Defaults passprompt="[sudo] password for %u on %h: "
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+# Find binaries to be executed as archvsync user also in its home, so the
+# caller does not need to know.
Defaults>archvsync secure_path="/home/archvsync/bin:/usr/local/bin:/usr/bin:/bin"
# Host alias specification
Host_Alias PIUPARTS_SLAVE_HOSTS = piu-slave-bm-a, piu-slave-ubc-01
Host_Alias MQ_HOSTS = rainier, rapoport
Host_Alias JENKINSHOSTS = jerea
-Host_Alias SIGNINGHOSTS = fasolo
# Cmnd alias specification
dak ALL=(dak-unpriv) NOPASSWD: ALL
# and ftpmaster can access the role user for their web services
%debadmin FTPHOSTS=(dak-web) ALL
-# the dak user gets to sign stuff
-dak SIGNINGHOSTS=(codesign) /usr/local/bin/secure-boot-code-sign
# some groups are in apachectrl on "their" hosts so they can reload apache and update their vhost
%apachectrl ALL=(root) /usr/sbin/apache2-vhost-update
%wbadm BUILDD_MASTER=(wb-buildd) ALL
%wbadm BUILDD_MASTER=(root) /usr/local/bin/update-buildd-sshkeys
# mirror push
-dak FTPHOSTS,SECHOSTS=(archvsync) NOPASSWD:/home/archvsync/runmirrors
+dak FTPHOSTS,SECHOSTS=(archvsync) NOPASSWD:/home/archvsync/runmirrors, /home/archvsync/bin/runmirrors
# archvsync triggers snapshot
archvsync sibelius=(snapshot) NOPASSWD: /srv/snapshot.debian.org/bin/update-trigger
archvsync sibelius=(snapshot) NOPASSWD: /srv/2ndsnapshot/bin/update-trigger