run_before_fix-sudo.sh.tmpl

#!/bin/bash
{{ if eq .chezmoi.os "darwin" }}
# setup sudo to accept touchid
if ! grep -q pam_tid /etc/pam.d/sudo; then
  (echo 1a; echo 'auth       sufficient     pam_tid.so'; echo .; echo w) | sudo ed - /etc/pam.d/sudo
  echo '=> macOS: updated sudoers to allow touchid auth'
else
  echo '=> macOS: no need to update sudoers'
fi
{{ end }}