PyPI - runspec-linux-root - Versions diffs - 0.1.0__tar.gz → 0.2.0__tar.gz - Mend

runspec-linux-root 0.1.0tar.gz → 0.2.0tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (20) hide show

{runspec_linux_root-0.1.0 → runspec_linux_root-0.2.0}/.gitignore RENAMED Viewed

@@ -25,6 +25,8 @@ coverage.xml
 # Node
 node_modules/
 dist/
+# runspec manifest output (written at npm pack time)
+runspec-files.json
 *.js.map
 .npm
@@ -59,3 +61,6 @@ chainlit-docs/
 # Stray committed test venv (removed from tracking)
 .venv-test/
+# Private gitleaks rules (see .gitleaks.toml)
+.gitleaks.local.toml

runspec_linux_root-0.2.0/CHANGELOG.md ADDED Viewed

@@ -0,0 +1,54 @@
+# Changelog
+All notable changes to `runspec-linux-root` are documented here.
+## [0.2.0] — 2026-11-07
+### Added
+- **`package-repo`** (`list` / `add` / `remove`): add a vendor's package
+  repository and its signing key without a shell, the way install guides like
+  Grafana Alloy's do it. One call takes the apt pair (`--apt-url`,
+  `--apt-key`, `--apt-suite`, `--apt-components`) and the rpm pair
+  (`--rpm-url`, `--rpm-key`, for dnf, yum and zypper); each host uses its own,
+  so one call covers a mixed group of hosts. apt keys go to
+  `/etc/apt/keyrings/<name>.asc` with `signed-by=`; rpm keys to
+  `/etc/pki/rpm-gpg/` plus `rpm --import`, with `gpgcheck=1` and
+  `repo_gpgcheck=1` (`--unsigned-metadata` turns the second off). The output
+  lists every key's fingerprint, `--key-fingerprint` refuses a key file
+  holding a key you didn't list, and an `http://` key needs one. `add`
+  refreshes just that repository and undoes everything if the refresh fails;
+  running it again with the same values changes nothing. `--replace`
+  overwrites a same-named repository set up by hand; `--proxy` and
+  `--ca-bundle` apply to the key download. `list` is autonomous, `add` and
+  `remove` need approval. pacman hosts are refused.
+- **`system-service`** (`start` / `stop` / `restart` / `reload` / `enable` /
+  `disable`, `--now` with enable/disable): systemd service control as root,
+  for system services such as `alloy` (runspec-linux's `restart-service` never
+  runs as root). A failure includes the unit's last journal lines.
+- Needs `runspec-linux-core >= 0.15.0`.
+## [0.1.1] — 2026-10-01
+- `enable-passwordless-sudo --scope scoped`: the help text and README now say
+  the scoped grant also covers runspec-console and MCP-gateway runs, from
+  runspec 0.70.0 (their env prelude runs on the venv's `bin/python`).
+  `--scope all` is no longer needed for those. No code change.
+## [0.1.0] — 2026-09-30
+First release. The Linux tools that need root, split out of `runspec-linux`
+(0.19.0) so that package never runs anything as root:
+`list-upgrades`, `upgrade-packages`, `install-package`, `remove-package`,
+`autoremove-packages`, `set-sysctl`, `reboot-host` and
+`enable-passwordless-sudo`.
+- Every tool declares `run_as = "root"` (except `enable-passwordless-sudo`,
+  which runs as the invoker and escalates with the password it's given).
+  `set-sysctl` loses its `--run-as`/`--sudo`/`--become-method` args: it always
+  runs as root.
+- Meant for a root-owned venv, so only root can change code that root runs.
+- `enable-passwordless-sudo`'s `scoped` option is documented honestly: it covers
+  direct `sudo <tool>` runs only, not runs from runspec-console or the MCP
+  gateway.
+- The helpers stay in `runspec-linux-core` (>= 0.13.0).

runspec_linux_root-0.2.0/PKG-INFO ADDED Viewed

@@ -0,0 +1,130 @@
+Metadata-Version: 2.5
+Name: runspec-linux-root
+Version: 0.2.0
+Summary: Linux admin runnables that need root (packages, package repositories, services, reboot, sysctl) for runspec
+Project-URL: Documentation, https://runspec.app/
+Project-URL: Source, https://github.com/runspec-app/runspec/tree/main/packages/python/runspec-linux-root
+Project-URL: Changelog, https://github.com/runspec-app/runspec/blob/main/packages/python/runspec-linux-root/CHANGELOG.md
+Project-URL: Issues, https://github.com/runspec-app/runspec/issues
+Keywords: linux,packages,root,runnable,runspec,sysadmin
+Requires-Python: >=3.10
+Requires-Dist: runspec-linux-core>=0.15.0
+Requires-Dist: runspec>=0.68.0
+Provides-Extra: dev
+Requires-Dist: mypy; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff==0.15.20; extra == 'dev'
+Description-Content-Type: text/markdown
+# runspec-linux-root
+Linux admin tools that need **root**, as [runspec](https://runspec.app/) runnables:
+| Tool | What it does | Autonomy |
+|---|---|---|
+| `list-upgrades` | List packages with an available upgrade (refreshes the index) | autonomous |
+| `upgrade-packages` | Refresh the index and upgrade every package | confirm |
+| `install-package` | Install packages by name | confirm |
+| `remove-package` | Remove packages (`--purge` for config files too) | confirm |
+| `autoremove-packages` | Remove packages nothing depends on (`--dry-run` to preview) | confirm |
+| `package-repo list` | List the package repositories configured on the host | autonomous |
+| `package-repo add` | Add or update a repository and its signing key, then refresh it (undone if that fails) | confirm |
+| `package-repo remove` | Remove a repository and its key file | confirm |
+| `system-service <action>` | `start`, `stop`, `restart`, `reload`, `enable` or `disable` a systemd service (`--now` with enable/disable) | confirm |
+| `set-sysctl` | Set a kernel parameter, optionally persisted under `/etc/sysctl.d` | confirm |
+| `reboot-host` | Reboot, optionally after a delay | confirm |
+| `enable-passwordless-sudo` | One-time bootstrap: a validated `/etc/sudoers.d` drop-in | confirm |
+They work across apt, dnf, yum, zypper and pacman (`package-repo`: all but pacman). The logic lives in
+[`runspec-linux-core`](https://pypi.org/project/runspec-linux-core/). The
+everyday tools that never need root are in
+[`runspec-linux`](https://pypi.org/project/runspec-linux/).
+## Install into a root-owned venv
+Every tool here declares `run_as = "root"`: root runs this code. So install it
+into a venv **only root can change**. A venv owned by a service account would
+let that account edit code root later runs.
+```bash
+sudo python3 -m venv /opt/venvs/admin
+sudo /opt/venvs/admin/bin/pip install runspec-linux-root
+```
+## Who can run them
+sudoers decides. An admin runs a tool with sudo:
+```bash
+sudo /opt/venvs/admin/bin/upgrade-packages
+```
+runspec checks the process really is root (`enforce_run_as`) and refuses
+otherwise, naming the account to `sudo -u` to.
+**From runspec-console or the MCP gateway**, the tool is run with `sudo -n`,
+which never prompts for a password, so the admin needs a passwordless sudo rule.
+`enable-passwordless-sudo` installs one:
+- `--scope scoped` allows only the programs in this venv's `bin/`. That covers
+  direct runs (`sudo /opt/venvs/admin/bin/<tool>` from a shell or cron) and,
+  with runspec-console / runspec-mcp built on runspec ≥ 0.70.0, console and
+  gateway runs too. Those pass variables to the tool on stdin through a small
+  prelude that runs on the venv's own `bin/python`, which the scoped rule covers.
+  (Before runspec 0.70.0 the prelude ran on `sh`, which the scoped rule doesn't
+  cover, so console runs that carried variables needed `--scope all`.)
+- `--scope all` grants `NOPASSWD: ALL`.
+## Adding a package repository
+Vendor install guides (Grafana Alloy, Docker, PostgreSQL, ...) start with "add
+our key and repository". `package-repo add` does that without a shell:
+```bash
+package-repo add grafana \
+  --apt-url https://apt.grafana.com --apt-key https://apt.grafana.com/gpg-full.key \
+  --rpm-url https://rpm.grafana.com --rpm-key https://rpm.grafana.com/gpg.key
+install-package alloy
+system-service enable alloy --now
+```
+- One call carries the **apt** pair and the **rpm** pair (dnf, yum and zypper).
+  Each host uses the pair for its own package manager, so the same call works
+  on every host in a mixed group. A missing pair is an error naming it.
+- **apt**: the key goes to `/etc/apt/keyrings/<name>.asc` and
+  `/etc/apt/sources.list.d/<name>.list` names it with `signed-by=`, so the key
+  is trusted for that repository only. `--apt-suite` (default `stable`) and
+  `--apt-components` (default `main`) fill in the rest of the `deb` line.
+- **dnf / yum / zypper**: the key goes to `/etc/pki/rpm-gpg/RPM-GPG-KEY-<name>`
+  and is imported with `rpm --import`; `/etc/yum.repos.d/<name>.repo` (or
+  `/etc/zypp/repos.d/`) has `gpgcheck=1`, `repo_gpgcheck=1` and
+  `gpgkey=file://` pointing at that file. `--unsigned-metadata` sets
+  `repo_gpgcheck=0` for a repository whose metadata isn't signed.
+- **The key** is an `https://` URL or a file already on the host (`http://`
+  only with `--key-fingerprint`). The output lists every key's fingerprint.
+  `--key-fingerprint` (repeat it, or separate with commas) refuses a key file
+  holding any key you didn't list. Check them with the vendor first. A key file
+  can hold several keys: Grafana's apt file has three.
+- **Then it refreshes just that repository.** If the refresh fails (wrong key,
+  bad URL) the files are put back and newly imported rpm keys removed, so a
+  host is never left with a repository that breaks `apt-get update`. On
+  dnf/yum, a new key also clears dnf's cached copy of the old one, so the
+  refresh really checks it.
+- **Running it again** with the same values changes nothing (no refresh). A
+  same-named file it didn't write (one you set up by hand) needs `--replace`.
+  On apt, the same URL in another file is refused: apt won't accept one
+  repository with two keys. Remove the old one first.
+- The key download uses the proxy environment variables, or `--proxy`, and
+  `--ca-bundle` for a private CA. The package manager uses its own proxy
+  settings.
+`package-repo remove <name>` deletes the repository file and its key file
+(unless another repository uses that key), including one set up by hand
+following the vendor's guide. Keys already in the rpm database stay.
+## Across a group of hosts
+From runspec-console, ask the agent to run it with a **host group** as the
+target: it runs on every host in the group behind one approval, and each host
+picks its own apt or rpm details. A saved runbook can hold the whole sequence
+(add the repository, `install-package`, then `system-service enable --now`).

runspec_linux_root-0.2.0/README.md ADDED Viewed

@@ -0,0 +1,112 @@
+# runspec-linux-root
+Linux admin tools that need **root**, as [runspec](https://runspec.app/) runnables:
+| Tool | What it does | Autonomy |
+|---|---|---|
+| `list-upgrades` | List packages with an available upgrade (refreshes the index) | autonomous |
+| `upgrade-packages` | Refresh the index and upgrade every package | confirm |
+| `install-package` | Install packages by name | confirm |
+| `remove-package` | Remove packages (`--purge` for config files too) | confirm |
+| `autoremove-packages` | Remove packages nothing depends on (`--dry-run` to preview) | confirm |
+| `package-repo list` | List the package repositories configured on the host | autonomous |
+| `package-repo add` | Add or update a repository and its signing key, then refresh it (undone if that fails) | confirm |
+| `package-repo remove` | Remove a repository and its key file | confirm |
+| `system-service <action>` | `start`, `stop`, `restart`, `reload`, `enable` or `disable` a systemd service (`--now` with enable/disable) | confirm |
+| `set-sysctl` | Set a kernel parameter, optionally persisted under `/etc/sysctl.d` | confirm |
+| `reboot-host` | Reboot, optionally after a delay | confirm |
+| `enable-passwordless-sudo` | One-time bootstrap: a validated `/etc/sudoers.d` drop-in | confirm |
+They work across apt, dnf, yum, zypper and pacman (`package-repo`: all but pacman). The logic lives in
+[`runspec-linux-core`](https://pypi.org/project/runspec-linux-core/). The
+everyday tools that never need root are in
+[`runspec-linux`](https://pypi.org/project/runspec-linux/).
+## Install into a root-owned venv
+Every tool here declares `run_as = "root"`: root runs this code. So install it
+into a venv **only root can change**. A venv owned by a service account would
+let that account edit code root later runs.
+```bash
+sudo python3 -m venv /opt/venvs/admin
+sudo /opt/venvs/admin/bin/pip install runspec-linux-root
+```
+## Who can run them
+sudoers decides. An admin runs a tool with sudo:
+```bash
+sudo /opt/venvs/admin/bin/upgrade-packages
+```
+runspec checks the process really is root (`enforce_run_as`) and refuses
+otherwise, naming the account to `sudo -u` to.
+**From runspec-console or the MCP gateway**, the tool is run with `sudo -n`,
+which never prompts for a password, so the admin needs a passwordless sudo rule.
+`enable-passwordless-sudo` installs one:
+- `--scope scoped` allows only the programs in this venv's `bin/`. That covers
+  direct runs (`sudo /opt/venvs/admin/bin/<tool>` from a shell or cron) and,
+  with runspec-console / runspec-mcp built on runspec ≥ 0.70.0, console and
+  gateway runs too. Those pass variables to the tool on stdin through a small
+  prelude that runs on the venv's own `bin/python`, which the scoped rule covers.
+  (Before runspec 0.70.0 the prelude ran on `sh`, which the scoped rule doesn't
+  cover, so console runs that carried variables needed `--scope all`.)
+- `--scope all` grants `NOPASSWD: ALL`.
+## Adding a package repository
+Vendor install guides (Grafana Alloy, Docker, PostgreSQL, ...) start with "add
+our key and repository". `package-repo add` does that without a shell:
+```bash
+package-repo add grafana \
+  --apt-url https://apt.grafana.com --apt-key https://apt.grafana.com/gpg-full.key \
+  --rpm-url https://rpm.grafana.com --rpm-key https://rpm.grafana.com/gpg.key
+install-package alloy
+system-service enable alloy --now
+```
+- One call carries the **apt** pair and the **rpm** pair (dnf, yum and zypper).
+  Each host uses the pair for its own package manager, so the same call works
+  on every host in a mixed group. A missing pair is an error naming it.
+- **apt**: the key goes to `/etc/apt/keyrings/<name>.asc` and
+  `/etc/apt/sources.list.d/<name>.list` names it with `signed-by=`, so the key
+  is trusted for that repository only. `--apt-suite` (default `stable`) and
+  `--apt-components` (default `main`) fill in the rest of the `deb` line.
+- **dnf / yum / zypper**: the key goes to `/etc/pki/rpm-gpg/RPM-GPG-KEY-<name>`
+  and is imported with `rpm --import`; `/etc/yum.repos.d/<name>.repo` (or
+  `/etc/zypp/repos.d/`) has `gpgcheck=1`, `repo_gpgcheck=1` and
+  `gpgkey=file://` pointing at that file. `--unsigned-metadata` sets
+  `repo_gpgcheck=0` for a repository whose metadata isn't signed.
+- **The key** is an `https://` URL or a file already on the host (`http://`
+  only with `--key-fingerprint`). The output lists every key's fingerprint.
+  `--key-fingerprint` (repeat it, or separate with commas) refuses a key file
+  holding any key you didn't list. Check them with the vendor first. A key file
+  can hold several keys: Grafana's apt file has three.
+- **Then it refreshes just that repository.** If the refresh fails (wrong key,
+  bad URL) the files are put back and newly imported rpm keys removed, so a
+  host is never left with a repository that breaks `apt-get update`. On
+  dnf/yum, a new key also clears dnf's cached copy of the old one, so the
+  refresh really checks it.
+- **Running it again** with the same values changes nothing (no refresh). A
+  same-named file it didn't write (one you set up by hand) needs `--replace`.
+  On apt, the same URL in another file is refused: apt won't accept one
+  repository with two keys. Remove the old one first.
+- The key download uses the proxy environment variables, or `--proxy`, and
+  `--ca-bundle` for a private CA. The package manager uses its own proxy
+  settings.
+`package-repo remove <name>` deletes the repository file and its key file
+(unless another repository uses that key), including one set up by hand
+following the vendor's guide. Keys already in the rpm database stay.
+## Across a group of hosts
+From runspec-console, ask the agent to run it with a **host group** as the
+target: it runs on every host in the group behind one approval, and each host
+picks its own apt or rpm details. A saved runbook can hold the whole sequence
+(add the repository, `install-package`, then `system-service enable --now`).

{runspec_linux_root-0.1.0 → runspec_linux_root-0.2.0}/pyproject.toml RENAMED Viewed

@@ -4,21 +4,21 @@ build-backend = "hatchling.build"
 [project]
 name = "runspec-linux-root"
-version = "0.1.0"
+version = "0.2.0"
 requires-python = ">=3.10"
-description = "Linux admin runnables that need root (packages, reboot, sysctl) for runspec"
+description = "Linux admin runnables that need root (packages, package repositories, services, reboot, sysctl) for runspec"
 readme = "README.md"
 keywords = ["runspec", "runnable", "linux", "sysadmin", "root", "packages"]
 dependencies = [
     "runspec>=0.68.0",
-    "runspec-linux-core>=0.13.0",
+    "runspec-linux-core>=0.15.0",
 ]
 [project.urls]
 Documentation = "https://runspec.app/"
-Source        = "https://github.com/jasonfinestone/runspec/tree/main/packages/python/runspec-linux-root"
-Changelog     = "https://github.com/jasonfinestone/runspec/blob/main/packages/python/runspec-linux-root/CHANGELOG.md"
-Issues        = "https://github.com/jasonfinestone/runspec/issues"
+Source        = "https://github.com/runspec-app/runspec/tree/main/packages/python/runspec-linux-root"
+Changelog     = "https://github.com/runspec-app/runspec/blob/main/packages/python/runspec-linux-root/CHANGELOG.md"
+Issues        = "https://github.com/runspec-app/runspec/issues"
 [project.scripts]
 list-upgrades       = "runspec_linux_root.packages:main_list_upgrades"
@@ -26,6 +26,8 @@ upgrade-packages    = "runspec_linux_root.packages:main_upgrade_packages"
 install-package     = "runspec_linux_root.packages:main_install_package"
 remove-package      = "runspec_linux_root.packages:main_remove_package"
 autoremove-packages = "runspec_linux_root.packages:main_autoremove_packages"
+package-repo        = "runspec_linux_root.repos:main"
+system-service      = "runspec_linux_root.services:main"
 set-sysctl          = "runspec_linux_root.perf:main_set_sysctl"
 reboot-host         = "runspec_linux_root.power:main_reboot_host"
 enable-passwordless-sudo = "runspec_linux_root.sudoers:main_enable_passwordless_sudo"

runspec_linux_root-0.2.0/runspec_linux_root/repos.py ADDED Viewed

@@ -0,0 +1,55 @@
+"""``package-repo``: list, add and remove package repositories (apt, dnf/yum, zypper)."""
+from __future__ import annotations
+import json
+import sys
+from typing import Any
+import runspec as rs
+from runspec_linux_core.errors import LinuxCoreError
+from runspec_linux_core.repos import add_repo, list_repos, remove_repo
+def _emit(payload: dict[str, Any]) -> None:
+    print(json.dumps(payload, default=str))
+def _run(spec: rs.RunSpec) -> dict[str, Any]:
+    command = spec.runspec_command
+    if command == "list":
+        return list_repos(spec.filter.value or None)
+    if command == "add":
+        return add_repo(
+            spec.name.value,
+            apt_url=spec.apt_url.value or None,
+            apt_key=spec.apt_key.value or None,
+            apt_suite=spec.apt_suite.value,
+            apt_components=spec.apt_components.value,
+            rpm_url=spec.rpm_url.value or None,
+            rpm_key=spec.rpm_key.value or None,
+            key_fingerprints=list(spec.key_fingerprint.value or []),
+            signed_metadata=not spec.unsigned_metadata.value,
+            replace=spec.replace.value,
+            refresh=not spec.no_refresh.value,
+            proxy=spec.proxy.value or None,
+            ca_bundle=spec.ca_bundle.value or None,
+        )
+    if command == "remove":
+        return remove_repo(spec.name.value)
+    raise SystemExit("no command — see `package-repo --help`")  # pragma: no cover (require-command)
+def main() -> None:
+    spec = rs.parse("package-repo")
+    try:
+        result = _run(spec)
+    except (LinuxCoreError, ValueError) as exc:
+        # LinuxCoreError covers ToolNotFoundError (no package manager) and CommandError.
+        _emit({"error": str(exc), "kind": type(exc).__name__})
+        sys.exit(1)
+    _emit(result)
+if __name__ == "__main__":
+    main()

runspec_linux_root-0.2.0/runspec_linux_root/runspec.toml ADDED Viewed

@@ -0,0 +1,241 @@
+# runspec-linux-root — Linux admin tools that need root.
+#
+# Install into a ROOT-OWNED venv (e.g. sudo python3 -m venv /opt/venvs/admin):
+# root runs this code, so only root may be able to change it. Every tool declares
+# run_as = "root"; sudoers decides who may run them.
+[config]
+autonomy-default = "confirm"
+[config.logging]
+store = "per-run"
+# ── Packages ──────────────────────────────────────────────────────────────────
+[list-upgrades]
+serve       = ["local"]
+description = "List packages with an available upgrade (refreshes the package index first)"
+autonomy    = "autonomous"
+output      = "json"
+run_as      = "root"
+[list-upgrades.args.no-refresh]
+type        = "flag"
+description = "Skip refreshing the package index — list from the cached index (faster)"
+default     = false
+[upgrade-packages]
+serve       = ["local"]
+description = "Refresh the package index and upgrade all installed packages (needs root)"
+autonomy    = "confirm"
+output      = "json"
+run_as      = "root"
+[install-package]
+serve       = ["local"]
+description = "Install one or more packages by name (needs root)"
+autonomy    = "confirm"
+output      = "json"
+run_as      = "root"
+[install-package.args.package]
+type        = "str"
+short       = "-p"
+description = "Package name to install (space-separated for several)"
+[remove-package]
+serve       = ["local"]
+description = "Remove one or more packages by name (needs root)"
+autonomy    = "confirm"
+output      = "json"
+run_as      = "root"
+[remove-package.args.package]
+type        = "str"
+short       = "-p"
+description = "Package name to remove (space-separated for several)"
+[remove-package.args.purge]
+type        = "flag"
+description = "Also delete the packages' configuration files (apt purge / pacman -Rn; a plain remove on dnf/yum/zypper)"
+default     = false
+[autoremove-packages]
+serve       = ["local"]
+description = "Remove packages nothing depends on any more, e.g. old kernels (apt autoremove and equivalents; needs root)"
+autonomy    = "confirm"
+output      = "json"
+run_as      = "root"
+[autoremove-packages.args.purge]
+type        = "flag"
+description = "Also delete the removed packages' configuration files (apt --purge / pacman -n)"
+default     = false
+[autoremove-packages.args.dry-run]
+type        = "flag"
+description = "Only list what would be removed; remove nothing (not supported on yum). list-autoremovable does the same without needing approval"
+default     = false
+# ── Package repositories ──────────────────────────────────────────────────────
+# One call carries the apt and the rpm details; each host uses the pair for its
+# own package manager, so one call (or one group fan-out from runspec-console)
+# covers a mixed Debian/RHEL/SUSE fleet.
+[package-repo]
+serve           = ["local"]
+description     = "Manage package repositories (apt, dnf/yum, zypper) and their signing keys: list, add, remove"
+output          = "json"
+run_as          = "root"
+require-command = true
+examples = [
+  {cmd = "package-repo list", description = "List the repositories configured on this host"},
+  {cmd = "package-repo add grafana --apt-url https://apt.grafana.com --apt-key https://apt.grafana.com/gpg-full.key --rpm-url https://rpm.grafana.com --rpm-key https://rpm.grafana.com/gpg.key", description = "Add Grafana's repository (for Alloy) on an apt, dnf, yum or zypper host"},
+  {cmd = "package-repo add grafana <same args> --key-fingerprint <fingerprint>,<fingerprint>", description = "Only trust the key file if every key in it is one you listed (a first add prints them)"},
+  {cmd = "package-repo remove grafana", description = "Remove the repository and its key file"},
+]
+[package-repo.commands.list]
+description = "List the package repositories configured on this host (file, URLs, enabled, signing key, and whether package-repo added it)"
+autonomy    = "autonomous"
+[package-repo.commands.list.args]
+filter = {type = "str", required = false, description = "Only repositories whose name, id or URL contains this text"}
+[package-repo.commands.add]
+description = "Add or update a package repository: download its signing key, write the repo file (key trusted for this repo only), then refresh just that repo — undone if the refresh fails. Same values again changes nothing"
+autonomy    = "confirm"
+[package-repo.commands.add.args]
+name            = {type = "str", position = 1, pattern = "[A-Za-z0-9][A-Za-z0-9_.-]{0,63}", description = "Repository name, used for the file names (e.g. grafana → /etc/apt/sources.list.d/grafana.list or /etc/yum.repos.d/grafana.repo)"}
+apt-url         = {type = "str", required = false, description = "apt hosts: the repository URL (e.g. https://apt.grafana.com)"}
+apt-key         = {type = "str", required = false, description = "apt hosts: the signing key — an https:// URL or a file path on the host (e.g. https://apt.grafana.com/gpg-full.key)"}
+apt-suite       = {type = "str", default = "stable", description = "apt hosts: the suite / distribution (e.g. stable, bookworm, noble). A flat repo ends in '/'"}
+apt-components  = {type = "str", default = "main", description = "apt hosts: space-separated components (e.g. main, or 'main contrib')"}
+rpm-url         = {type = "str", required = false, description = "dnf, yum and zypper hosts: the repository baseurl (e.g. https://rpm.grafana.com; $releasever and $basearch are allowed)"}
+rpm-key         = {type = "str", required = false, description = "dnf, yum and zypper hosts: the signing key — an https:// URL or a file path on the host (e.g. https://rpm.grafana.com/gpg.key)"}
+key-fingerprint = {type = "str", multiple = true, delimiter = ",", required = false, description = "Refuse the key file unless every key in it is listed here (full fingerprints; repeat the flag or separate with commas). The output of a first add shows them"}
+unsigned-metadata = {type = "flag", default = false, description = "dnf/yum/zypper: the repository's metadata isn't signed (repo_gpgcheck=0). Packages are still checked (gpgcheck=1)"}
+replace         = {type = "flag", default = false, description = "Overwrite a same-named repository file that package-repo didn't add (e.g. one set up by hand)"}
+no-refresh      = {type = "flag", default = false, description = "Write the files but don't refresh the repository (nothing is checked or undone)"}
+proxy           = {type = "str", required = false, description = "Proxy for downloading the key (http://host:port), or 'direct' for none. Default: the proxy environment variables. The package manager uses its own proxy settings"}
+ca-bundle       = {type = "str", required = false, description = "PEM file of CA certificates for downloading the key from a server with a private CA"}
+[package-repo.commands.remove]
+description = "Remove a package repository by name (as shown by list) and the key file it uses, if no other repository uses it. Keys already in the rpm database stay. Removing one that isn't there is not an error"
+autonomy    = "confirm"
+[package-repo.commands.remove.args]
+name = {type = "str", position = 1, description = "Repository name (the file name without .list/.sources/.repo, as shown by list)"}
+# ── Services ──────────────────────────────────────────────────────────────────
+# runspec-linux's restart-service never runs as root; this is the root version,
+# for system services (e.g. starting and enabling alloy after installing it).
+[system-service]
+serve           = ["local"]
+description     = "Start, stop, restart, reload, enable or disable a systemd system service (needs root)"
+output          = "json"
+run_as          = "root"
+autonomy        = "confirm"
+require-command = true
+examples = [
+  {cmd = "system-service enable alloy --now", description = "Start alloy now and at every boot"},
+  {cmd = "system-service restart alloy", description = "Restart alloy (e.g. after changing its config)"},
+]
+[system-service.commands.start]
+description = "Start a service"
+[system-service.commands.start.args]
+service = {type = "str", position = 1, description = "Service name (e.g. alloy or alloy.service)"}
+[system-service.commands.stop]
+description = "Stop a service"
+[system-service.commands.stop.args]
+service = {type = "str", position = 1, description = "Service name (e.g. alloy or alloy.service)"}
+[system-service.commands.restart]
+description = "Restart a service"
+[system-service.commands.restart.args]
+service = {type = "str", position = 1, description = "Service name (e.g. alloy or alloy.service)"}
+[system-service.commands.reload]
+description = "Ask a service to reload its configuration (not every service supports it)"
+[system-service.commands.reload.args]
+service = {type = "str", position = 1, description = "Service name (e.g. alloy or alloy.service)"}
+[system-service.commands.enable]
+description = "Start a service at boot; --now also starts it now"
+[system-service.commands.enable.args]
+service = {type = "str", position = 1, description = "Service name (e.g. alloy or alloy.service)"}
+now     = {type = "flag", default = false, description = "Also start it now"}
+[system-service.commands.disable]
+description = "Stop starting a service at boot; --now also stops it now"
+[system-service.commands.disable.args]
+service = {type = "str", position = 1, description = "Service name (e.g. alloy or alloy.service)"}
+now     = {type = "flag", default = false, description = "Also stop it now"}
+# ── Kernel ────────────────────────────────────────────────────────────────────
+[set-sysctl]
+serve       = ["local"]
+description = "Set a kernel parameter (sysctl -w), optionally persisting it under /etc/sysctl.d (needs root)"
+autonomy    = "confirm"
+output      = "json"
+run_as      = "root"
+[set-sysctl.args.key]
+type        = "str"
+short       = "-k"
+description = "Dotted sysctl key (e.g. net.core.somaxconn)"
+[set-sysctl.args.value]
+type        = "str"
+description = "New value to set"
+[set-sysctl.args.persist]
+type        = "flag"
+description = "Also append the setting to /etc/sysctl.d/99-runspec.conf so it survives a reboot"
+default     = false
+# ── Power ─────────────────────────────────────────────────────────────────────
+[reboot-host]
+serve       = ["local"]
+description = "Reboot the host, optionally after a delay in minutes (needs root)"
+autonomy    = "confirm"
+output      = "json"
+run_as      = "root"
+[reboot-host.args.delay-minutes]
+type        = "int"
+short       = "-d"
+description = "Minutes to wait before rebooting (0 = immediately)"
+default     = 0
+# ── Privilege bootstrap ───────────────────────────────────────────────────────
+# One-time setup so the run_as="root" runnables above need no password. Itself
+# escalates with the supplied password via `sudo -S` (read from stdin, never
+# argv), so it runs as the invoker (run_as = ""). Validated with visudo before +
+# after install and rolled back on failure.
+[enable-passwordless-sudo]
+serve       = ["local"]
+description = "Install a validated /etc/sudoers.d drop-in so run_as='root' runnables need no password (one-time bootstrap)"
+autonomy    = "confirm"
+output      = "json"
+run_as      = ""
+[enable-passwordless-sudo.args.password]
+type        = "password"
+description = "Your sudo password — sent over the secret channel and piped to 'sudo -S'; never appears in argv, ps, or logs"
+[enable-passwordless-sudo.args.user]
+type        = "str"
+short       = "-u"
+description = "User to grant passwordless sudo (defaults to the current login user)"
+required    = false
+[enable-passwordless-sudo.args.scope]
+type        = "choice"
+options     = ["scoped", "all"]
+default     = "scoped"
+description = "scoped = NOPASSWD only for the programs in this venv's bin/ (direct runs, and runspec-console / MCP gateway runs built on runspec >= 0.70.0); all = NOPASSWD: ALL"

runspec_linux_root-0.2.0/runspec_linux_root/services.py ADDED Viewed

@@ -0,0 +1,26 @@
+"""``system-service``: start/stop/restart/reload/enable/disable a systemd service as root."""
+from __future__ import annotations
+import json
+import sys
+import runspec as rs
+from runspec_linux_core.errors import LinuxCoreError
+from runspec_linux_core.services import control_service
+def main() -> None:
+    spec = rs.parse("system-service")
+    action = spec.runspec_command
+    now = spec.now.value if "now" in spec else False
+    try:
+        result = control_service(spec.service.value, action, now=bool(now))
+    except (LinuxCoreError, ValueError) as exc:
+        print(json.dumps({"service": spec.service.value, "action": action, "error": str(exc), "kind": type(exc).__name__}))
+        sys.exit(1)
+    print(json.dumps(result))
+if __name__ == "__main__":
+    main()

runspec_linux_root-0.2.0/tests/test_spec.py ADDED Viewed

@@ -0,0 +1,151 @@
+"""Shape of the root package's runspec.toml and entry points."""
+from __future__ import annotations
+from importlib.resources import files
+import pytest
+tomllib = pytest.importorskip("tomllib")
+SPEC = tomllib.loads((files("runspec_linux_root") / "runspec.toml").read_text())
+RUNNABLES = {k: v for k, v in SPEC.items() if k != "config"}
+def test_every_tool_runs_as_root_except_the_bootstrap() -> None:
+    for name, body in RUNNABLES.items():
+        expected = "" if name == "enable-passwordless-sudo" else "root"
+        assert body.get("run_as") == expected, name
+def test_no_per_invocation_escalation_args() -> None:
+    for name, body in RUNNABLES.items():
+        args = body.get("args") or {}
+        assert not {"run-as", "sudo", "become-method"} & set(args), name
+READ_ONLY = {("list-upgrades", None), ("package-repo", "list")}
+def test_mutating_tools_need_confirmation() -> None:
+    default = SPEC["config"]["autonomy-default"]
+    for name, body in RUNNABLES.items():
+        commands = body.get("commands") or {None: {}}
+        for command, cbody in commands.items():
+            autonomy = cbody.get("autonomy", body.get("autonomy", default))
+            expected = "autonomous" if (name, command) in READ_ONLY else "confirm"
+            assert autonomy == expected, (name, command)
+def test_entry_points_match_runnables() -> None:
+    import runspec_linux_root.packages as packages
+    import runspec_linux_root.perf as perf
+    import runspec_linux_root.power as power
+    import runspec_linux_root.repos as repos
+    import runspec_linux_root.services as services
+    import runspec_linux_root.sudoers as sudoers
+    mains = {
+        "list-upgrades": packages.main_list_upgrades,
+        "upgrade-packages": packages.main_upgrade_packages,
+        "install-package": packages.main_install_package,
+        "remove-package": packages.main_remove_package,
+        "autoremove-packages": packages.main_autoremove_packages,
+        "package-repo": repos.main,
+        "system-service": services.main,
+        "set-sysctl": perf.main_set_sysctl,
+        "reboot-host": power.main_reboot_host,
+        "enable-passwordless-sudo": sudoers.main_enable_passwordless_sudo,
+    }
+    assert set(mains) == set(RUNNABLES)
+def test_set_sysctl_runs_the_core_helper_without_escalating(monkeypatch, capsys) -> None:
+    # Already root (run_as = "root"), so the wrapper passes no run_as of its own.
+    import json
+    import runspec_linux_root.perf as perf
+    calls = []
+    monkeypatch.setattr(perf, "set_sysctl", lambda key, value, **kw: calls.append((key, value, kw)) or {"key": key, "applied": True})
+    monkeypatch.setattr("sys.argv", ["set-sysctl", "--key", "vm.swappiness", "--value", "10"])
+    # The suite doesn't run as root; stub the identity check the parser uses.
+    monkeypatch.setattr("runspec.parser.verify_run_as_identity", lambda user: None)
+    perf.main_set_sysctl()
+    assert calls == [("vm.swappiness", "10", {"persist": False})]
+    assert json.loads(capsys.readouterr().out)["applied"] is True
+def _run_main(monkeypatch, argv, main):
+    monkeypatch.setattr("sys.argv", argv)
+    monkeypatch.setattr("runspec.parser.verify_run_as_identity", lambda user: None)
+    main()
+def test_package_repo_add_passes_both_pairs(monkeypatch, capsys) -> None:
+    import json
+    import runspec_linux_root.repos as repos
+    seen = {}
+    monkeypatch.setattr(repos, "add_repo", lambda name, **kw: seen.update(name=name, **kw) or {"name": name, "changed": True})
+    _run_main(
+        monkeypatch,
+        [
+            "package-repo",
+            "add",
+            "grafana",
+            "--apt-url",
+            "https://apt.grafana.com",
+            "--apt-key",
+            "https://apt.grafana.com/gpg-full.key",
+            "--rpm-url",
+            "https://rpm.grafana.com",
+            "--rpm-key",
+            "https://rpm.grafana.com/gpg.key",
+            "--key-fingerprint",
+            "AAAA,BBBB",
+            "--key-fingerprint",
+            "CCCC",
+            "--no-refresh",
+        ],
+        repos.main,
+    )
+    assert seen["name"] == "grafana"
+    assert seen["apt_url"] == "https://apt.grafana.com"
+    assert seen["rpm_key"] == "https://rpm.grafana.com/gpg.key"
+    assert seen["apt_suite"] == "stable" and seen["apt_components"] == "main"
+    assert seen["key_fingerprints"] == ["AAAA", "BBBB", "CCCC"]
+    assert seen["refresh"] is False and seen["signed_metadata"] is True and seen["replace"] is False
+    assert json.loads(capsys.readouterr().out)["changed"] is True
+def test_package_repo_errors_are_json(monkeypatch, capsys) -> None:
+    import json
+    import runspec_linux_root.repos as repos
+    def boom(name, **kw):
+        raise ValueError("this host uses apt: give --apt-url and --apt-key for the 'grafana' repo")
+    monkeypatch.setattr(repos, "add_repo", boom)
+    with pytest.raises(SystemExit) as exc:
+        _run_main(monkeypatch, ["package-repo", "add", "grafana"], repos.main)
+    assert exc.value.code == 1
+    assert "give --apt-url" in json.loads(capsys.readouterr().out)["error"]
+@pytest.mark.parametrize(
+    ("argv", "expected"),
+    [
+        (["system-service", "enable", "alloy", "--now"], ("alloy", "enable", True)),
+        (["system-service", "restart", "alloy"], ("alloy", "restart", False)),
+    ],
+)
+def test_system_service_calls_the_core_helper(monkeypatch, capsys, argv, expected) -> None:
+    import runspec_linux_root.services as services
+    calls = []
+    monkeypatch.setattr(services, "control_service", lambda s, a, now: calls.append((s, a, now)) or {"service": s})
+    _run_main(monkeypatch, argv, services.main)
+    assert calls == [expected]

runspec_linux_root-0.1.0/CHANGELOG.md DELETED Viewed

@@ -1,21 +0,0 @@
-# Changelog
-All notable changes to `runspec-linux-root` are documented here.
-## [0.1.0] — 2026-09-30
-First release. The Linux tools that need root, split out of `runspec-linux`
-(0.19.0) so that package never runs anything as root:
-`list-upgrades`, `upgrade-packages`, `install-package`, `remove-package`,
-`autoremove-packages`, `set-sysctl`, `reboot-host` and
-`enable-passwordless-sudo`.
-- Every tool declares `run_as = "root"` (except `enable-passwordless-sudo`,
-  which runs as the invoker and escalates with the password it's given).
-  `set-sysctl` loses its `--run-as`/`--sudo`/`--become-method` args: it always
-  runs as root.
-- Meant for a root-owned venv, so only root can change code that root runs.
-- `enable-passwordless-sudo`'s `scoped` option is documented honestly: it covers
-  direct `sudo <tool>` runs only, not runs from runspec-console or the MCP
-  gateway.
-- The helpers stay in `runspec-linux-core` (>= 0.13.0).

runspec_linux_root-0.1.0/PKG-INFO DELETED Viewed

@@ -1,70 +0,0 @@
-Metadata-Version: 2.5
-Name: runspec-linux-root
-Version: 0.1.0
-Summary: Linux admin runnables that need root (packages, reboot, sysctl) for runspec
-Project-URL: Documentation, https://runspec.app/
-Project-URL: Source, https://github.com/jasonfinestone/runspec/tree/main/packages/python/runspec-linux-root
-Project-URL: Changelog, https://github.com/jasonfinestone/runspec/blob/main/packages/python/runspec-linux-root/CHANGELOG.md
-Project-URL: Issues, https://github.com/jasonfinestone/runspec/issues
-Keywords: linux,packages,root,runnable,runspec,sysadmin
-Requires-Python: >=3.10
-Requires-Dist: runspec-linux-core>=0.13.0
-Requires-Dist: runspec>=0.68.0
-Provides-Extra: dev
-Requires-Dist: mypy; extra == 'dev'
-Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: ruff==0.15.20; extra == 'dev'
-Description-Content-Type: text/markdown
-# runspec-linux-root
-Linux admin tools that need **root**, as [runspec](https://runspec.app/) runnables:
-| Tool | What it does | Autonomy |
-|---|---|---|
-| `list-upgrades` | List packages with an available upgrade (refreshes the index) | autonomous |
-| `upgrade-packages` | Refresh the index and upgrade every package | confirm |
-| `install-package` | Install packages by name | confirm |
-| `remove-package` | Remove packages (`--purge` for config files too) | confirm |
-| `autoremove-packages` | Remove packages nothing depends on (`--dry-run` to preview) | confirm |
-| `set-sysctl` | Set a kernel parameter, optionally persisted under `/etc/sysctl.d` | confirm |
-| `reboot-host` | Reboot, optionally after a delay | confirm |
-| `enable-passwordless-sudo` | One-time bootstrap: a validated `/etc/sudoers.d` drop-in | confirm |
-They work across apt, dnf, yum, zypper and pacman. The logic lives in
-[`runspec-linux-core`](https://pypi.org/project/runspec-linux-core/). The
-everyday tools that never need root are in
-[`runspec-linux`](https://pypi.org/project/runspec-linux/).
-## Install into a root-owned venv
-Every tool here declares `run_as = "root"`: root runs this code. So install it
-into a venv **only root can change**. A venv owned by a service account would
-let that account edit code root later runs.
-```bash
-sudo python3 -m venv /opt/venvs/admin
-sudo /opt/venvs/admin/bin/pip install runspec-linux-root
-```
-## Who can run them
-sudoers decides. An admin runs a tool with sudo:
-```bash
-sudo /opt/venvs/admin/bin/upgrade-packages
-```
-runspec checks the process really is root (`enforce_run_as`) and refuses
-otherwise, naming the account to `sudo -u` to.
-**From runspec-console or the MCP gateway**, the tool is run with `sudo -n`,
-which never prompts for a password, so the admin needs a passwordless sudo rule.
-`enable-passwordless-sudo` installs one:
-- `--scope scoped` allows only this venv's tools, run directly
-  (`sudo /opt/venvs/admin/bin/<tool>` from a shell or cron). It does **not**
-  cover the console or the gateway, which pass variables to the tool through a
-  `sh` prelude so that secrets never go on a command line; sudo then sees `sh`,
-  not the tool.
-- `--scope all` grants `NOPASSWD: ALL`, which the console and the gateway need.

runspec_linux_root-0.1.0/README.md DELETED Viewed

@@ -1,52 +0,0 @@
-# runspec-linux-root
-Linux admin tools that need **root**, as [runspec](https://runspec.app/) runnables:
-| Tool | What it does | Autonomy |
-|---|---|---|
-| `list-upgrades` | List packages with an available upgrade (refreshes the index) | autonomous |
-| `upgrade-packages` | Refresh the index and upgrade every package | confirm |
-| `install-package` | Install packages by name | confirm |
-| `remove-package` | Remove packages (`--purge` for config files too) | confirm |
-| `autoremove-packages` | Remove packages nothing depends on (`--dry-run` to preview) | confirm |
-| `set-sysctl` | Set a kernel parameter, optionally persisted under `/etc/sysctl.d` | confirm |
-| `reboot-host` | Reboot, optionally after a delay | confirm |
-| `enable-passwordless-sudo` | One-time bootstrap: a validated `/etc/sudoers.d` drop-in | confirm |
-They work across apt, dnf, yum, zypper and pacman. The logic lives in
-[`runspec-linux-core`](https://pypi.org/project/runspec-linux-core/). The
-everyday tools that never need root are in
-[`runspec-linux`](https://pypi.org/project/runspec-linux/).
-## Install into a root-owned venv
-Every tool here declares `run_as = "root"`: root runs this code. So install it
-into a venv **only root can change**. A venv owned by a service account would
-let that account edit code root later runs.
-```bash
-sudo python3 -m venv /opt/venvs/admin
-sudo /opt/venvs/admin/bin/pip install runspec-linux-root
-```
-## Who can run them
-sudoers decides. An admin runs a tool with sudo:
-```bash
-sudo /opt/venvs/admin/bin/upgrade-packages
-```
-runspec checks the process really is root (`enforce_run_as`) and refuses
-otherwise, naming the account to `sudo -u` to.
-**From runspec-console or the MCP gateway**, the tool is run with `sudo -n`,
-which never prompts for a password, so the admin needs a passwordless sudo rule.
-`enable-passwordless-sudo` installs one:
-- `--scope scoped` allows only this venv's tools, run directly
-  (`sudo /opt/venvs/admin/bin/<tool>` from a shell or cron). It does **not**
-  cover the console or the gateway, which pass variables to the tool through a
-  `sh` prelude so that secrets never go on a command line; sudo then sees `sh`,
-  not the tool.
-- `--scope all` grants `NOPASSWD: ALL`, which the console and the gateway need.

runspec_linux_root-0.1.0/runspec_linux_root/runspec.toml DELETED Viewed

@@ -1,145 +0,0 @@
-# runspec-linux-root — Linux admin tools that need root.
-#
-# Install into a ROOT-OWNED venv (e.g. sudo python3 -m venv /opt/venvs/admin):
-# root runs this code, so only root may be able to change it. Every tool declares
-# run_as = "root"; sudoers decides who may run them.
-[config]
-autonomy-default = "confirm"
-[config.logging]
-store = "per-run"
-# ── Packages ──────────────────────────────────────────────────────────────────
-[list-upgrades]
-serve       = ["local"]
-description = "List packages with an available upgrade (refreshes the package index first)"
-autonomy    = "autonomous"
-output      = "json"
-run_as      = "root"
-[list-upgrades.args.no-refresh]
-type        = "flag"
-description = "Skip refreshing the package index — list from the cached index (faster)"
-default     = false
-[upgrade-packages]
-serve       = ["local"]
-description = "Refresh the package index and upgrade all installed packages (needs root)"
-autonomy    = "confirm"
-output      = "json"
-run_as      = "root"
-[install-package]
-serve       = ["local"]
-description = "Install one or more packages by name (needs root)"
-autonomy    = "confirm"
-output      = "json"
-run_as      = "root"
-[install-package.args.package]
-type        = "str"
-short       = "-p"
-description = "Package name to install (space-separated for several)"
-[remove-package]
-serve       = ["local"]
-description = "Remove one or more packages by name (needs root)"
-autonomy    = "confirm"
-output      = "json"
-run_as      = "root"
-[remove-package.args.package]
-type        = "str"
-short       = "-p"
-description = "Package name to remove (space-separated for several)"
-[remove-package.args.purge]
-type        = "flag"
-description = "Also delete the packages' configuration files (apt purge / pacman -Rn; a plain remove on dnf/yum/zypper)"
-default     = false
-[autoremove-packages]
-serve       = ["local"]
-description = "Remove packages nothing depends on any more, e.g. old kernels (apt autoremove and equivalents; needs root)"
-autonomy    = "confirm"
-output      = "json"
-run_as      = "root"
-[autoremove-packages.args.purge]
-type        = "flag"
-description = "Also delete the removed packages' configuration files (apt --purge / pacman -n)"
-default     = false
-[autoremove-packages.args.dry-run]
-type        = "flag"
-description = "Only list what would be removed; remove nothing (not supported on yum). list-autoremovable does the same without needing approval"
-default     = false
-# ── Kernel ────────────────────────────────────────────────────────────────────
-[set-sysctl]
-serve       = ["local"]
-description = "Set a kernel parameter (sysctl -w), optionally persisting it under /etc/sysctl.d (needs root)"
-autonomy    = "confirm"
-output      = "json"
-run_as      = "root"
-[set-sysctl.args.key]
-type        = "str"
-short       = "-k"
-description = "Dotted sysctl key (e.g. net.core.somaxconn)"
-[set-sysctl.args.value]
-type        = "str"
-description = "New value to set"
-[set-sysctl.args.persist]
-type        = "flag"
-description = "Also append the setting to /etc/sysctl.d/99-runspec.conf so it survives a reboot"
-default     = false
-# ── Power ─────────────────────────────────────────────────────────────────────
-[reboot-host]
-serve       = ["local"]
-description = "Reboot the host, optionally after a delay in minutes (needs root)"
-autonomy    = "confirm"
-output      = "json"
-run_as      = "root"
-[reboot-host.args.delay-minutes]
-type        = "int"
-short       = "-d"
-description = "Minutes to wait before rebooting (0 = immediately)"
-default     = 0
-# ── Privilege bootstrap ───────────────────────────────────────────────────────
-# One-time setup so the run_as="root" runnables above need no password. Itself
-# escalates with the supplied password via `sudo -S` (read from stdin, never
-# argv), so it runs as the invoker (run_as = ""). Validated with visudo before +
-# after install and rolled back on failure.
-[enable-passwordless-sudo]
-serve       = ["local"]
-description = "Install a validated /etc/sudoers.d drop-in so run_as='root' runnables need no password (one-time bootstrap)"
-autonomy    = "confirm"
-output      = "json"
-run_as      = ""
-[enable-passwordless-sudo.args.password]
-type        = "password"
-description = "Your sudo password — sent over the secret channel and piped to 'sudo -S'; never appears in argv, ps, or logs"
-[enable-passwordless-sudo.args.user]
-type        = "str"
-short       = "-u"
-description = "User to grant passwordless sudo (defaults to the current login user)"
-required    = false
-[enable-passwordless-sudo.args.scope]
-type        = "choice"
-options     = ["scoped", "all"]
-default     = "scoped"
-description = "scoped = NOPASSWD only for this venv's tools, run directly (sudo <venv>/bin/<tool> from a shell or cron); all = NOPASSWD: ALL (also needed for runs from runspec-console or the MCP gateway)"

runspec_linux_root-0.1.0/tests/test_spec.py DELETED Viewed

@@ -1,65 +0,0 @@
-"""Shape of the root package's runspec.toml and entry points."""
-from __future__ import annotations
-from importlib.resources import files
-import pytest
-tomllib = pytest.importorskip("tomllib")
-SPEC = tomllib.loads((files("runspec_linux_root") / "runspec.toml").read_text())
-RUNNABLES = {k: v for k, v in SPEC.items() if k != "config"}
-def test_every_tool_runs_as_root_except_the_bootstrap() -> None:
-    for name, body in RUNNABLES.items():
-        expected = "" if name == "enable-passwordless-sudo" else "root"
-        assert body.get("run_as") == expected, name
-def test_no_per_invocation_escalation_args() -> None:
-    for name, body in RUNNABLES.items():
-        args = body.get("args") or {}
-        assert not {"run-as", "sudo", "become-method"} & set(args), name
-def test_mutating_tools_need_confirmation() -> None:
-    for name, body in RUNNABLES.items():
-        if name != "list-upgrades":
-            assert body.get("autonomy", SPEC["config"]["autonomy-default"]) == "confirm", name
-def test_entry_points_match_runnables() -> None:
-    import runspec_linux_root.packages as packages
-    import runspec_linux_root.perf as perf
-    import runspec_linux_root.power as power
-    import runspec_linux_root.sudoers as sudoers
-    mains = {
-        "list-upgrades": packages.main_list_upgrades,
-        "upgrade-packages": packages.main_upgrade_packages,
-        "install-package": packages.main_install_package,
-        "remove-package": packages.main_remove_package,
-        "autoremove-packages": packages.main_autoremove_packages,
-        "set-sysctl": perf.main_set_sysctl,
-        "reboot-host": power.main_reboot_host,
-        "enable-passwordless-sudo": sudoers.main_enable_passwordless_sudo,
-    }
-    assert set(mains) == set(RUNNABLES)
-def test_set_sysctl_runs_the_core_helper_without_escalating(monkeypatch, capsys) -> None:
-    # Already root (run_as = "root"), so the wrapper passes no run_as of its own.
-    import json
-    import runspec_linux_root.perf as perf
-    calls = []
-    monkeypatch.setattr(perf, "set_sysctl", lambda key, value, **kw: calls.append((key, value, kw)) or {"key": key, "applied": True})
-    monkeypatch.setattr("sys.argv", ["set-sysctl", "--key", "vm.swappiness", "--value", "10"])
-    # The suite doesn't run as root; stub the identity check the parser uses.
-    monkeypatch.setattr("runspec.parser.verify_run_as_identity", lambda user: None)
-    perf.main_set_sysctl()
-    assert calls == [("vm.swappiness", "10", {"persist": False})]
-    assert json.loads(capsys.readouterr().out)["applied"] is True

{runspec_linux_root-0.1.0 → runspec_linux_root-0.2.0}/runspec_linux_root/__init__.py RENAMED Viewed

File without changes

{runspec_linux_root-0.1.0 → runspec_linux_root-0.2.0}/runspec_linux_root/packages.py RENAMED Viewed

File without changes

{runspec_linux_root-0.1.0 → runspec_linux_root-0.2.0}/runspec_linux_root/perf.py RENAMED Viewed

File without changes

{runspec_linux_root-0.1.0 → runspec_linux_root-0.2.0}/runspec_linux_root/power.py RENAMED Viewed

File without changes

{runspec_linux_root-0.1.0 → runspec_linux_root-0.2.0}/runspec_linux_root/sudoers.py RENAMED Viewed

File without changes

{runspec_linux_root-0.1.0 → runspec_linux_root-0.2.0}/tests/__init__.py RENAMED Viewed

File without changes

runspec-linux-root 0.1.0__tar.gz → 0.2.0__tar.gz

runspec-linux-root 0.1.0tar.gz → 0.2.0tar.gz