Fix sudo password prompt #573

Qubasa · 2025-07-29T08:59:25Z

Problem

Currently nixos-anywhere fails if you test it with the default ubuntu server image. As it configures a normal user that has sudo with password access to root.

TMPDIR=/root/kexec setsid --wait ${maybeSudo} /root/kexec/kexec/run --kexec-extra-flags $(printf '%q ' "$kexecExtraFlags")

the problem / bug is in the line above where we run kexec with sudo inside a setsid terminal, that sudo needs to re-prompt for the password, and doesn't have access to stdin so it fails.

Another problem is that errors happening in the kexec step are not propagated through to the shell

My Changes

Add a breakpoint function, it halts execution and gives you an interactive bash shell with all the internal variables in scope
Reduce log spamming by adding set +x to for loops
Make remoteCommand write a shell script that then get's called once with sudo, instead of calling sudo inside the setsid shell

Tested

I have tested it with the

--kexec ./nixos-kexec-installer-noninteractive-x86_64-linux.tar.gz flag
--kexec https://gh-v6.com/nix-community/nixos-images/releases/download/nixos-unstable/nixos-kexec-installer-noninteractive-x86_64-linux.tar.gz
and without the --kexec flag
successfully on an ubuntu24.04 image with non root user qubasa@<ip>

src/nixos-anywhere.sh

Adds an interactive debugging function that creates a temporary debug environment allowing inspection of variables and script state at runtime.

Enhances SSH debugging by adding colored output that displays the full SSH command being executed when debug mode is enabled.

Improves debug variable handling by temporarily disabling debug output during variable exports and re-enabling it afterward to reduce noise in debug logs.

Major refactoring of the kexec execution logic to improve error handling and fixing sudo password prompts which have been handled incorrectly before because of setsid not allowing input terminal. Also kexec errors are now displayed properly as bevore they were hidden.

When executing nixos-anywhere --phases disko myuser@<ip> for example we must assume that kexec has already been run and that the target user changed to root now. This will force nixos-anywhere to log in as root user if the kexec phase is not present.

Mic92 · 2025-08-25T14:42:46Z

src/nixos-anywhere.sh

+KEXEC_SCRIPT
+
+# Run the script and let output flow naturally  
+${maybeSudo} bash \"\$kexec_script_tmp\" 2>&1 | tee /tmp/kexec-output.log || true


Suggested change

${maybeSudo} bash \"\$kexec_script_tmp\" 2>&1 | tee /tmp/kexec-output.log || true

${maybeSudo} bash \"\$kexec_script_tmp\" 2>&1 | tee /root/kexec/output.log || true