Package: dpkg
Version: 1.17.6
Severity: minor

Dear dpkg maintainers,

dpkg-deb creates the tarfiles inside a .deb using tar -T without using
--no-unquote.  This can cause issues when a filename contains one or
more "\"-characters, as tar will strip one level of blackslahes (due
to --unqoute being the default).

Thus a file named \\ will be renamed to \ in the process (and
e.g. "\a" becomes "a"[1]).  If this causes two files to have the same
name, tar will consider of them a hardlink of other (discarding its
content, as it is assumed to be the same as the other one).

I have filed this as "minor", since (to my knowledge) the only
packages containing files affected by this are found solely in the
Lintian test suite[2].

~Niels

[1] I believe it will also do some translation.  E.g. turn something
like "\060" into a literal "0".

[2] E.g. t/tests/files-tar-traps - can be run from the source via:

 $ mkdir debian/test-out
 $ t/runtests t debian/test-out files-tar-traps

Also, consider opening t/tests/files-tar-traps/pre_build and have it
enable the last line or add other "funny" named files as needed.


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Reply via email to