From 7d8a9fa0e14be83d2301485a669ffcbc0eb7f0cb Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Sat, 14 Jun 2025 08:57:13 +0200
Subject: [PATCH] nixos-rebuild: restore local sudo functionality

This functionality used to exist and was then removed in #331741. The
issue was that $SUDO_USER is already used by `sudo` as an environment
variable.

This change makes it possible to checkout a flake repository, as a user,
enter the devshell, and with the additions below and apply changes with
`nixos-rebuild switch`.

```nix
{ pkgs }:
let
  nixos-rebuild = pkgs.writeShellApplication {
    name = "nixos-rebuild";
    runtimeInputs = [ pkgs.nixos-rebuild ];
    text = ''
      set -euo pipefail
      exec nixos-rebuild --flake "$PRJ_ROOT" --use-local-sudo "$@"
    '';
  };
in
pkgs.mkShellNoCC {
  packages = [
    nixos-rebuild
  ];

  shellHook = ''
    export PRJ_ROOT=$PWD
  '';
}
```
---
 pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 74ca23a8b6ca..6c22a46bdcef 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -33,6 +33,7 @@ imageVariant=
 buildHost=
 targetHost=
 remoteSudo=
+localSudo=
 noSSHTTY=
 verboseScript=
 noFlake=
@@ -173,6 +174,9 @@ while [ "$#" -gt 0 ]; do
       --use-remote-sudo)
         remoteSudo=1
         ;;
+      --use-local-sudo)
+        localSudo=1
+        ;;
       --no-ssh-tty)
         noSSHTTY=1
         ;;
@@ -256,7 +260,7 @@ targetHostSudoCmd() {
         t="-t"
     fi
 
-    if [ -n "$remoteSudo" ]; then
+    if [[ -n "$remoteSudo" || -n "$localSudo" ]]; then
         useSudo=1 SSHOPTS="$SSHOPTS $t" targetHostCmd "$@"
     else
         # While a tty might not be necessary, we apply it to be consistent with