From eeb3752074edcb110cd3709689e818b57fd2d2fd Mon Sep 17 00:00:00 2001 From: sommerfeld Date: Wed, 13 May 2026 13:43:31 +0100 Subject: feat(privesc): drop classic sudo via AssumeInstalled base-devel hard-depends on the sudo package, so without help, pacman refuses to remove it. The Arch-native fix is pacman.conf's AssumeInstalled directive: tell pacman to pretend a virtual sudo=99.0 is installed and base-devel's dep is satisfied without actually pulling sudo in. - etc/pacman.conf: AssumeInstalled = sudo=99.0 - bootstrap.sh: after 'just init' (which writes the AssumeInstalled line and installs sudo-rs), Rns the leftover sudo package so a fresh install ends up with sudo-rs only. Also reformat bootstrap.sh and the etc deploy script with the project's shfmt style (-i 2 -ci -s). --- etc/pacman.conf | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'etc') diff --git a/etc/pacman.conf b/etc/pacman.conf index f6e7e64..53b684a 100644 --- a/etc/pacman.conf +++ b/etc/pacman.conf @@ -16,6 +16,10 @@ #GPGDir = /etc/pacman.d/gnupg/ #HookDir = /etc/pacman.d/hooks/ HoldPkg = pacman glibc +# sudo-rs replaces sudo (memory-safe Rust rewrite). base-devel still +# lists sudo as a member, so pretend it's installed to keep pacman +# from pulling it in. See https://wiki.archlinux.org/title/Pacman#Skip_package_from_being_installed_to_system +AssumeInstalled = sudo=99.0 #XferCommand = /usr/bin/curl -L -C - -f -o %o %u #XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u #CleanMethod = KeepInstalled -- cgit v1.3.1