Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Invalid Debian package name #73

Open
laurent-simon opened this issue Jan 30, 2021 · 1 comment
Open

Invalid Debian package name #73

laurent-simon opened this issue Jan 30, 2021 · 1 comment

Comments

@laurent-simon
Copy link

laurent-simon commented Jan 30, 2021

When Drill Debian package is installed, the reported source package name is https://github.com/yatima1460/Drill. A URL is not a valid package name. This is a problem for tools that need a real package name to work properly.

For example, debsecan (a classic tool used to scan for vulnerabilities on Debian installations) cannot work anymore due to this anomaly:

$ debsecan --suite $(lsb_release --codename --short) --source https://raw.githubusercontent.com/BBVA/ust2dsa/data/  --format detail
Traceback (most recent call last):
  File "/usr/bin/debsecan", line 1370, in <module>
    rate_system(target, options, fetch_data(options, config), history)
  File "/usr/bin/debsecan", line 1305, in rate_system
    raise SyntaxError(('package %s references '
SyntaxError: package drill-search-gtk references invalid source package 'https://github.com/yatima1460/Drill'

So, when Drill is installed, the result is that the overall system cannot be analyzed for security vulnerabilities...

Remark: I agree that debsecan should not fail like that. It should report the anomaly, discard Drill from the analysis and continue his work. But all tools that expects for a valid package name are potentially affected by this small mistake.

For information, the Debian package naming rules are (from Debian policy):

Package names (both source and binary, see Package) must consist only of lower case letters (a-z), digits (0-9), plus (+) and minus (-) signs, and periods (.). They must be at least two characters long and must start with an alphanumeric character.

Environment:

  • Installation: Debian package
  • Version: v566
  • OS: Ubuntu 20.10
@yatima1460
Copy link
Owner

Hello, sorry if I abandoned this repo, I hope to revamp it soon

Thanks for posting issues :D

yatima1460 added a commit that referenced this issue Feb 14, 2021
yatima1460 added a commit that referenced this issue Jul 29, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants