darwin-rebuild: Don't prompt for sudo multiple times

pkgs/nix-tools/darwin-rebuild.sh

@@ -21,17 +21,16 @@ showSyntax() {
   exit 1
 }
 
-sudo() {
-  # REMOVEME when support for macOS 10.13 is dropped
-  # macOS 10.13 does not support sudo --preserve-env so we make this conditional
-  if command sudo --help | grep -- --preserve-env= >/dev/null; then
-    # We use `env` before our command to ensure the preserved PATH gets checked
-    # when trying to resolve the command to execute
-    command sudo -H --preserve-env=PATH --preserve-env=SSH_CONNECTION env "$@"
-  else
-    command sudo -H "$@"
-  fi
-}
+# REMOVEME when support for macOS 10.13 is dropped
+# macOS 10.13 does not support sudo --preserve-env so we make this conditional
+if /usr/bin/sudo --help | grep -- --preserve-env= >/dev/null; then
+  # We use `env` before our command to ensure the preserved PATH gets checked
+  # when trying to resolve the command to execute
+  sudo="/usr/bin/sudo -H --preserve-env=PATH --preserve-env=SSH_CONNECTION"
+else
+  sudo="/usr/bin/sudo -H"
+fi
+sudo() { $sudo "$@"; }
 
 # Parse the command line.
 origArgs=("$@")
@@ -224,11 +223,15 @@ if [ "$action" = switch ]; then
 fi
 
 if [ "$action" = switch ] || [ "$action" = activate ] || [ "$action" = rollback ]; then
-  "$systemConfig/activate-user"
-
   if [ "$USER" != root ]; then
-    sudo "$systemConfig/activate"
+    # Running `$systemConfig/activate-user` causes subsequent sudo invocations to prompt
+    # for the password even if we previously ran sudo in the same session; indeed, by this
+    # point we've already run `nix-env --set` as sudo. To avoid prompting a second time,
+    # we become root *before* running activate-user and then drop down to the user to
+    # invoke it. This way, the call to activate doesn't require a password.
+    sudo @shell@ -c "$sudo -u $USER $systemConfig/activate-user && $systemConfig/activate"
   else
+    "$systemConfig/activate-user"
     "$systemConfig/activate"
   fi
 fi