@local + sudo unusable when using PAM fingerprint support in fedora 34

Describe the bug

Fedora 34 sets up PAM with support for fingerprint support in PAM. That means I can put my fingerprint on the reader and sudo will let me through. Unfortunate, this means that every pyinfra sudo call will ask for a fingerprint which has to time out to finally let the normal password (Which pyinfra supplies in a env variable) take over.

To Reproduce

Laptop with fingerprint support, setup to let sudo be authenticated by the fingerprint (default on fedora 34). Add a ´dnf.packages` task with like 10+ packages -> there is one sudo call for each package, all of them waiting for the fingerprint timeout 😦

Expected behavior

I will only get asked once for my password.

I suspect that this isn’t easily solveable by pyinfra (i also saw a google result for the same thing in ansible) 😦 but I wonder if it would be possible to use a (cached) pty for all calls so that sudo itself caches credentials?

[jankatins]

Also reported as a feature request to sudo: https://github.com/sudo-project/sudo/issues/112

[Fizzadar]

Shifting this to a documentation issue now sudo has a fix for this, need to make sure this is well highlighted alongside sudo documentation.