The biggest issue is directly supplying the data within the format
string which can result in misinterpreting formatter sequences if a
printed variable contains an "%" in it. This character is currently
permitted in the pkgver field, though not in the pkgname. Also
pacman/libalpm itself has much looser limitations and this can appear
anywhere at all if a package was created by some other program.

For the package "iambroke-1%s-1-any.pkg.tar.xz", installed in the build
environment, the result is:

  -> Generating .BUILDINFO file...
awk: cmd. line:3: (FILENAME=- FNR=1085) fatal: not enough arguments to satisfy 
format string
        `-1%s-1'
           ^ ran out for this one

Followed by a .BUILDINFO which contains an LC_ALL=C sorted list of
$pkgname-${epoch:+$epoch:}$pkgver-$pkgrel-$arch ending in:

installed = iambroke

Which is cut short, then fails to list the succeeding packages. The
package itself successfully builds.

It's also unnecessary to save the output of pacman -Qq in order to get the
information for pacman -Qi, since the latter will, just like the former,
return information for all installed packages if not given a package
name(s).

While I am at it, pipe this directly to awk rather than keeping a copy
in an unnecessary local variable. This is slightly more efficient in
addition to preventing the <<< herestring from re-interpreting the
content of "$pkginfos" in ways that don't really matter for our usage.

Signed-off-by: Eli Schwartz <[email protected]>
---
 scripts/makepkg.sh.in | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in
index a5b0cbdf..987bb9f1 100644
--- a/scripts/makepkg.sh.in
+++ b/scripts/makepkg.sh.in
@@ -699,13 +699,11 @@ write_buildinfo() {
        write_kv_pair "buildenv" "${BUILDENV[@]}"
        write_kv_pair "options" "${OPTIONS[@]}"
 
-       local pkglist=($(run_pacman -Qq))
-       local pkginfos="$(LC_ALL=C run_pacman -Qi ${pkglist[@]})"
-       local pkginfos_parsed=($(awk -F': ' '\
-               /^Name .*/ {printf $2} \
-               /^Version .*/ {printf "-"$2} \
+       local pkginfos_parsed=($(LC_ALL=C run_pacman -Qi | awk -F': ' '\
+               /^Name .*/ {printf "%s", $2} \
+               /^Version .*/ {printf "-%s", $2} \
                /^Architecture .*/ {print "-"$2} \
-               ' <<< "${pkginfos}"))
+               '))
 
        write_kv_pair "installed" "${pkginfos_parsed[@]}"
 }
-- 
2.17.1

Reply via email to