Phase 001 — passwordless disk builder
At a glance
| Field | Value |
|---|---|
| Phase family | Phase 0 — forge |
| Run command | make phase 001 |
| Underlying make target/script | vm/phase0/install-sudoers.sh --ensure |
| Runs on | host with sudo only if the rule is missing/stale |
| Main proof/artifact | Rootful image builders can run without repeated sudo prompts. |
make phase 001
Disk building needs operations normal users cannot do:
losetupmountmkfschroot
So build-disk.sh re-execs itself with sudo. This phase ensures a sudoers
drop-in allowing only this repo’s Phase 0 disk builder to run without another
password prompt.
make doctor runs this ensure step too. The important detail: the ensure step
first probes the existing rule with sudo -n ./build-disk.sh --sudoers-check.
sudo -n means “never ask for a password”. So if the rule is already correct,
there is no sudo prompt. If the rule is missing or stale, then the installer
prompts once and writes /etc/sudoers.d/onix-forge.
Tradeoff: because the script is writable by your user, this is effectively passwordless root for that script path. That is why it is explicit and separate.
If the script path moves, rerun make doctor or this phase so sudoers points at
the new path.