pastilhasandClaude Opus 5
a8335bfdd6
The setup wrote /etc/sudoers.d/officer-service with tee and then chmod'd it. Two problems, both with the same worst case: a malformed or wrongly-permissioned file there breaks sudo completely, and you cannot sudo to repair it — on a remote machine that means physical access or a rescue boot. Generate into a temp file, gate on `visudo -c`, and only then install. Use install(1) rather than tee+chmod so the content and the 0440 mode land in one step; tee creates at the default umask first, and sudo refuses to read a sudoers file with loose permissions, so the old ordering had a window where sudo could reject its own configuration. The re-run guard also grepped for the username anywhere in the file, so a comment mentioning it counted as configured. Match the actual rule instead. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>