Your message dated Thu, 21 Apr 2005 12:02:03 -0400
with message-id <[EMAIL PROTECTED]>
and subject line Bug#305592: fixed in alien 8.52
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 20 Apr 2005 23:19:55 +0000
>From [EMAIL PROTECTED] Wed Apr 20 16:19:55 2005
Return-path: <[EMAIL PROTECTED]>
Received: from tornado.dat.etsit.upm.es (dat.etsit.upm.es) [138.100.17.73]
by spohr.debian.org with smtp (Exim 3.35 1 (Debian))
id 1DOOU5-0004bo-00; Wed, 20 Apr 2005 16:19:54 -0700
Received: (qmail 27363 invoked by uid 1013); 20 Apr 2005 23:19:51 -0000
Date: Thu, 21 Apr 2005 01:19:51 +0200
From: Javier =?iso-8859-1?Q?Fern=E1ndez-Sanguino_Pe=F1a?= <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: alien: Breaks when working with broken packages
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="/WwmFnJnmDyWGHa4"
Content-Disposition: inline
User-Agent: Mutt/1.5.6+20040907i
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-3.0 required=4.0 tests=BAYES_00 autolearn=no
version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
--/WwmFnJnmDyWGHa4
Content-Type: multipart/mixed; boundary="J2SCkAp4GZ/dPZZf"
Content-Disposition: inline
--J2SCkAp4GZ/dPZZf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Package: alien
Version: 8.51
Priority: normal
Tags: patch
Alien fails to detect some error conditions that might break its package=20
conversion. I actually found this when converting a broken rpm package,=20
alien generated all kind of weird directories in my cwd.
I believe alien should:
- not act on empty (or unreadable) files
- die if the Alien::Package runpipe method runs a command that does not=20
exit properly
The attached script shows the behaviour and the attached patch is a=20
proposed fix. I'm not sure if runpipe should continue even if errors are=20
seen, the only module that seems to act on these errors is=20
Alien::Package::Deb (in the 'build' method). If there is a legitimate need=
=20
to have runpipe return even if an error ocurred maybe a new parameter=20
flag could be added to the method to switch the die() code on and off (and=
=20
default to 'on'). Or the $? check should be moved only to the methods=20
running runpipe.
I think the current status is pretty dangerous, since some weird commands
might get executed and there seems to be a chance to create a malformed=20
package that will end up running arbitary code on behalf of the user.=20
Although I have not investigated that posibility. (that's why I'm not=20
setting this bug at a higher severity and tagging it security, although I'm=
=20
tempted to, see the attached script.
Regards
Javier
--J2SCkAp4GZ/dPZZf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="alien-error.script"
Content-Transfer-Encoding: quoted-printable
Script started on jue 21 abr 2005 01:01:43 CEST
$ ls=0D
=1B[00m=1B[m$ touch test.rpm=0D
$ alien--t=08 =08=08 =08=08 =08 --to-tgz test.rpm =0D
Warning: alien is not running as root!=0D
Ownerships of files in the generated packages will probably be messed up.=0D
sh: line 1: -test.rpm:: command not found=0D
sh: line 1: -test.rpm:: command not found=0D
sh: -c: line 2: syntax error near unexpected token `;'=0D
sh: -c: line 2: `; cpio --extract --make-directories --no-absolute-filename=
s --preserve-modification-time) 2>&1'=0D
Unsuccessful stat on filename containing newline at /usr/share/perl5/Alien/=
Package/Rpm.pm line 166.=0D
mkdir: cannot create directory `test.rpm: read manifest failed: Success\n-t=
est.rpm: read manifest failed: Success\n/test.rpm: read manifest failed: Su=
ccess\n': No such file or directory=0D
mv: invalid option -- t=0D
Try `mv --help' for more information.=0D
sh: line 1: -test.rpm:: command not found=0D
sh: line 2: -type: command not found=0D
Argument "test.rpm:" isn't numeric in bitwise and (&) at /usr/share/perl5/A=
lien/Package/Rpm.pm line 216, <GETPERMS> line 1.=0D
Unsuccessful stat on filename containing newline at /usr/share/perl5/Alien/=
Package/Rpm.pm line 235, <GETPERMS> line 1.=0D
sh: line 1: -test.rpm:: command not found=0D
sh: -c: line 2: syntax error near unexpected token `;'=0D
sh: -c: line 2: `; tar czf ../test.rpm: read manifest failed: Success'=0D
test.rpm: read manifest failed: Success=0D
-test.rpm: read manifest failed: Success=0D
=2Etgz generated=0D
find: test.rpm: read manifest failed: Success=0D
-test.rpm: read manifest failed: Success=0D
: No such file or directory=0D
$ ls -la=0D
=1B[00mtotal 28=0D
drwxr-xr-x 7 jfs jfs 4096 Apr 21 01:02 =1B[01;34m.=1B[00m=0D
drwxr-xr-x 5 jfs jfs 4096 Apr 21 01:00 =1B[01;34m..=1B[00m=0D
drwxr-xr-x 2 jfs jfs 4096 Apr 21 01:02 =1B[01;34mSuccess=1B[00m=0D
drwxr-xr-x 2 jfs jfs 4096 Apr 21 01:02 =1B[01;34mfailed:=1B[00m=0D
drwxr-xr-x 2 jfs jfs 4096 Apr 21 01:02 =1B[01;34mmanifest=1B[00m=0D
drwxr-xr-x 2 jfs jfs 4096 Apr 21 01:02 =1B[01;34mread=1B[00m=0D
-rw-r--r-- 1 jfs jfs 0 Apr 21 01:02 =1B[01;31mtest.rpm=1B[00m=0D
drwxr-xr-x 2 jfs jfs 4096 Apr 21 01:02 =1B[01;34mtest.rpm:=1B[00m=0D
=1B[m$ rm -rf Success/=0D$ =1B[Krm-rf=08 =08=08 =08=08 =08 -rf *=0D
$ dd if=3D/dev/random of=3Dtest.rpm count=3D1000=0D
0+1000 records in=0D
61+1 records out=0D
31460 bytes transferred in 3.619511 seconds (8692 bytes/sec)=0D
$ alien --to-tgz test.rpm =0D
Warning: alien is not running as root!=0D
Ownerships of files in the generated packages will probably be messed up.=0D
sh: line 1: -test.rpm:: command not found=0D
sh: line 1: -test.rpm:: command not found=0D
sh: -c: line 2: syntax error near unexpected token `;'=0D
sh: -c: line 2: `; cpio --extract --make-directories --no-absolute-filename=
s --preserve-modification-time) 2>&1'=0D
Unsuccessful stat on filename containing newline at /usr/share/perl5/Alien/=
Package/Rpm.pm line 166.=0D
mkdir: cannot create directory `test.rpm: read manifest failed: Success\n-t=
est.rpm: read manifest failed: Success\n/test.rpm: read manifest failed: Su=
ccess\n': No such file or directory=0D
mv: invalid option -- t=0D
Try `mv --help' for more information.=0D
sh: line 1: -test.rpm:: command not found=0D
sh: line 2: -type: command not found=0D
Argument "test.rpm:" isn't numeric in bitwise and (&) at /usr/share/perl5/A=
lien/Package/Rpm.pm line 216, <GETPERMS> line 1.=0D
Unsuccessful stat on filename containing newline at /usr/share/perl5/Alien/=
Package/Rpm.pm line 235, <GETPERMS> line 1.=0D
sh: line 1: -test.rpm:: command not found=0D
sh: -c: line 2: syntax error near unexpected token `;'=0D
sh: -c: line 2: `; tar czf ../test.rpm: read manifest failed: Success'=0D
test.rpm: read manifest failed: Success=0D
-test.rpm: read manifest failed: Success=0D
=2Etgz generated=0D
find: test.rpm: read manifest failed: Success=0D
-test.rpm: read manifest failed: Success=0D
: No such file or directory=0D
$ ls=0D
=1B[00m=1B[01;34mSuccess=1B[00m =1B[01;34mfailed:=1B[00m =1B[01;34mmanife=
st=1B[00m =1B[01;34mread=1B[00m =1B[01;31mtest.rpm=1B[00m =1B[01;34mtest=
=2Erpm:=1B[00m=0D
=1B[m$ rm -rf *=0D
$ =0D
$=20
Script done on jue 21 abr 2005 01:02:45 CEST
--J2SCkAp4GZ/dPZZf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="alien-brokenpkg-fix.diff"
Content-Transfer-Encoding: quoted-printable
diff -Nru alien-8.51/Alien/Package.pm alien-8.52/Alien/Package.pm
--- alien-8.51/Alien/Package.pm 2003-10-28 21:45:28.000000000 +0100
+++ alien-8.52/Alien/Package.pm 2005-04-21 01:05:17.000000000 +0200
@@ -220,6 +220,9 @@
if (! -e $file) {
die "$file does not exist; cannot read.";
}
+ if (! -r $file) {
+ die "$file is not readable.";
+ }
}
=20
=3Ditem unpack
@@ -421,7 +424,8 @@
=3Ditem runpipe
=20
This is similar to backticks, but honors $Alien::Package::verbose, logging
-the command run if asked to. The output of the command returned.
+the command run if asked to. The output of the command returned. If the
+command fails, the program will be aborted.
=20
=3Dcut
=20
@@ -433,6 +437,7 @@
}
if (wantarray) {
my @[EMAIL PROTECTED];
+ die "Error executing \"@command\": $!" if $? ne 0;
if ($Alien::Package::verbose >=3D 2) {
print @ret;
}
@@ -440,6 +445,7 @@
}
else {
my [EMAIL PROTECTED];
+ die "Error executing \"@command\": $!" if $? ne 0;
if ($Alien::Package::verbose >=3D 2) {
print $ret."\n";
}
diff -Nru alien-8.51/alien.lsm alien-8.52/alien.lsm
--- alien-8.51/alien.lsm 2005-04-21 01:05:34.000000000 +0200
+++ alien-8.52/alien.lsm 2005-04-21 01:05:27.000000000 +0200
@@ -1,6 +1,6 @@
Begin3
Title: alien
-Version: 8.51
+Version: 8.52
Entered-date: 31MAR97
Description: Alien converts Slackware .tgz packages, Red Hat .rpm packages,
Debian .deb packages, and Stampede .slp packages. It can=
=20
@@ -9,6 +9,6 @@
Keywords: debian dpkg deb red hat redhat rpm slackware tgz stampede slp
co=
nvert package LSB
Author: [EMAIL PROTECTED]
Primary-site: sunsite.unc.edu /pub/Linux/utils/package
- 80 alien-8.51.tar.gz
+ 80 alien-8.52.tar.gz
Copying-policy: GPL
End
diff -Nru alien-8.51/alien.pl alien-8.52/alien.pl
--- alien-8.51/alien.pl 2004-02-10 00:32:48.000000000 +0100
+++ alien-8.52/alien.pl 2005-04-21 00:56:34.000000000 +0200
@@ -414,6 +414,13 @@
if (! -f $file) {
die "File \"$file\" not found.\n";
}
+ if (! -r $file) {
+ die "File \"$file\" is not readable.\n";
+ }
+ if ( -z $file) {
+ print STDERR "File \"$file\" is empty, skipping.\n";
+ last;
+ }
=20
# Figure out what kind of file this is.
my $package;
diff -Nru alien-8.51/alien.spec alien-8.52/alien.spec
--- alien-8.51/alien.spec 2005-04-21 01:05:34.000000000 +0200
+++ alien-8.52/alien.spec 2005-04-21 01:05:27.000000000 +0200
@@ -1,12 +1,12 @@
Summary: Install Debian, Slackware, and Stampede packages with rpm.
Name: alien
Packager: Joey Hess <[EMAIL PROTECTED]>
-Version: 8.51
+Version: 8.52
Release: 1
-Source: ftp://kitenet.net/pub/code/debian/alien_8.51.tar.gz
+Source: ftp://kitenet.net/pub/code/debian/alien_8.52.tar.gz
Copyright: GPL
Group: Utilities/File
-Buildroot: /tmp/alien-8.51.build
+Buildroot: /tmp/alien-8.52.build
Requires: perl
BuildArchitectures: noarch
=20
@@ -20,7 +20,7 @@
=20
%prep
%setup -n alien
-rm -rf /tmp/alien-8.51.build
+rm -rf /tmp/alien-8.52.build
=20
%install
perl Makefile.PL PREFIX=3D$RPM_BUILD_ROOT/usr
diff -Nru alien-8.51/debian/changelog alien-8.52/debian/changelog
--- alien-8.51/debian/changelog 2005-03-09 22:22:11.000000000 +0100
+++ alien-8.52/debian/changelog 2005-04-21 00:58:55.000000000 +0200
@@ -1,3 +1,11 @@
+alien (8.52) unstable; urgency=3Dlow
+
+ * Added additional checks to die if the file is unreadable, skip
+ empty file and die if backticks commands don't suceeded (i.e.
+ file is probably not on the correct format)
+
+ -- Javier Fernandez-Sanguino Pen~a <[EMAIL PROTECTED]> Thu, 21 Apr 2005 0=
0:53:18 +0200
+
alien (8.51) unstable; urgency=3Dlow
=20
* In rpm unpack permission fixup code, do not call chmod on symlinks,
--J2SCkAp4GZ/dPZZf--
--/WwmFnJnmDyWGHa4
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iD8DBQFCZuOWi4sehJTrj0oRAv8VAKCkgz0favQNbvZIFyc3drwxKV7V7QCgyvWS
BCds3ChWi9m2z4ilrYUbDvk=
=4qxG
-----END PGP SIGNATURE-----
--/WwmFnJnmDyWGHa4--
---------------------------------------
Received: (at 305592-close) by bugs.debian.org; 21 Apr 2005 16:16:48 +0000
>From [EMAIL PROTECTED] Thu Apr 21 09:16:48 2005
Return-path: <[EMAIL PROTECTED]>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1DOeMC-0000Qp-00; Thu, 21 Apr 2005 09:16:48 -0700
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1DOe7v-0003qK-00; Thu, 21 Apr 2005 12:02:03 -0400
From: Joey Hess <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.55 $
Subject: Bug#305592: fixed in alien 8.52
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Thu, 21 Apr 2005 12:02:03 -0400
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Source: alien
Source-Version: 8.52
We believe that the bug you reported is fixed in the latest version of
alien, which is due to be installed in the Debian FTP archive:
alien_8.52.dsc
to pool/main/a/alien/alien_8.52.dsc
alien_8.52.tar.gz
to pool/main/a/alien/alien_8.52.tar.gz
alien_8.52_all.deb
to pool/main/a/alien/alien_8.52_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Joey Hess <[EMAIL PROTECTED]> (supplier of updated alien package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Thu, 21 Apr 2005 11:34:41 -0400
Source: alien
Binary: alien
Architecture: source all
Version: 8.52
Distribution: unstable
Urgency: low
Maintainer: Joey Hess <[EMAIL PROTECTED]>
Changed-By: Joey Hess <[EMAIL PROTECTED]>
Description:
alien - install non-native packages with dpkg
Closes: 305592
Changes:
alien (8.52) unstable; urgency=low
.
* Add a new parameter to runpipe to control whether it automatically
checks the return code of the command (and exits). Turn this on for many
runpipe calls that are not expected to fail in normal operation, but can
fail if the input file is empty, corrupt, or not readable. Previous
behavior for rpm files was a cascading failure that created weird
directories in cwd. Closes: #305592
Files:
d907543b592453aa9fe64d09291dca83 496 admin optional alien_8.52.dsc
b9b0f32d7b72e51128b250f25e4d8f42 85209 admin optional alien_8.52.tar.gz
9a26fff8fcf93eb1f77abbfdb3bd8267 115372 admin optional alien_8.52_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCZ8sq2tp5zXiKP0wRAjdaAKC77wqRYDRHSypfYiWe7MIy5mXZtwCg02pF
6VAfHaSjnd49ZG5YX/hCGls=
=aXH9
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
