# Allow the unprivileged service user to run ONLY the APT OTA updater as root,
# without a password. Installed 0440 root:root by the .deb. With no argument
# spec after the path, sudo permits any arguments (the desired version varies),
# but the command itself is pinned to this exact script.
collector ALL=(root) NOPASSWD: /opt/zarv/updater/apt-update.sh
