https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297394
--- Comment #11 from Jeremy Chadwick <[email protected]> --- Everyone is focused on ENV env var. That is not the sole problem. I'm at least glad Helge read the rest and noticed the PATH variance. Again: perl taint mode is being used in SpamAssassin no matter what shell you use. But clearly when used from sh, existence of ENV causes problems with sa-update, and god only knows what is going on with PATH and sa-compile (that is one I do not care to dig into). I'm an old Perl guy (started in 1994) so I'm familiar with taint mode and these nuances. Keep in mind sa-compile nor sa-update are setuid nor setgid perl scripts. But again, the root point here: migrating from csh to sh is fine (I have wanted this since 1997!), but it is clear that those who made this decision did not stop and think about the full ramifications. (I've known for decades, for example, replacing root shell would break parts of ports infra. I imagine by now that's been addressed, but third-party impact is going to be a lot more widespread.) Case in point: many Linux distros use either bash or dash. If we focus on dash (e.g. on Debian/Ubuntu), we find the same ENV "gotcha" per the sh/dash man page (it's identical to FreeBSD sh in this manner actually). However, on Linux, ENV is not set anywhere. The addition of ENV to /root/.profile -- or more specifically, part of skel -- was added 27 years ago. It may be time to re-visit that. I am certain that this change will not be the only "surprise" or "gotcha" that comes up. It's just a matter of time -- time of mine which was already taken up by 1) trying to figure out why this problem happened to begin with, and 2) filing the bug report. Thanks to those digging in -- appreciated. -- You are receiving this mail because: You are the assignee for the bug.
