sudo not included in Debian dependencies

[GreenReaper]

Bug Overview

When I tried to install the Debian package provided by nginx, I encountered several failures because it was assumed that sudo was installed, which was not the case on my cloud server - it provided root access without a regular user.

In particular the sudo tee step is easy to miss the first time, and if you do not look closely the error appears to be related more to gpg, since the download completes.

Expected Behavior

I expected the installation instructions to work, accounting for the possibility that sudo was not installed, perhaps with a preface indicating that it was a dependency which must be installed separately if not already done.

Steps to Reproduce the Bug

# sudo apt install curl gnupg2 ca-certificates lsb-release ubuntu-keyring

-bash: sudo: command not found

[if sudo ignored and dependencies installed]

# curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor \
    | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
-bash: sudo: command not found
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 11809  100 11809    0     0  26590      0 --:--:-- --:--:-- --:--:-- 26656
gpg: [stdout]: write error: Broken pipe
gpg: [stdout]: write error: Broken pipe
gpg: filter_flush failed on close: Broken pipe

Environment Details

• Target deployment platform: Leaseweb Virtual Machine
• Target OS: Linux VM 6.1.0-34-cloud-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.135-1 (2025-04-25) x86_64 GNU/Linux
• Version of this project or specific commit: Live site as of 2025-05-04

Additional Context

The VM was running a default install of Debian 12 provided by Leaseweb US, except that I had done a dist-upgrade and installed the cloud kernel instead.

[thresheek]

Hello @GreenReaper !

Indeed, sudo is omitted in the dependencies - and you're 100% correct it's not easy to spot an issue when it's missing.

However, I'm having a hard time suggesting installing such a piece of software mixed with other dependencies we need to actually fetch and check packages. The reason is that sudo is a security tool, and installing yet another method of managing privileges is not something that should be taken lightly in my opinion (especially with sudo' CVE history)...

[GreenReaper]

Perhaps there is a formulation that would only call sudo if it is required to start with, i.e. a test that you are not already root (or do not already have permission to access the relevant paths)? I read that id -u returns 0 if the user already has root privileges (id requires coreutils; it is installed on my VM), and below that there is a script that sets a variable to sudo if is required (this uses $EUID which I gather is in bash, not Debian's dash, but it could probably be replaced with id -u).