Avoiding password while compiling ports

[nukey]

Is there a secure and simple way to prevent the compilation process from asking for my password more than once? The documentation suggests avoiding root for compilation, which makes sense, so I set up to compile as my regular user. However, the "persist" option in doas.conf seems more like a "pester" option because it asks for my password incessantly. I usually end up resorting to the "nopass" option but that just seems terribly insecure. What is the best way to work around this problem?

[ibara]

"persist" is only for a limited time (5 minutes, IIRC). With persist off, it's at every doas issuance, even if they're only a microsecond apart.

Some options:
1. Set your PREFIX, LOCALBASE, and TRUEPREFIX to directories that you have write access to, and add it LOCALBASE/bin directory to your PATH. That seems like a bad option.
2. Set nopass and use strong passwords locally and ssh keys only remotely. That sounds wise.
3. Use packages instead of ports. How many ports are you building anyway? Why? You almost certainly don't need to be building packages yourself.

[nukey]

While compiling ports, the "persist" option makes no difference, it still asks for my password even if they are a microsecond apart. I suppose I will stick with option 2 for now.

I'm compiling ports listed by out-of-date, because -release and -stable packages do not receive security updates. I'm not ready for -current yet.

What about a possible option 4) Create a dedicated build user with the bare minimum permissions necessary to build/install ports? I'm not experienced enough to know how to do that correctly, I'm just thinking aloud.

[jggimi]

Hello and welcome!

... -release and -stable packages do not receive security updates.

Port maintainers will produce -stable patches for CVEs. That is the primary purpose of the -stable branch of the ports tree. But the Project does not build -stable packages. M:Tier (https://stable.mtier.org) does, as a service.

4) Create a dedicated build user with the bare minimum permissions necessary to build/install ports?

The Distributed Ports Builder dpb(1) may be helpful. It is started as root; it drops privileges for fetch, build, and log operations.