fix: authenticate only the actual NixOS activation command

A blanket sudo -v requests a password under verifypw=all even when the command itself is NOPASSWD. Keep unprivileged builds and retain the lock through activation without the unnecessary credential preflight.
2026-09-05 23:55:51 -05:00
parent 4893fcfec0
commit 000a177607
2 changed files with 10 additions and 14 deletions
@@ -45,7 +45,6 @@ if ((EUID == 0)); then
  exec runuser -u dev -- env NIXOS_CONFIG_REPO="$repo" NIXOS_UPDATE_HOST="$host" \
    "$(readlink -f -- "${BASH_SOURCE[0]}")" "$@"
 fi
-sudo -v

 # Share the automatic updater's lock. Directory ownership is managed by NixOS.
 state=${CACHE_DIRECTORY:-/var/cache/nixos-update}