this is now a template

Signed-off-by: Stephen Gran <steve@lobefin.net>

diff --git a/modules/sudo/files/common/sudoers b/modules/sudo/files/common/sudoers
deleted file mode 100644 (file)
index 1a45f67..0000000
--- a/modules/sudo/files/common/sudoers
+++ /dev/null
@@ -1,181 +0,0 @@
-# /etc/sudoers
-##
-## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
-## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
-##
-
-###################################################################
-###################################################################
-###################################################################
-##
-## PLEASE EDIT THIS FILE WITH THE visudo COMMAND TO ENSURE IT
-## IS SYNTACTICALLY VALID.
-##
-##  /usr/sbin/visudo -f sudoers
-##
-###################################################################
-###################################################################
-###################################################################
-
-Defaults       env_reset
-Defaults       passprompt="[sudo] password for %u on %h: "
-Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-
-# Host alias specification
-Host_Alias     QAHOSTS         = master, quantz, stabile
-Host_Alias     WEBHOSTS        = wolkenstein
-Host_Alias     SECHOSTS        = chopin
-Host_Alias     FTPHOSTS        = franck, morricone
-Host_Alias     ZIVITHOSTS      = zelenka, zandonai
-Host_Alias     AACRAIDHOSTS    = bellini, morricone, paganini, respighi, vivaldi, beethoven, pettersson
-Host_Alias     MEGARAIDHOSTS   = grieg, rautavaara, sibelius
-Host_Alias     MPTRAIDHOSTS    = master, fasch, holter, barber, biber, cilea, vitry, krenek, scelsi, orff, field
-Host_Alias     MEGACTLHOSTS    = lindberg, englund, heininen
-
-# Cmnd alias specification
-
-# User privilege specification
-root   ALL=(ALL) ALL
-
-
-# DSA and local admins
-%adm           ALL=(ALL)       ALL
-%adm           ALL=(ALL)       NOPASSWD: /usr/bin/apt-get update, /usr/bin/apt-get upgrade, /usr/bin/apt-get dist-upgrade, /usr/bin/apt-get clean, /usr/sbin/samhain -t check -i -p err -s none -l none -m none, /usr/sbin/upgrade-porter-chroots
-
-admin          agnesi=(ALL)    ALL
-%zivit-admins  ZIVITHOSTS=(ALL)        NOPASSWD: ALL
-
-# nagios
-nagios         ALL=(ALL)       NOPASSWD: /etc/init.d/ekeyd-egd-linux restart
-nagios         ALL=(ALL)       NOPASSWD: /usr/lib/nagios/plugins/dsa-check-dabackup ""
-# with smartarray controllers
-nagios         ALL=(ALL)       NOPASSWD: /sbin/hpasmcli ""
-nagios         ALL=(ALL)       NOPASSWD: /usr/bin/arrayprobe ""
-nagios         franck=(ALL)    NOPASSWD: /usr/bin/arrayprobe -f /dev/cciss/c1d0
-nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/hpacucli controller all show
-nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/hpacucli controller slot=[0129] pd all show
-nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/hpacucli controller slot=[0129] pd [0-9]\:[0-9] show
-nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/hpacucli controller slot=[0129] pd [0-9][EIC]\:[0-9]\:[0-9] show
-nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/hpacucli controller slot=[0129] pd [0-9][EIC]\:[0-9]\:[0-9][0-9] show
-nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/hpacucli controller slot=[0129] show status
-nagios         franck=(ALL)    NOPASSWD: /usr/sbin/hpacucli controller slot=1 enclosure 1E\:1 show detail
-
-# other raid controllers
-nagios         powell=(ALL)    NOPASSWD: /usr/local/sbin/areca-cli vsf info
-nagios         puccini=(ALL)   NOPASSWD: /usr/local/bin/tw_cli info c0 u0 status
-nagios         MPTRAIDHOSTS=(ALL)      NOPASSWD: /usr/sbin/mpt-status -s
-nagios         AACRAIDHOSTS=(ALL)      NOPASSWD: /usr/local/bin/arcconf GETCONFIG 1 LD, /usr/local/bin/arcconf GETCONFIG 1 AD
-nagios         MEGARAIDHOSTS=(ALL)     NOPASSWD: /usr/local/bin/megarc -AllAdpInfo -nolog, /usr/local/bin/megarc -dispCfg -a0 -nolog
-nagios         MEGACTLHOSTS=(ALL)      NOPASSWD: /usr/sbin/megactl -Hv
-# other nagios things
-nagios         beethoven=(debbackup)   NOPASSWD: /usr/lib/nagios/plugins/dsa-check-backuppg ""
-
-# groups and their role accounts
-%auditor       ALL=(accounting)        ALL
-%backports     ALL=(backports) ALL
-%buildd                ALL=(buildd)    ALL
-%d-i           ALL=(d-i)       ALL
-%dde           ALL=(dde)       ALL
-%ddtp          ALL=(ddtp)      ALL
-%debadmin      ALL=(dak)       ALL
-%debbugs       ALL=(debbugs)   ALL
-%debbugs       ALL=(debbugs-mirror)    ALL
-%debian-cd     ALL=(debian-cd) ALL
-%debian-i18n   ALL=(debian-i18n)       ALL
-%debian-release        ALL=(release)   ALL
-%debvoip       cilea=(freeswitch)      ALL
-%debwww                ALL=(debwww)    ALL
-%btslink       ALL=(btslink)   ALL
-%emdebian      ALL=(emdebian)  ALL
-%forums                ALL=(forums)    ALL
-%keyring       ALL=(keyring)   ALL
-%lintian       ALL=(lintian)   ALL
-%listweb       ALL=(listweb)   ALL
-%list          liszt=(list)    ALL
-%mirroradm     ALL=(archvsync) ALL
-%nm            ALL=(nm)        ALL
-%patch-tracker ALL=(patch-tracker)     ALL
-%piuparts      ALL=(piupartsm) ALL
-%piuparts      ALL=(piupartss) ALL
-%pkg_maint     ALL=(pkg_user)  ALL
-%planet                ALL=(planet)    ALL
-%popcon                ALL=(popcon)    ALL
-%search                ALL=(search)    ALL
-%secretary     ALL=(secretary) ALL
-%sectracker    ALL=(sectracker)        ALL
-%security      SECHOSTS=(mail_security)        ALL
-%snapshot      ALL=(snapshot)  ALL
-%uddadm                ALL=(udd)       ALL
-%volatile      ALL=(volatile)  ALL
-%wbadm         ALL=(wbadm)     ALL
-%mujeres       ALL=(women)     ALL
-%wikiadm       ALL=(wiki)      ALL
-%qa-core       QAHOSTS=(qa)    ALL
-%gobby         gombert=(gobby) ALL
-
-# the dak user gets to run stuff as dak-unpriv (for things like lintian checks)
-dak            ALL=(dak-unpriv)        NOPASSWD: ALL
-
-# some groups are in apachectrl on "their" hosts so they can reload apache and update their vhost
-%apachectrl    ALL=(root)      /usr/sbin/apache2-vhost-update
-
-# buildd
-# FIXME: change that ALL for hosts to a hostlist of buildds?
-Defaults:buildd env_reset,env_keep+="APT_CONFIG DEBIAN_FRONTEND"
-buildd         ALL=(ALL)               NOPASSWD: ALL
-
-# The piuparts slave needs to handle chroots
-piupartss      piatti=(ALL)            NOPASSWD: ALL
-# trigger of mirror run for packages
-pkg_user       powell=(archvsync)      NOPASSWD: /home/archvsync/bin/pushpdo
-# on draghi, the domains git thing will run bind9 reload afterwards
-%dnsadm                draghi,orff=(root)              NOPASSWD: /etc/init.d/bind9 reload
-%dnsadm                draghi,orff=(geodnssync)        NOPASSWD: /usr/bin/make -C /srv/dns.debian.org/geo
-%adm           draghi=(puppet)                 NOPASSWD: /usr/bin/make -s -C /srv/db.debian.org/var/gitnagios/dsa-nagios/config install
-# remote power to babylon5 in the same rack:
-joerg          unger=(ALL)             /usr/bin/sispmctl -t [12], /usr/bin/sispmctl -g [12]
-# wbadm can update all buildd* users' keys on buildd.d.o
-%wbadm         grieg=(root)            /usr/local/bin/update-buildd-sshkeys
-wbadm          grieg=(postgres)        NOPASSWD: /usr/bin/pg_dumpall --cluster 8.4/wanna-build
-# mirror push
-dak            FTPHOSTS,SECHOSTS=(archvsync)   NOPASSWD:/home/archvsync/runmirrors
-planet         senfl=(archvsync)       NOPASSWD: /home/archvsync/bin/runplanet ""
-# archvsync triggers snapshot
-archvsync      sibelius,stabile=(snapshot)     NOPASSWD: /srv/snapshot.debian.org/bin/update-trigger
-archvsync      sibelius,stabile=(snapshot)     NOPASSWD: /srv/2ndsnapshot/bin/update-trigger
-# allow the debbugs-mirror user on rietz to release the afs volume so changes make it to the read-only replicas
-debbugs-mirror rietz=(root)            NOPASSWD: /usr/bin/vos release -id srv.mirrors.bugs -localauth
-# dak stuff
-%debian-release        FTPHOSTS=(dak)          /usr/local/bin/dak transitions --import *
-%ftpteam       FTPHOSTS=(dak)          /usr/local/bin/dak transitions --import *
-# security
-%security      SECHOSTS=(dak)          NOPASSWD: /usr/local/bin/dak new-security-install -[AR]
-%sec_public    SECHOSTS=(dak)          NOPASSWD: /usr/local/bin/dak new-security-install -[AR]
-%sec_public    SECHOSTS=(dak)          NOPASSWD: /home/dak/trigger_mirror
-dak            SECHOSTS=(archvsync)    NOPASSWD: /home/archvsync/signal_security
-# web stuff
-debwww         WEBHOSTS=(archvsync)    NOPASSWD: /home/archvsync/webmirrors/runmirrors
-%press         WEBHOSTS=(debwww)       /org/www.debian.org/update-part News
-# more list stuff
-%list          liszt=(root)            /usr/sbin/postfix reload
-%list          liszt=(root)            /usr/sbin/qshape, /usr/sbin/postsuper
-%list          liszt=(root)            /etc/init.d/spamassassin, /etc/init.d/amavis
-%list          liszt=(amavis)          NOPASSWD: /usr/bin/sa-learn
-%list          liszt=(amavis)          ALL
-# geodns may reload bind
-geodnssync     geo1,geo2,geo3=(root)   NOPASSWD: /etc/init.d/bind9 reload
-geodnssync     geo1,geo2,geo3=(root)   NOPASSWD: /usr/sbin/rndc reconfig
-# fossology
-%fossy         vivaldi=(root)          /etc/init.d/fossology
-%fossy         vivaldi=(fossy)         ALL
-
-# Porter work
-%porter-alpha  albeniz=(root)          NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
-%porter-armel  abel,agricola=(root)    NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
-%porter-amd64  pergolesi=(root)        NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
-%porter-hppa   paer=(root)             NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
-%porter-ia64   merulo=(root)           NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
-%porter-mips   gabrielli=(root)        NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
-%porter-ppc    pescetti=(root)         NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
-%porter-s390   zelenka=(root)          NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
-%porter-sparc  smetana,sperger,zee=(root)      NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot

diff --git a/modules/sudo/manifests/init.pp b/modules/sudo/manifests/init.pp
index d774a8f6c203aa5e95f039667625b8cae6029452..887168cd3d71eb32cc0544a82aaa25d16a7187da 100644 (file)
--- a/modules/sudo/manifests/init.pp
+++ b/modules/sudo/manifests/init.pp
@@ -5,8 +5,7 @@ class sudo {
                owner   => root,
                group   => root,
                mode    => 440,
-               source  => [ "puppet:///modules/sudo/per-host/$fqdn/sudoers",
-                            "puppet:///modules/sudo/common/sudoers" ],
+               content => template("sudo/sudoers.erb"),
                require => Package["sudo"]
                 ;
               "/etc/pam.d/sudo":

diff --git a/modules/sudo/templates/sudoers.erb b/modules/sudo/templates/sudoers.erb
new file mode 100644 (file)
index 0000000..c0ec5f6
--- /dev/null
+++ b/modules/sudo/templates/sudoers.erb
@@ -0,0 +1,183 @@
+# /etc/sudoers
+##
+## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
+## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
+##
+
+###################################################################
+###################################################################
+###################################################################
+##
+## PLEASE EDIT THIS FILE WITH THE visudo COMMAND TO ENSURE IT
+## IS SYNTACTICALLY VALID.
+##
+##  /usr/sbin/visudo -f sudoers
+##
+###################################################################
+###################################################################
+###################################################################
+
+Defaults       env_reset
+Defaults       passprompt="[sudo] password for %u on %h: "
+<% if nodeinfo.has_key?('wheezy') and nodeinfo['wheezy'] %>
+Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+<% end %>
+
+# Host alias specification
+Host_Alias     QAHOSTS         = master, quantz, stabile
+Host_Alias     WEBHOSTS        = wolkenstein
+Host_Alias     SECHOSTS        = chopin
+Host_Alias     FTPHOSTS        = franck, morricone
+Host_Alias     ZIVITHOSTS      = zelenka, zandonai
+Host_Alias     AACRAIDHOSTS    = bellini, morricone, paganini, respighi, vivaldi, beethoven, pettersson
+Host_Alias     MEGARAIDHOSTS   = grieg, rautavaara, sibelius
+Host_Alias     MPTRAIDHOSTS    = master, fasch, holter, barber, biber, cilea, vitry, krenek, scelsi, orff, field
+Host_Alias     MEGACTLHOSTS    = lindberg, englund, heininen
+
+# Cmnd alias specification
+
+# User privilege specification
+root   ALL=(ALL) ALL
+
+
+# DSA and local admins
+%adm           ALL=(ALL)       ALL
+%adm           ALL=(ALL)       NOPASSWD: /usr/bin/apt-get update, /usr/bin/apt-get upgrade, /usr/bin/apt-get dist-upgrade, /usr/bin/apt-get clean, /usr/sbin/samhain -t check -i -p err -s none -l none -m none, /usr/sbin/upgrade-porter-chroots
+
+admin          agnesi=(ALL)    ALL
+%zivit-admins  ZIVITHOSTS=(ALL)        NOPASSWD: ALL
+
+# nagios
+nagios         ALL=(ALL)       NOPASSWD: /etc/init.d/ekeyd-egd-linux restart
+nagios         ALL=(ALL)       NOPASSWD: /usr/lib/nagios/plugins/dsa-check-dabackup ""
+# with smartarray controllers
+nagios         ALL=(ALL)       NOPASSWD: /sbin/hpasmcli ""
+nagios         ALL=(ALL)       NOPASSWD: /usr/bin/arrayprobe ""
+nagios         franck=(ALL)    NOPASSWD: /usr/bin/arrayprobe -f /dev/cciss/c1d0
+nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/hpacucli controller all show
+nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/hpacucli controller slot=[0129] pd all show
+nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/hpacucli controller slot=[0129] pd [0-9]\:[0-9] show
+nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/hpacucli controller slot=[0129] pd [0-9][EIC]\:[0-9]\:[0-9] show
+nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/hpacucli controller slot=[0129] pd [0-9][EIC]\:[0-9]\:[0-9][0-9] show
+nagios         ALL=(ALL)       NOPASSWD: /usr/sbin/hpacucli controller slot=[0129] show status
+nagios         franck=(ALL)    NOPASSWD: /usr/sbin/hpacucli controller slot=1 enclosure 1E\:1 show detail
+
+# other raid controllers
+nagios         powell=(ALL)    NOPASSWD: /usr/local/sbin/areca-cli vsf info
+nagios         puccini=(ALL)   NOPASSWD: /usr/local/bin/tw_cli info c0 u0 status
+nagios         MPTRAIDHOSTS=(ALL)      NOPASSWD: /usr/sbin/mpt-status -s
+nagios         AACRAIDHOSTS=(ALL)      NOPASSWD: /usr/local/bin/arcconf GETCONFIG 1 LD, /usr/local/bin/arcconf GETCONFIG 1 AD
+nagios         MEGARAIDHOSTS=(ALL)     NOPASSWD: /usr/local/bin/megarc -AllAdpInfo -nolog, /usr/local/bin/megarc -dispCfg -a0 -nolog
+nagios         MEGACTLHOSTS=(ALL)      NOPASSWD: /usr/sbin/megactl -Hv
+# other nagios things
+nagios         beethoven=(debbackup)   NOPASSWD: /usr/lib/nagios/plugins/dsa-check-backuppg ""
+
+# groups and their role accounts
+%auditor       ALL=(accounting)        ALL
+%backports     ALL=(backports) ALL
+%buildd                ALL=(buildd)    ALL
+%d-i           ALL=(d-i)       ALL
+%dde           ALL=(dde)       ALL
+%ddtp          ALL=(ddtp)      ALL
+%debadmin      ALL=(dak)       ALL
+%debbugs       ALL=(debbugs)   ALL
+%debbugs       ALL=(debbugs-mirror)    ALL
+%debian-cd     ALL=(debian-cd) ALL
+%debian-i18n   ALL=(debian-i18n)       ALL
+%debian-release        ALL=(release)   ALL
+%debvoip       cilea=(freeswitch)      ALL
+%debwww                ALL=(debwww)    ALL
+%btslink       ALL=(btslink)   ALL
+%emdebian      ALL=(emdebian)  ALL
+%forums                ALL=(forums)    ALL
+%keyring       ALL=(keyring)   ALL
+%lintian       ALL=(lintian)   ALL
+%listweb       ALL=(listweb)   ALL
+%list          liszt=(list)    ALL
+%mirroradm     ALL=(archvsync) ALL
+%nm            ALL=(nm)        ALL
+%patch-tracker ALL=(patch-tracker)     ALL
+%piuparts      ALL=(piupartsm) ALL
+%piuparts      ALL=(piupartss) ALL
+%pkg_maint     ALL=(pkg_user)  ALL
+%planet                ALL=(planet)    ALL
+%popcon                ALL=(popcon)    ALL
+%search                ALL=(search)    ALL
+%secretary     ALL=(secretary) ALL
+%sectracker    ALL=(sectracker)        ALL
+%security      SECHOSTS=(mail_security)        ALL
+%snapshot      ALL=(snapshot)  ALL
+%uddadm                ALL=(udd)       ALL
+%volatile      ALL=(volatile)  ALL
+%wbadm         ALL=(wbadm)     ALL
+%mujeres       ALL=(women)     ALL
+%wikiadm       ALL=(wiki)      ALL
+%qa-core       QAHOSTS=(qa)    ALL
+%gobby         gombert=(gobby) ALL
+
+# the dak user gets to run stuff as dak-unpriv (for things like lintian checks)
+dak            ALL=(dak-unpriv)        NOPASSWD: ALL
+
+# some groups are in apachectrl on "their" hosts so they can reload apache and update their vhost
+%apachectrl    ALL=(root)      /usr/sbin/apache2-vhost-update
+
+# buildd
+# FIXME: change that ALL for hosts to a hostlist of buildds?
+Defaults:buildd env_reset,env_keep+="APT_CONFIG DEBIAN_FRONTEND"
+buildd         ALL=(ALL)               NOPASSWD: ALL
+
+# The piuparts slave needs to handle chroots
+piupartss      piatti=(ALL)            NOPASSWD: ALL
+# trigger of mirror run for packages
+pkg_user       powell=(archvsync)      NOPASSWD: /home/archvsync/bin/pushpdo
+# on draghi, the domains git thing will run bind9 reload afterwards
+%dnsadm                draghi,orff=(root)              NOPASSWD: /etc/init.d/bind9 reload
+%dnsadm                draghi,orff=(geodnssync)        NOPASSWD: /usr/bin/make -C /srv/dns.debian.org/geo
+%adm           draghi=(puppet)                 NOPASSWD: /usr/bin/make -s -C /srv/db.debian.org/var/gitnagios/dsa-nagios/config install
+# remote power to babylon5 in the same rack:
+joerg          unger=(ALL)             /usr/bin/sispmctl -t [12], /usr/bin/sispmctl -g [12]
+# wbadm can update all buildd* users' keys on buildd.d.o
+%wbadm         grieg=(root)            /usr/local/bin/update-buildd-sshkeys
+wbadm          grieg=(postgres)        NOPASSWD: /usr/bin/pg_dumpall --cluster 8.4/wanna-build
+# mirror push
+dak            FTPHOSTS,SECHOSTS=(archvsync)   NOPASSWD:/home/archvsync/runmirrors
+planet         senfl=(archvsync)       NOPASSWD: /home/archvsync/bin/runplanet ""
+# archvsync triggers snapshot
+archvsync      sibelius,stabile=(snapshot)     NOPASSWD: /srv/snapshot.debian.org/bin/update-trigger
+archvsync      sibelius,stabile=(snapshot)     NOPASSWD: /srv/2ndsnapshot/bin/update-trigger
+# allow the debbugs-mirror user on rietz to release the afs volume so changes make it to the read-only replicas
+debbugs-mirror rietz=(root)            NOPASSWD: /usr/bin/vos release -id srv.mirrors.bugs -localauth
+# dak stuff
+%debian-release        FTPHOSTS=(dak)          /usr/local/bin/dak transitions --import *
+%ftpteam       FTPHOSTS=(dak)          /usr/local/bin/dak transitions --import *
+# security
+%security      SECHOSTS=(dak)          NOPASSWD: /usr/local/bin/dak new-security-install -[AR]
+%sec_public    SECHOSTS=(dak)          NOPASSWD: /usr/local/bin/dak new-security-install -[AR]
+%sec_public    SECHOSTS=(dak)          NOPASSWD: /home/dak/trigger_mirror
+dak            SECHOSTS=(archvsync)    NOPASSWD: /home/archvsync/signal_security
+# web stuff
+debwww         WEBHOSTS=(archvsync)    NOPASSWD: /home/archvsync/webmirrors/runmirrors
+%press         WEBHOSTS=(debwww)       /org/www.debian.org/update-part News
+# more list stuff
+%list          liszt=(root)            /usr/sbin/postfix reload
+%list          liszt=(root)            /usr/sbin/qshape, /usr/sbin/postsuper
+%list          liszt=(root)            /etc/init.d/spamassassin, /etc/init.d/amavis
+%list          liszt=(amavis)          NOPASSWD: /usr/bin/sa-learn
+%list          liszt=(amavis)          ALL
+# geodns may reload bind
+geodnssync     geo1,geo2,geo3=(root)   NOPASSWD: /etc/init.d/bind9 reload
+geodnssync     geo1,geo2,geo3=(root)   NOPASSWD: /usr/sbin/rndc reconfig
+# fossology
+%fossy         vivaldi=(root)          /etc/init.d/fossology
+%fossy         vivaldi=(fossy)         ALL
+
+# Porter work
+%porter-alpha  albeniz=(root)          NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-armel  abel,agricola=(root)    NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-amd64  pergolesi=(root)        NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-hppa   paer=(root)             NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-ia64   merulo=(root)           NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-mips   gabrielli=(root)        NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-ppc    pescetti=(root)         NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-s390   zelenka=(root)          NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot
+%porter-sparc  smetana,sperger,zee=(root)      NOPASSWD: /usr/sbin/upgrade-porter-chroots, /usr/bin/apt-in-chroot