From 734adfba7d2bf5673c89c97e9d023f0ff0943d2a Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 21 Sep 2026 20:17:52 +0000 Subject: [PATCH] docs(changelog): record #602 in the 3.5.0 section #602 merged into main after #601, the same way #600 merged during it, and also touched no CHANGELOG. So the section was still a commit short of what v3.5.0 will actually ship. It gets its own "Installers" subsection rather than a line under "Small fixes": a malformed drop-in in /etc/sudoers.d makes sudo refuse every command for every user, which on a headless Pi is unrecoverable over SSH. That is not a small fix, and someone reading the release notes to decide whether to update should see it. Written from the commit: what both installers did, what `visudo -c` now gates, and the fixed /tmp path that mktemp replaced. `scripts/check_release_version.py v3.5.0` still passes, and this branch is rebased onto 967f3a05 so the section now covers every commit since v3.4.0. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01Rqzd6Nz2bQJp5K7DD5dS4X --- CHANGELOG.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 182a6fd4..c7f2c629 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -367,6 +367,19 @@ New modules a plugin may import via `src.*` (floor on 3.5.0): budget, so a rollback finishes inside the unit's 30-minute limit instead of being killed mid-way. +### Installers + +- The generated `ledmatrix_web` sudoers rules are parsed before they are + installed. Both installers built the drop-in from `which` lookups and copied + it into `/etc/sudoers.d` without ever checking it, and a malformed file there + makes sudo refuse every command for every user — on a headless Pi, that is + unrecoverable over SSH. `first_time_install.sh` now runs `visudo -c` on the + generated file and, if it does not parse, prints what visudo said and leaves + the installed file untouched instead of replacing it with a broken one; + `configure_web_sudo.sh` does the same before offering the rules for + confirmation. `first_time_install.sh` also built that file at a fixed `/tmp` + path as root; `mktemp` now picks the name. + ### Small fixes (update-all, plugin system settings, scripts) - **Check & Update All** counts a plugin that had nothing to update as