Add clarity to the documentation

README.md

@@ -21,25 +21,33 @@ multiple times:
 #### CLI: portzap
 
     # Clone the HardenedBSD ports tree into /home/_portzap/ports/
-    # This command is delegated to the '_portzap' user
+    # This command is delegated to the '_portzap' user and
+    # limited to members of the '_portzap' group
     user@localhost$ portzap clone
 
     # Pull updates into /home/_portzap/ports/
-    # This command is delegated to the '_portzap' user
+    # This command is delegated to the '_portzap' user and
+    # limited to members of the '_portzap' group
     user@localhost$ portzap pull
 
     # Checkout a branch other than the default: hardenedbsd/main
-    # This command is delegated to the '_portzap' user
+    # This command is delegated to the '_portzap' user and
+    # limited to members of the '_portzap' group
     user@localhost$ portzap checkout freebsd/main
 
-    # Install /home/_portzap/ports/ into /usr/ports/
+    # Run /bin/sh within /home/_portzap/ports/
-    # This command requires root privileges
+    # This command is delegated to the '_portzap' user and
-    root@localhost# portzap install
+    # limited to members of the '_portzap' group
+    user@localhost$ portzap sh
 
     # Remove the contents of /usr/ports/ and /home/_portzap/ports/
     # This command requires root privileges
     root@localhost# portzap rm
 
+    # Install /home/_portzap/ports/ into /usr/ports/
+    # This command requires root privileges
+    root@localhost# portzap install
+
 #### Environment
 
 * __$PORTZAP\_CLONEURL__ <br>

bin/portzap

@@ -54,6 +54,10 @@ case $1 in
         require_dependency "git doas"
         "${libexec}"/commands/portzap-checkout "${gitdir}" "${2}"
         ;;
+     "sh")
+        require_dependency "doas"
+        "${libexec}"/commands/portzap-sh "${gitdir}"
+        ;;
     "rm")
         "${libexec}"/commands/portzap-rm "${gitdir}" "${installdir}"
         ;;
@@ -68,6 +72,7 @@ case $1 in
         printf "  clone       Clone the hardenedbsd ports tree\n"
         printf "  pull        Pull updates from the hardenedbsd ports tree\n"
         printf "  checkout    Checkout a branch other than the default\n"
+        printf "  sh          Run /bin/sh within /home/_portzap/ports/\n"
         printf "  rm          Remove /usr/ports/ and /home/_portzap/ports/\n"
         printf "  install     Install the ports tree into /usr/ports/\n"
         ;;

libexec/portzap/commands/portzap-sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+set -e
+
+##
+# variables
+localbase=${LOCALBASE:-$(realpath "$(dirname "$0")"/../../..)}
+libexec="${localbase}"/libexec/portzap
+user=_portzap
+gitdir="${1}"
+
+##
+# functions
+# shellcheck source=/dev/null
+. "${libexec}"/functions/print.sh
+
+##
+# main
+if [ "$(id -u)" = "0" ]; then
+    printerr "you must be a user other than root"
+    exit 1
+fi
+
+if [ ! -e "${gitdir}" ]; then
+    printerr "try 'portzap clone' instead"
+    exit 1
+fi
+
+if ! "${libexec}"/utils/isportzap-member; then
+   printerr "$(id -un) is not a member of _portzap"
+fi
+
+cd "${gitdir}"
+doas -n \
+     -u "${user}" \
+     /bin/sh

man/man8/portzap.8

@@ -23,32 +23,42 @@ can be installed into /usr/ports/ by root.
 .br
 Clone the HardenedBSD ports tree into /home/_portzap/ports/
 .br
-This command is delegated to the '_portzap' user
+This command is delegated to the '_portzap' user and
+limited to members of the '_portzap' group
 .Pp
 .Nm portzap pull
 .br
 Pull updates into /home/_portzap/ports/
 .br
-This command is delegated to the '_portzap' user
+This command is delegated to the '_portzap' user and
+limited to members of the '_portzap' group
 .br
 .Pp
 .Nm portzap checkout
 .br
 Checkout a branch other than the default: hardenedbsd/main
 .br
-This command is delegated to the '_portzap' user
+This command is delegated to the '_portzap' user and
+limited to members of the '_portzap' group
 .Pp
-.Nm portzap install
+.Nm portzap sh
 .br
-Install /home/_portzap/ports/ into /usr/ports/
+Run /bin/sh within /home/_portzap/ports/
 .br
-This command requires root privileges
+This command is delegated to the '_portzap' user and
+limited to members of the '_portzap' group
 .Pp
 .Nm portzap rm
 .br
 Remove the contents of /usr/ports/ and /home/_portzap/ports/
 .br
 This command requires root privileges
+.Pp
+.Nm portzap install
+.br
+Install /home/_portzap/ports/ into /usr/ports/
+.br
+This command requires root privileges
 .br
 .Sh ENVIRONMENT
 .sp