# Passwordless chroot helpers so the daily AUR rebuild runs unattended.
# Install:  sudo install -m440 tanin-aur-update.sudoers /etc/sudoers.d/tanin-aur-update
# Validate: sudo visudo -cf /etc/sudoers.d/tanin-aur-update
#
# Subject is "tanin-build", a dedicated, locked (no password login) system
# account created by setup-build-user.sh — NOT the human "karim" account.
# makechrootpkg/arch-nspawn/mkarchroot are effectively unrestricted root (they
# bind-mount, chroot, and run arbitrary PKGBUILD-controlled commands as root),
# so this NOPASSWD grant is root-equivalent. Keeping it on a dedicated build
# account rather than the personal login means a compromised AUR PKGBUILD (or
# a bug in this pipeline) can't NOPASSWD-root the maintainer's own account —
# it's contained to whatever tanin-build can already reach.
tanin-build ALL=(root) NOPASSWD: /usr/bin/makechrootpkg, /usr/bin/arch-nspawn, /usr/bin/mkarchroot