Bug#1113774: Disabling -fcf-protection in sudo for bookworm

On Fri, 05 Dec 2025 at 15:26:50 +0000, James Addison wrote:
>It seems unlikely to me that [an amd64 system with an i386 foreign 
>architecture] would have both sudo:amd64 and sudo:i386 installed

This isn't possible. sudo is not Multi-Arch: same, so you can only have 
one instance of it at a time. (Each architecture's instance of sudo 
contains a different /usr/bin/sudo, so it is impossible for more than 
one to coexist.)

>hopefully even less likely that only sudo:i386 is installed

This is possible. Realistically, this would only happen if the user 
specifically asked for it, or if they did an incomplete crossgrade from 
i386, or if they installed an i386 package that Depends or Recommends on 
sudo while not already having sudo:amd64 installed.

The first two of those options are at least arguably user error, and the 
last seems unlikely to me: the typical use-cases for an i386 foreign 
architecture on an amd64 system (Wine, Steam, cross-compilers) don't 
have a reason to depend on sudo.

     smcv