _render_boxcfg(ok):
             log('Installing box-config sudoers...', nl=False)
@@ -1530,7 +1533,10 @@ def _update_logic(ctx, *, box, yes, version, verbose, check, force=False):
         elif verbose:
             click.echo()
 
-        run_ssh_command_interactive(combined_priv_cmd, allow_sudo_prompt=True)
+        # 600s, not the 300s default: this session waits on a human typing the
+        # sudo password late in the run, when the operator may have stepped
+        # away — the timeout should only guard a genuine hang.
+        run_ssh_command_interactive(combined_priv_cmd, timeout_secs=600, allow_sudo_prompt=True)
 
         if not verbose and progress:
             progress.resume()