software update did not ask for authentication

I am not an expert on this, but I understand that Trisquel uses a component called polkit that is designed to allow certain programs to perform actions that normally require special priviledge, without the need to be superuser.

On my system, I see the file /usr/share/polkit-1/rules.d/com.ubuntu.desktop.rules that includes rules about authorized actions. One of these rules is:

// Update already installed software
polkit.addRule(function(action, subject) {
if (action.id == "org.debian.apt.upgrade-packages" &&
subject.active == true && subject.local == true &&
subject.isInGroup("sudo")) {
return polkit.Result.YES;
}
});

From the comment, it seems to allow updating already installed software without the need for extra authentication. So maybe that was the case?

From the details and the manual page, this is only possible if the user is in the "sudo" group (so a guest cannot do that) and when the user has an active session and the "seat" (no clue what this is) is local. Maybe that would be false for some kind of remote usage? (not sure).

If you have identified your sudo-capable-user within a span of 5 minutes before. Then the system validates it's you. After 5 minutes you need to pass the sudo user password.