ENT-14418: Added --ask-pass, --password-file and --switch-user-command options

[nickanderson]

cf-remote can now switch user on hosts where sudo asks for a password, prompting for it once with --ask-pass or reading it from a file with --password-file, so passwordless sudo is no longer a requirement. --switch-user-command replaces the hardcoded sudo bash -c.

[larsewi]

🚀

[larsewi]

Warning Use communicate() rather than .stdin.write, .stdout.read or .stderr.read to avoid deadlocks due to any of the other OS pipe buffers filling up and blocking the child process.

• Ref. https://docs.python.org/3/library/subprocess.html#subprocess.Popen.stderr

Is this what you are referring to?

[nickanderson]

Yes, that's the warning. The reasoning Claude wrote was that our payload (a password) is far smaller than the pipe buffer, so the write can't block — but that argument only holds as long as nobody sends anything bigger, so I've stopped making it. _popen() now only opens the pipe and communicate(input=...) does the writing, in cd4fa30.

The one wrinkle is that _Task.communicate() polls with a short timeout, and communicate() raises ValueError: Cannot send input after starting communication if a later call hands it the same input again. It remembers what the first call gave it and keeps writing from where it left off, so only the first call passes it (and a retried process gets a fresh one, so the flag resets). tests/test_aramid.py::test_input_is_only_handed_over_once covers that — it fails with that ValueError if the flag goes away.

[victormlg]

My comments

[victormlg]

This doesn't feel very robust to me. What if instead cf-remote would by default run sudo non-interactively sudo -n ? This would collapse all these errors into a single one: sudo: a password is required. Then you can accurately print this hint.

However, I don't know how the rest of the code would react to this change

[nickanderson]

Taken — the default is sudo -n bash -c now, in 8fc3d4f, so the case that matters collapses to sudo: a password is required the way you described, and that is the first thing checked. The other two wordings stay for a --switch-user-command we were given, which has no -n to ask with.

The part -n doesn't fix, and you were right to poke at it: sudo says that in the caller's language, and ssh forwards LANG/LC_* by default. On Fedora 41 the same failure reads sudo: Ein Passwort ist notwendig, so the hint just went quiet. 75fa7b2 pins LC_ALL=C on the command, which makes the wording we match the one that arrives, with a case in tests/shell/002_sudo_password.sh that fails if the pin goes away.

[victormlg]

Maybe this wouldn't be needed if by default we run sudo -n ? (see other comment)

[nickanderson]

Taken the other two: the default is now sudo -n bash -c, and SwitchUser is built inside run_command_with_args instead of being passed in.

-n and -S can't be combined. -n means never prompt, so sudo -n -S refuses the password. When there is a password the command is still sudo -S -p '' bash -c.

needs_password_on() decides whether the password is written to the child's stdin at all. On a NOPASSWD host, sending it puts it on the stdin of the wrapped command instead of into sudo. (tests/shell/002_sudo_password.sh).

[codecov]

Codecov Report

❌ Patch coverage is 86.61972% with 19 lines in your changes missing coverage. Please review.
✅ Project coverage is 47.53%. Comparing base (40dc552) to head (75fa7b2).

Files with missing lines	Patch %	Lines
cf_remote/commands.py	61.11%	7 Missing ⚠️
cf_remote/main.py	68.75%	5 Missing ⚠️
cf_remote/ssh.py	95.18%	4 Missing ⚠️
cf_remote/aramid.py	83.33%	2 Missing ⚠️
cf_remote/remote.py	83.33%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #199      +/-   ##
==========================================
+ Coverage   44.27%   47.53%   +3.25%     
==========================================
  Files          18       18              
  Lines        3065     3158      +93     
==========================================
+ Hits         1357     1501     +144     
+ Misses       1708     1657      -51     

Files with missing lines	Coverage Δ
cf_remote/args.py	100.00% <100.00%> (ø)
cf_remote/remote.py	30.90% <83.33%> (+0.44%)	⬆️
cf_remote/aramid.py	66.20% <83.33%> (+2.08%)	⬆️
cf_remote/ssh.py	82.50% <95.18%> (+8.09%)	⬆️
cf_remote/main.py	46.53% <68.75%> (+7.38%)	⬆️
cf_remote/commands.py	18.99% <61.11%> (+3.64%)	⬆️

... and 3 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.