Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-4904GitHub issuePublicReceived

omarchy update prompts for password even when the user has a NOPASSWD sudoers drop-in (sudo -v gate)

Reported by christianjgilman · filed Sep 5, 2026Closed upstream on 2026-09-21 by bjarneo via an automated message, as a duplicate of #9066 (R-1233). GitHub close reason: completed.

Open at source
Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
Not yet mapped to any requirement or component.
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

omarchy update prompts for password even when the user has a NOPASSWD sudoers drop-in (sudo -v gate)revision 1 · captured 2026-10-04 12:10 UTC via poll

Setup (reproducible)

User enables passwordless sudo the standard way — a separate drop-in:

# /etc/sudoers.d/zzz-nopasswd  (0440)
<user> ALL=(ALL:ALL) NOPASSWD: ALL

…while omarchy's stock /etc/sudoers.d/04_<user> (<user> ALL=(ALL) ALL) remains. Every actual sudo <cmd> runs without a password. But omarchy update (via the omarchy-update-stay-awake start → sudo -v gate) stalls at `[sudo] password for user:` and the update fails — even with update -y, which promises unattended operation.

Cause

sudo -v demands a password when any sudoers rule matching the user lacks NOPASSWD. With two matching user rules (stock 04_<user> password-required + new drop-in NOPASSWD), validation prompts — even though command execution is passwordless.

Workarounds (both verified)

  1. Put NOPASSWD: ALL into the existing 04_<user> file instead of a separate drop-in (last-rule-wins then resolves to NOPASSWD for everything).
  2. Additionally/alternatively: Defaults verifypw=never in a sudoers drop-in.

Suggestion

Either:
- document this on the passwordless-sudo path (it cost a nontrivial debugging session — the failure is invisible: actual sudo commands work fine, only sudo -v prompts), or
- make the updater tolerate non-interactive use: sudo -n -v and skip/continue when validation would prompt, since -y explicitly promises no questions.

View raw text
### Setup (reproducible)

User enables passwordless sudo the standard way — a **separate** drop-in:

```
# /etc/sudoers.d/zzz-nopasswd  (0440)
<user> ALL=(ALL:ALL) NOPASSWD: ALL
```

…while omarchy's stock `/etc/sudoers.d/04_<user>` (`<user> ALL=(ALL) ALL`) remains. Every actual `sudo <cmd>` runs without a password. But `omarchy update` (via the `omarchy-update-stay-awake start` → `sudo -v` gate) **stalls at `[sudo] password for user:`** and the update fails — even with `update -y`, which promises unattended operation.

### Cause

`sudo -v` demands a password when **any** sudoers rule matching the user lacks `NOPASSWD`. With two matching user rules (stock `04_<user>` password-required + new drop-in NOPASSWD), validation prompts — even though command execution is passwordless.

### Workarounds (both verified)

1. Put `NOPASSWD: ALL` into the existing `04_<user>` file instead of a separate drop-in (last-rule-wins then resolves to NOPASSWD for everything).
2. Additionally/alternatively: `Defaults verifypw=never` in a sudoers drop-in.

### Suggestion

Either:
- document this on the passwordless-sudo path (it cost a nontrivial debugging session — the failure is invisible: actual sudo commands work fine, only `sudo -v` prompts), **or**
- make the updater tolerate non-interactive use: `sudo -n -v` and skip/continue when validation would prompt, since `-y` explicitly promises no questions.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.