summaryrefslogtreecommitdiff
path: root/scripts/Dpkg/Source
AgeCommit message (Collapse)AuthorFilesLines
2014-10-06Dpkg::Source::Patch: Switch remaining topic to named variable in analyze()Guillem Jover1-8/+8
The loop in the function was expecting $line to be filled by its last part, and by working on the topic variable it was not getting updated. Switch all topic variable usages in that funtion so that we can restore working source unpacking. Regression introduced in commmit 0d5e17af7391fb0d3a3c695dac40f8df41f8b11c. Closes: #764206 Addresses BuiltinFunctions::ProhibitUselessTopic. Warned-by: perlcritic
2014-10-06scripts: Unpack arguments instead of accessing @_ directlyGuillem Jover2-6/+7
Addresses Subroutines::RequireArgUnpacking. Warned-by: perlcritic
2014-10-06Dpkg::Source::Package: Use a simple string match instead of a regexGuillem Jover3-17/+17
Addresses RegularExpressions::ProhibitFixedStringMatches. Warned-by: perlcritic
2014-10-06perl: Use length instead of /^$/ to test for an empty stringGuillem Jover2-5/+9
Addresses RegularExpressions::ProhibitFixedStringMatches. Warned-by: perlcritic
2014-10-06Dpkg::Source::Package::V2: Rename %origtar to %addonfileGuillem Jover1-8/+8
Make it clear that these are the addon tarballs.
2014-10-06perl: Do not use the topic variable unnecessarilyGuillem Jover3-7/+7
Fixes BuiltinFunctions::ProhibitUselessTopic and RegularExpressions::ProhibitUselessTopic. Warned-by: perlcritic
2014-10-06scripts: Use named variables instead of using the topic variableGuillem Jover4-34/+46
Switch code that uses roughly more explicit instances of the topic variable than implicit ones. Addresses BuiltinFunctions::ProhibitUselessTopic. Warned-by: perlcritic
2014-10-06dpkg-source: Fix perl warning when typing Ctrl-D on patch name promptGuillem Jover1-1/+3
When prompting the user for a patch name, if they type Ctrl-D the variable reading from STDIN will be initialized to undef, but we were acting on it anyway. Catch that case.
2014-08-19scripts: Revert some unsafe //= usages back to ||=Guillem Jover2-3/+3
This reverts some of the unsafe assignments, as the variable might have contained a value evaluating to false, and we are assigning non-false values. This specifically fixes dpkg-source --commit and -b not working any longer. Regression introduced in commit b0337f001bee1f3791cb87505b1330c9bf83e2be. Closes: #758426 Reported-by: Neil Williams <codehelp@debian.org>
2014-08-15scripts: Use length instead of defined when checking environment variablesGuillem Jover1-1/+1
In these cases we are not interested if the variables are defined, but if they have actual content.
2014-08-15Dpkg::Source::Archive: Use tar --format=gnu when creating archivesJan Blunck1-1/+1
Explicitly instruct Dpkg::Source::Archive to use the gnu format when creating archives. Some versions of tar (specifically on openSUSE >= 12.2) have a different default tar format. This change makes the archive creation more consistent. Signed-off-by: Jan Blunck <jblunck@infradead.org> Signed-off-by: Guillem Jover <guillem@debian.org>
2014-08-09Dpkg::Path: Change find_command() to handle an empty or undef argumentGuillem Jover1-1/+1
This makes some call sites more natural.
2014-08-09Dpkg::Source::Archive: Delete the current compressor SIGPIPE dispositionGuillem Jover1-1/+1
With some archives, the tar process will terminate prematurely if it finds trailing zeros, but the compressor will try to keep feeding it with data, although the other end of the pipe will now be gone. We handle this already by ignoring processes terminated by SIGPIPE, but if the process is ignoring SIGPIPE it might get terminated due to the error from the write(2) call, which we are not handling. Reset the SIGPIPE disposition to its default setting. Closes: #756526
2014-08-09scripts: Use // instead of || where appropriateGuillem Jover1-2/+2
Replace only safe usages, i.e. those that fallback on initialization values that evaluate to false anyway. Or when the API is explicit about the variable being undefined.
2014-08-09scripts: Use //= instead of ||= when appropriateGuillem Jover4-15/+15
Replace only safe usages, i.e. those that fallback on initialization values that evaluate to false anyway. Or when the API is explicit about the variable being undefined.
2014-08-09scripts: Use //= instead of explicit defined or exists checksGuillem Jover4-39/+23
2014-08-09dpkg-source: Print the correct removed binary filename with --include-removalGuillem Jover2-20/+23
When removing a binary file and using --include-removal, we get a bogus error message about including a pathname relative to /dev/null in debian/source/include-binaries. Closes: #755166
2014-08-09Dpkg::Source::Quilt: Clarify error message when patches fail to applyGuillem Jover1-1/+1
There are other reasons besides patches with no fuzz, mention that the patch could be malformed too, to make the error message less confusing.
2014-08-09Dpkg::Source::Patch: Add comment about ignoring the Index: pseudo-headerGuillem Jover1-1/+4
2014-08-09Use https:// URLs instead of http:// when possible (round two)Guillem Jover1-1/+1
Switch more URLs, now that these services have had SSL enabled.
2014-06-05Dpkg::Source::Patch: Fix patch header parsing to avoid directory traversalsGuillem Jover1-1/+1
The code parsing the patches was not taking into account that patches w/ partial or no pathname headers are still valid patches, and that they can specify the pathname in the Index: pseudo-header or in a single «+++ » pathname header, which allows doing directory traversal when unpacking source packages. The first vector is due to how the Index: pseudo-header is handled by patch. Its value gets used (on non-POSIX mode) only when both «+++ » and «--- » pathname headers do not provide a pathname, by either having an empty pathname or by the header being completely absent. The minimal fix for this is to just consider that we've parsed the header when we see a hunk header marker «@@ -». This is CVE-2014-3865 and #749183. The other vector is due to patches with only a «+++ » pathname header, which get skipped by the parser as it only checks for «--- » pathname header lines. The minimal fix for this is to also check for «+++ » when parsing the patch header. This is CVE-2014-3864 and #746498. The first issue is a superset of the second, and its fix is sufficient and covers and fixes too the second vector, as the «@@ -» marker is mandatory for a patch to be valid. An unspecified directory traversal vulnerability was initially reported in #746498 by Javier Serrano Polo <javier@jasp.net>, and while no information had been provided, I independently found #749183 and what was supposed to be #746498, which was later on published. Fixes: CVE-2014-3864, CVE-2014-3865 Closes: #746498, #749183
2014-05-27Replace non-breaking spaces with ASCII spacesGuillem Jover1-1/+1
2014-06-02Dpkg::Source::Package::V2: Do not assume sensible-editor is presentGuillem Jover1-2/+10
This command is very Debian specific, fallback to try to use VISUAL, EDITOR or vi if the previous are either unset or not found.
2014-05-17Dpkg::Source::Quilt: Refactor register() and unregister() methodsGuillem Jover2-58/+71
Refactor the code out from Dpkg::Source::Package::V3::Quilt into two new methods that take care of registering and unregistering a patch from the series and applied_patches in-core and on-disk lists.
2014-05-17Dpkg::Source::Package::V3::Quilt: Handle series files with no final newlineGuillem Jover1-2/+7
Do not mangle the series files when the last line is missing a newline, by loading and saving the file with the added patch. This is quite ugly in general, but fixes the immediate problem. The code will be getting a general overhaul in due time. Closes: #584233
2014-05-17Dpkg::Source::Package::V3::Quilt: Refactor _load_file()Guillem Jover1-4/+12
2014-05-17Dpkg::Source::Quilt: Rename write_db() to save_db()Guillem Jover2-5/+5
This is the normal counterpart to load actions.
2014-05-17Dpkg::Source::Quilt: Refactor write_patch_list()Guillem Jover1-6/+11
2014-05-17scripts: Switch unused capturing groups to non-capturing onesGuillem Jover3-3/+3
These have better runtime performance, not that it matters in many of the instances here though. Addresses RegularExpressions::ProhibitUnusedCapture. Warned-by: perlcritic
2014-05-06dpkg-source: unpack additional tarballs in a deterministic orderRaphaël Hertzog1-1/+1
Reported-by: Samuel Bronson <naesten@gmail.com> Closes: #747148
2014-04-30Dpkg::Source::Patch: Outright reject C-style filenames in patchesGuillem Jover1-31/+1
Because patch only started recognizing C-style filenames in diffs in version 2.7, it's not safe to assume one behaviour or the other, as the system might or might not have a recent enough version, or a GNU patch program at all. There's also no reason we should be supporting this kind of strange encoded filenames in patches, when we have not done so up to now. Let's just ban these types of diffs and be done with it. Fixes: CVE-2014-0471 Closes: #746306
2014-04-28Dpkg::Source::Patch: Correctly parse C-style diff filenamesGuillem Jover1-10/+49
We need to strip the surrounding quotes, and unescape any escape sequence, so that we check the same files that the patch program will be using, otherwise a malicious package could overpass those checks, and perform directory traversal attacks on source package unpacking. Fixes: CVE-2014-0471 Reported-by: Jakub Wilk <jwilk@debian.org>
2014-04-21dpkg-source: Add a new extraction --ignore-bad-version optionGuillem Jover3-1/+16
This allows to extract ancient source packages with broken versions, that used to be accepted at some point in time by dpkg-source. Closes: #740883
2014-04-21dpkg-source: Improve warning message when ignoring file removalsMoritz Muehlenhoff1-1/+1
Hint at the --include-removal option in the warning to direct the user to it. Closes: #738310 Signed-off-by: Guillem Jover <guillem@debian.org>
2014-04-21scripts: Add a space after commaGuillem Jover1-1/+1
2014-04-21scripts: Add a space after flow control statementsGuillem Jover2-3/+3
2014-04-21scripts: Localize $_ in functions with while (<$fh>) style loopsGuillem Jover3-1/+7
This way we make sure we don't affect the $_ value for the caller, in case it was being used.
2014-01-15dpkg-source: Change default source package compressor for new formats to xzGuillem Jover1-1/+1
This does not affect V1.0, which only supports gzip compression.
2014-01-15dpkg-source: Set default compression options in source format specific modulesGuillem Jover2-0/+12
This paves the way to be able to set package format specific defaults, and fixes a problem with the default compression level on “3.0 (native)” packages, as it was being set in dpkg-source but not reset when the compressor was changed. Closes: #733326
2014-01-15Dpkg::Source::Package: Always pass compression_level explicitlyGuillem Jover2-3/+6
When creating a Dpkg::Source::Archive or a Dpkg::Source::Patch, always be explicit about the compression level instead of relying on the global default level.
2014-01-15Dpkg::Source::Package::V3::Quilt: Clarify missing revision errorGuillem Jover1-1/+2
Closes: #719348, #733746
2013-12-07Use https:// URLs instead of http:// when possibleGuillem Jover12-12/+12
2013-12-05Dpkg::Source::Package: Add new set_default_diff_ignore_regex() functionGuillem Jover1-1/+16
2013-12-05Dpkg::Source::Package: Make $diff_ignore_default_regexp a true aliasGuillem Jover1-1/+2
If the users are modifying this variable, just copying the real one to the public one will not do it, because changes will not be seen by the module code. Instead create a real alias. Regression introduced in commit 5ae4ce9c2dfddbb36e2e0fc24dde3a27196f00f1.
2013-12-04scripts: Add GnuPG 2.x supportGuillem Jover1-1/+6
Add gnupg2 and gpgv2 as alternative Recommends to gnupg and gpgv (to not pull them by default, as that would change the current default build environment pulled in by dpkg-dev), but prefer gpgv2 over gpgv, and gpg2 over gpg at run-time if they are available, so that users installing the alternatives can benefit from the new implementations.
2013-12-04perl: Surround FileHandles with braces in print callsGuillem Jover6-17/+17
Fixes InputOutput::RequireBracedFileHandleWithPrint. Warned-by: perlcritic
2013-12-04scripts: Remove redundant STDOUT from print callsGuillem Jover1-1/+1
Addresses InputOutput::RequireBracedFileHandleWithPrint. Warned-by: perlcritic
2013-12-04scripts: Use croak instead of internerr on programming errors in modulesGuillem Jover2-8/+11
Remove now unused internerr() function, replaced by croak which does a way better job. Addresses ErrorHandling::RequireCarping. Warned-by: perlcritic
2013-12-04perl: Switch to use low precedence boolean operators for error checksGuillem Jover10-112/+108
This will make it safe to remove parenthesis around builtins.
2013-12-04perl: Try to avoid boolean operators after predicates on error checksGuillem Jover4-12/+20
Using boolean operators after predicates for error checking makes the code flow slightly confusing, do that only after actions, to check if they succeeded and error out otherwise.
generated by cgit v1.2.3 (git 2.39.1) at 2025-07-26 01:26:56 +0000