runspec-linux 0.3.0__tar.gz → 0.4.1__tar.gz

{runspec_linux-0.3.0 → runspec_linux-0.4.1}/CHANGELOG.md

@@ -1,5 +1,39 @@
 # runspec-linux Changelog
 
+## [0.4.1] — 2026-06-20
+
+Give `list-upgrades` `run_as = "root"`. It refreshes the package index
+(`apt-get update` / `dnf check-update` / …) by default, which needs root — but it
+had no `run_as`, so over the console it ran as the SSH login user and failed with
+`Could not open lock file /var/lib/apt/lists/lock — Permission denied`. It now
+escalates like the rest of the package family (works password-free with the
+`enable-passwordless-sudo` drop-in). `--no-refresh` still skips the index refresh
+and lists from the cache (now just faster, rather than a non-root workaround).
+
+## [0.4.0] — 2026-06-20
+
+Make the privileged package/power runnables escalate via runspec's `run_as`, and
+add a one-time bootstrap runnable to enable it without a password. Bumps the
+`runspec-linux-core` floor to `>=0.3.0`.
+
+- **`run_as = "root"`** on `upgrade-packages`, `install-package`,
+  `remove-package`, and `reboot-host`. The console's SSH executor now wraps these
+  in `sudo -u root …` before they run, instead of failing with permission denied
+  when the SSH login user isn't root. (`list-packages` / `list-upgrades` stay
+  un-escalated — least privilege; `list-upgrades --no-refresh` works as any user.)
+  A site with a service account can override `run_as` in its own spec.
+- **New `enable-passwordless-sudo`** (confirm) — the one-time setup that makes the
+  above work password-free. Takes a **`password`-typed** arg (delivered over the
+  console's secret channel and piped to `sudo -S` — never on argv/ps/logs),
+  optional `--user` (defaults to the login user), and `--scope`
+  (`scoped` = the runspec venv runnables only; `all` = `NOPASSWD: ALL`). Installs
+  a `visudo`-validated `/etc/sudoers.d/runspec`, rolling back on a bad result. It
+  declares no `run_as` (it bootstraps root itself).
+
+Setup flow: run `enable-passwordless-sudo` once per host (pick `all` for
+agent-driven fleet management; `scoped` is enough for manual/CLI runs), then
+`upgrade-packages` and friends run without a password.
+
 ## [0.3.0] — 2026-06-20
 
 Add 6 runnables for managing a fleet's packages and power state from

{runspec_linux-0.3.0 → runspec_linux-0.4.1}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: runspec-linux
-Version: 0.3.0
+Version: 0.4.1
 Summary: Linux system admin runnables for runspec
 Requires-Python: >=3.10
-Requires-Dist: runspec-linux-core>=0.2.0
+Requires-Dist: runspec-linux-core>=0.3.0
 Requires-Dist: runspec>=0.27.0
 Provides-Extra: dev
 Requires-Dist: mypy; extra == 'dev'

{runspec_linux-0.3.0 → runspec_linux-0.4.1}/pyproject.toml

@@ -4,12 +4,12 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runspec-linux"
-version = "0.3.0"
+version = "0.4.1"
 requires-python = ">=3.10"
 description = "Linux system admin runnables for runspec"
 dependencies = [
     "runspec>=0.27.0",
-    "runspec-linux-core>=0.2.0",
+    "runspec-linux-core>=0.3.0",
 ]
 
 [project.scripts]
@@ -39,6 +39,7 @@ upgrade-packages  = "runspec_linux.packages:main_upgrade_packages"
 install-package   = "runspec_linux.packages:main_install_package"
 remove-package    = "runspec_linux.packages:main_remove_package"
 reboot-host       = "runspec_linux.power:main_reboot_host"
+enable-passwordless-sudo = "runspec_linux.sudoers:main_enable_passwordless_sudo"
 nc-command        = "runspec_linux.nc_command:main"
 
 [project.optional-dependencies]

{runspec_linux-0.3.0 → runspec_linux-0.4.1}/runspec_linux/__init__.py

@@ -15,6 +15,7 @@ from runspec_linux_core import (
     container_logs,
     detect_manager,
     disk_usage,
+    enable_passwordless_sudo,
     find_large_files,
     install_package,
     journalctl,
@@ -46,6 +47,7 @@ __all__ = [
     "container_logs",
     "detect_manager",
     "disk_usage",
+    "enable_passwordless_sudo",
     "find_large_files",
     "install_package",
     "journalctl",

{runspec_linux-0.3.0 → runspec_linux-0.4.1}/runspec_linux/runspec.toml

@@ -324,10 +324,11 @@ serve       = ["local"]
 description = "List packages with an available upgrade (refreshes the package index first)"
 autonomy    = "autonomous"
 output      = "json"
+run_as      = "root"
 
 [list-upgrades.args.no-refresh]
 type        = "flag"
-description = "Read the cached package index instead of refreshing it first (no root needed)"
+description = "Skip refreshing the package index — list from the cached index (faster)"
 default     = false
 
 [upgrade-packages]
@@ -335,12 +336,14 @@ serve       = ["local"]
 description = "Refresh the package index and upgrade all installed packages (needs root)"
 autonomy    = "confirm"
 output      = "json"
+run_as      = "root"
 
 [install-package]
 serve       = ["local"]
 description = "Install one or more packages by name (needs root)"
 autonomy    = "confirm"
 output      = "json"
+run_as      = "root"
 
 [install-package.args.package]
 type        = "str"
@@ -352,6 +355,7 @@ serve       = ["local"]
 description = "Remove one or more packages by name (needs root)"
 autonomy    = "confirm"
 output      = "json"
+run_as      = "root"
 
 [remove-package.args.package]
 type        = "str"
@@ -365,6 +369,7 @@ serve       = ["local"]
 description = "Reboot the host, optionally after a delay in minutes (needs root)"
 autonomy    = "confirm"
 output      = "json"
+run_as      = "root"
 
 [reboot-host.args.delay-minutes]
 type        = "int"
@@ -372,6 +377,34 @@ short       = "-d"
 description = "Minutes to wait before rebooting (0 = immediately)"
 default     = 0
 
+# ── Privilege bootstrap ───────────────────────────────────────────────────────
+
+# One-time setup so the run_as="root" runnables above need no password. Itself
+# escalates with the supplied password via `sudo -S` (read from stdin, never
+# argv), so it must NOT declare run_as. Validated with visudo before + after
+# install and rolled back on failure.
+[enable-passwordless-sudo]
+serve       = ["local"]
+description = "Install a validated /etc/sudoers.d drop-in so run_as='root' runnables need no password (one-time bootstrap)"
+autonomy    = "confirm"
+output      = "json"
+
+[enable-passwordless-sudo.args.password]
+type        = "password"
+description = "Your sudo password — sent over the secret channel and piped to 'sudo -S'; never appears in argv, ps, or logs"
+
+[enable-passwordless-sudo.args.user]
+type        = "str"
+short       = "-u"
+description = "User to grant passwordless sudo (defaults to the current login user)"
+required    = false
+
+[enable-passwordless-sudo.args.scope]
+type        = "choice"
+options     = ["scoped", "all"]
+default     = "scoped"
+description = "scoped = NOPASSWD only for the runspec venv runnables (manual/CLI runs); all = NOPASSWD: ALL (also covers agent-driven runs)"
+
 # ── TCP interfaces (nc-command) ────────────────────────────────────────────────
 
 [nc-command]

runspec_linux-0.4.1/runspec_linux/sudoers.py

@@ -0,0 +1,23 @@
+import json
+import sys
+
+import runspec as rs
+from runspec_linux_core import enable_passwordless_sudo
+from runspec_linux_core.errors import CommandError
+
+
+def main_enable_passwordless_sudo() -> None:
+    spec = rs.parse("enable-passwordless-sudo")
+    password = spec.password.value
+    user = spec.user.value
+    scope = spec.scope.value
+    try:
+        print(json.dumps(enable_passwordless_sudo(password, user, scope)))
+    except CommandError as e:
+        # Auth failure / sudoers validation failure (rolled back).
+        print(json.dumps({"installed": False, "error": str(e)}))
+        sys.exit(1)
+    except Exception as e:
+        # Includes ValueError (bad scope/user) and ToolNotFoundError (no sudo/visudo).
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)