Bug#811267: handling issues of package contents in the case of --path-exclude

[Guillem Jover]

Hi!

On Sat, 2016-02-06 at 12:03:55 +0100, Marc Haber wrote:
> sorry for not getting back to you any sooner. It took me a while to
> understand my local configuration issue.

No problem!

> On Mon, Jan 18, 2016 at 03:04:55AM +0100, Guillem Jover wrote:
> > Yes, it should, and that's what's supposed to happen. Here's a session
> > on my system:
> > 
> > ,---
> > # rm -rf /usr/share/zoneinfo
> > # ls -la /usr/share/zoneinfo
> > ls: cannot access /usr/share/zoneinfo: No such file or directory
> > # dpkg --path-exclude='/usr/share/zoneinfo' 
> > --path-exclude='/usr/share/zoneinfo/*' --install tzdata_2015g-1_all.deb
> > (Reading database ... 264026 files and directories currently installed.)
> > Preparing to unpack tzdata_2015g-1_all.deb ...
> > Unpacking tzdata (2015g-1) over (2015g-1) ...
> > Setting up tzdata (2015g-1) ...
> > 
> > User defined time zone, leaving /etc/localtime unchanged.
> > Local time is now:  Mon Jan 18 02:56:22 CET 2016.
> > Universal Time is now:  Mon Jan 18 01:56:22 UTC 2016.
> > Run 'dpkg-reconfigure tzdata' if you wish to change it.
> > 
> > # ls -la /usr/share/zoneinfols: cannot access /usr/share/zoneinfo: No such 
> > file or directory
> > #
> > `---
> > 
> > So there's something else going on here. Could you run the above but by
> > passing «-D333» to dpkg, and send the log?
> 
> After looking into an strace of the dpkg process, I found out that I
> had configuration regarding path exclude and include in
> /etc/dpkg/dpkg.conf.d, which was contradicting my command line
> directives.
>
> After removing the configuration, dpkg behaves as expected now.

Ah, that certainly explains.

> May I suggest adding information about processed configuration files
> to -D333 output to point people a bit more towards a possible conflict?

Oh, you mean dpkg's own configurations, sure!

> How does dpkg handle conflicts between command line configuration and
> configuration file configuration?

If dpkg can detect there's an actual conflict then it should (in
principle) error out, but in this case I don't see how dpkg would be
able to tell what you really want to do, so it considers the user
wants to extend the pre-existing directives.

Thanks,
Guillem

Bug#811267: handling issues of package contents in the case of --path-exclude

[Guillem Jover]

Hi!

On Sat, 2016-02-06 at 12:10:31 +0100, Marc Haber wrote:
> On Fri, Feb 05, 2016 at 06:46:40PM +0100, Guillem Jover wrote:
> > I've now tried to clarify this in my local tree, I'm attaching the patch.
> 
> This looks good. I'd augment it with something like "it might thus be
> necessary to exclude both the directory and its contents, like
> --path-exclude=/foo/bar --path-exclude='/foo/bar/*',

Given that (as previously documented) pathnames might get reincluded
if the code thinks it might need them later on, I've mentioned just
that. And trying so hard to remove specific directory object entries
might be in vain after all, so it might not be a good recommendation
that sends people in the wrong direction.

> and to make sure
> that the glob does not get processed by the shell by using appropriate
> quoting".

I've added a hint for this, but this is normal command-line vs shell
interaction, so it feels a bit too explicit.

Thanks,
Guillem

Bug#811267: handling issues of package contents in the case of --path-exclude

[Marc Haber]

On Fri, Feb 05, 2016 at 06:46:40PM +0100, Guillem Jover wrote:
> I've now tried to clarify this in my local tree, I'm attaching the patch.

This looks good. I'd augment it with something like "it might thus be
necessary to exclude both the directory and its contents, like
--path-exclude=/foo/bar --path-exclude='/foo/bar/*', and to make sure
that the glob does not get processed by the shell by using appropriate
quoting".

Greetings
Marc

-- 
-
Marc Haber | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany|  lose things."Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421

Bug#811267: handling issues of package contents in the case of --path-exclude

[Marc Haber]

Hi,

sorry for not getting back to you any sooner. It took me a while to
understand my local configuration issue.

On Mon, Jan 18, 2016 at 03:04:55AM +0100, Guillem Jover wrote:
> Yes, it should, and that's what's supposed to happen. Here's a session
> on my system:
> 
> ,---
> # rm -rf /usr/share/zoneinfo
> # ls -la /usr/share/zoneinfo
> ls: cannot access /usr/share/zoneinfo: No such file or directory
> # dpkg --path-exclude='/usr/share/zoneinfo' 
> --path-exclude='/usr/share/zoneinfo/*' --install tzdata_2015g-1_all.deb
> (Reading database ... 264026 files and directories currently installed.)
> Preparing to unpack tzdata_2015g-1_all.deb ...
> Unpacking tzdata (2015g-1) over (2015g-1) ...
> Setting up tzdata (2015g-1) ...
> 
> User defined time zone, leaving /etc/localtime unchanged.
> Local time is now:  Mon Jan 18 02:56:22 CET 2016.
> Universal Time is now:  Mon Jan 18 01:56:22 UTC 2016.
> Run 'dpkg-reconfigure tzdata' if you wish to change it.
> 
> # ls -la /usr/share/zoneinfols: cannot access /usr/share/zoneinfo: No such 
> file or directory
> #
> `---
> 
> So there's something else going on here. Could you run the above but by
> passing «-D333» to dpkg, and send the log?

After looking into an strace of the dpkg process, I found out that I
had configuration regarding path exclude and include in
/etc/dpkg/dpkg.conf.d, which was contradicting my command line
directives.

After removing the configuration, dpkg behaves as expected now.

May I suggest adding information about processed configuration files
to -D333 output to point people a bit more towards a possible conflict?

How does dpkg handle conflicts between command line configuration and
configuration file configuration?

Greetings
Marc

-- 
-
Marc Haber | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany|  lose things."Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421

Bug#811267: handling issues of package contents in the case of --path-exclude

[Guillem Jover]

Control: tags + moreinfo

Hi!

On Mon, 2016-01-18 at 03:04:55 +0100, Guillem Jover wrote:
> On Sun, 2016-01-17 at 18:37:50 +0100, Marc Haber wrote:
> > On Sun, Jan 17, 2016 at 05:27:06PM +0100, Guillem Jover wrote:
> > > Actually, in this case given how the filters work, ideally, the exclusion
> > > should be ignored. What you actually requested was:
> > > 
> > >   exclude /usr/share/zoneinfo
> > >   include /usr/share/zoneinfo/*
> > 
> > Why?
> 
> Because these filters have side effects in contrast to find filters
> for example, and they are used on "streamed data". In dpkg, the filters
> have no knowledge of what type of objects they are filtering, so you
> specify a pathname that might be a directory or a file or a symlink,
> etc. And once the file is being unpacked, it only knows about the
> current pathname, and not if subsequent entries will also need this one
> or not. At that point dpkg has to decide if it unpacks the pathname or
> not, w/o further visibility. Making dpkg aware of futher objects would
> imply that it needs to do a two-pass over the .deb package to know the
> full contents of it, instead of unpacking on the fly.

I've now tried to clarify this in my local tree, I'm attaching the patch.

> > However, excluding both leads to the second problem:
> > 
> > root@fan:/# dpkg --install --path-exclude='/usr/share/zoneinfo' 
> > --path-exclude='/usr/share/zoneinfo/*' 
> > /var/cache/apt/archives/tzdata_2015g-1_all.deb
> > (Reading database ... 9271 files and directories currently installed.)
> > Preparing to unpack .../tzdata_2015g-1_all.deb ...
> > Unpacking tzdata (2015g-1) over (2015g-1) ...
> > dpkg: error processing archive 
> > /var/cache/apt/archives/tzdata_2015g-1_all.deb (--install):
> >  error creating directory './usr/share/zoneinfo/right/Etc': No such file or 
> > directory
> > dpkg-deb: error: subprocess paste was killed by signal (Broken pipe)
> > Errors were encountered while processing:
> >  /var/cache/apt/archives/tzdata_2015g-1_all.deb
> > root@fan:/#
> > 
> > dpkg should not try to unpack files in a directory that was excluded.
> 
> Yes, it should, and that's what's supposed to happen. Here's a session
> on my system:
> 
> ,---
> # rm -rf /usr/share/zoneinfo
> # ls -la /usr/share/zoneinfo
> ls: cannot access /usr/share/zoneinfo: No such file or directory
> # dpkg --path-exclude='/usr/share/zoneinfo' 
> --path-exclude='/usr/share/zoneinfo/*' --install tzdata_2015g-1_all.deb
> (Reading database ... 264026 files and directories currently installed.)
> Preparing to unpack tzdata_2015g-1_all.deb ...
> Unpacking tzdata (2015g-1) over (2015g-1) ...
> Setting up tzdata (2015g-1) ...
> 
> User defined time zone, leaving /etc/localtime unchanged.
> Local time is now:  Mon Jan 18 02:56:22 CET 2016.
> Universal Time is now:  Mon Jan 18 01:56:22 UTC 2016.
> Run 'dpkg-reconfigure tzdata' if you wish to change it.
> 
> # ls -la /usr/share/zoneinfols: cannot access /usr/share/zoneinfo: No such 
> file or directory
> #
> `---
> 
> So there's something else going on here. Could you run the above but by
> passing «-D333» to dpkg, and send the log?

I'd still welcome this information, but if it does not come before the
next release, I'll assume user-error, and close this bug with the
aforementioned patch. Of course you should feel free to open a new
report if you can reproduce the potential problem later on.

> > > I can probably add a note about this kind of situations in the man
> > > page.
> > 
> > IMO, no need for that. My bad.
> 
> I think still some things can be clarified, to avoid further
> confusion. :)

I've ended up doing this anyway.

Thanks,
Guillem
From 866badd77625323a18c2d8e62bdb5da7261ba092 Mon Sep 17 00:00:00 2001
From: Guillem Jover 
Date: Fri, 5 Feb 2016 18:22:08 +0100
Subject: [PATCH] man: Clarify pathname filters behavior

Closes: #811267
---
 man/dpkg.1 | 12 +++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/man/dpkg.1 b/man/dpkg.1
index b46bc06..05f7b47 100644
--- a/man/dpkg.1
+++ b/man/dpkg.1
@@ -699,7 +699,7 @@ starts a character class, which can contain a list of characters, ranges
 and complementations. See \fBglob\fP(7) for detailed information about
 globbing. Note: the current implementation might re-include more directories
 and symlinks than needed, to be on the safe side and avoid possible unpack
-failures, future work might fix this.
+failures; future work might fix this.
 
 This can be used to remove all paths except some particular ones; a typical
 case is:
@@ -714,6 +714,16 @@ to remove all documentation files except the copyright files.
 These two options can be specified multiple times, and interleaved with
 each other. Both are processed in the given order, with the last rule that
 matches a file name making the decision.
+
+The filters are applied when unpacking the binary packages, and as such
+only have knowledge of the type of object currently being filtered
+(e.g. a normal file or a directory) and 

Bug#811267: handling issues of package contents in the case of --path-exclude

[Guillem Jover]

Hi!

On Sun, 2016-01-17 at 18:37:50 +0100, Marc Haber wrote:
> On Sun, Jan 17, 2016 at 05:27:06PM +0100, Guillem Jover wrote:
> > On Sun, 2016-01-17 at 13:10:42 +0100, Marc Haber wrote:
> > > root@fan:/# dpkg --install --path-exclude=/usr/share/zoneinfo 
> > > /var/cache/apt/archives/tzdata_2015g-1_all.deb
> > > (Reading database ... 9271 files and directories currently installed.)
> > > Preparing to unpack .../tzdata_2015g-1_all.deb ...
> > > Unpacking tzdata (2015g-1) over (2015g-1) ...
> > > dpkg: error processing archive 
> > > /var/cache/apt/archives/tzdata_2015g-1_all.deb (--install):
> > >  unable to create '/usr/share/zoneinfo/leap-seconds.list.dpkg-new' (while 
> > > processing './usr/share/zoneinfo/leap-seconds.list'): No such file or 
> > > directory
> > > dpkg-deb: error: subprocess paste was killed by signal (Broken pipe)
> > > Errors were encountered while processing:
> > >  /var/cache/apt/archives/tzdata_2015g-1_all.deb
> > > root@fan:/#
> > > 
> > > In this case, dpkg should not try to unpack leap-seconds.list since it
> > > is in the excluded directory.
> > 
> > Actually, in this case given how the filters work, ideally, the exclusion
> > should be ignored. What you actually requested was:
> > 
> >   exclude /usr/share/zoneinfo
> >   include /usr/share/zoneinfo/*
> 
> Why?

Because these filters have side effects in contrast to find filters
for example, and they are used on "streamed data". In dpkg, the filters
have no knowledge of what type of objects they are filtering, so you
specify a pathname that might be a directory or a file or a symlink,
etc. And once the file is being unpacked, it only knows about the
current pathname, and not if subsequent entries will also need this one
or not. At that point dpkg has to decide if it unpacks the pathname or
not, w/o further visibility. Making dpkg aware of futher objects would
imply that it needs to do a two-pass over the .deb package to know the
full contents of it, instead of unpacking on the fly.

> However, excluding both leads to the second problem:
> 
> root@fan:/# dpkg --install --path-exclude='/usr/share/zoneinfo' 
> --path-exclude='/usr/share/zoneinfo/*' 
> /var/cache/apt/archives/tzdata_2015g-1_all.deb
> (Reading database ... 9271 files and directories currently installed.)
> Preparing to unpack .../tzdata_2015g-1_all.deb ...
> Unpacking tzdata (2015g-1) over (2015g-1) ...
> dpkg: error processing archive /var/cache/apt/archives/tzdata_2015g-1_all.deb 
> (--install):
>  error creating directory './usr/share/zoneinfo/right/Etc': No such file or 
> directory
> dpkg-deb: error: subprocess paste was killed by signal (Broken pipe)
> Errors were encountered while processing:
>  /var/cache/apt/archives/tzdata_2015g-1_all.deb
> root@fan:/#
> 
> dpkg should not try to unpack files in a directory that was excluded.

Yes, it should, and that's what's supposed to happen. Here's a session
on my system:

,---
# rm -rf /usr/share/zoneinfo
# ls -la /usr/share/zoneinfo
ls: cannot access /usr/share/zoneinfo: No such file or directory
# dpkg --path-exclude='/usr/share/zoneinfo' 
--path-exclude='/usr/share/zoneinfo/*' --install tzdata_2015g-1_all.deb
(Reading database ... 264026 files and directories currently installed.)
Preparing to unpack tzdata_2015g-1_all.deb ...
Unpacking tzdata (2015g-1) over (2015g-1) ...
Setting up tzdata (2015g-1) ...

User defined time zone, leaving /etc/localtime unchanged.
Local time is now:  Mon Jan 18 02:56:22 CET 2016.
Universal Time is now:  Mon Jan 18 01:56:22 UTC 2016.
Run 'dpkg-reconfigure tzdata' if you wish to change it.

# ls -la /usr/share/zoneinfols: cannot access /usr/share/zoneinfo: No such file 
or directory
#
`---

So there's something else going on here. Could you run the above but by
passing «-D333» to dpkg, and send the log?

> I don't think that it would be helpful to exclude
> /usr/share/zoneinfo/*/* and /usr/share/zoneinfo/*/*/* as well, since
> one never knows whether in the future, the directory tree will grow
> another level.

Sure, and the current glob makes ‘*’ match on any character, so the above
should not be necessary.

> If you absolutely want to keep the current semantics and don't agree
> that this is a bug, I'd like to suggest a rsync-like syntax like
> --path-exclude=/usr/share/zoneinfo/** to specify a recursive exclude.

My comment on the semantics was about making «/foo/bar» exclude any
files beneath that pathname, not on the ‘*’ glob semantics, which I
think are already sane.

> > I can probably add a note about this kind of situations in the man
> > page.
> 
> IMO, no need for that. My bad.

I think still some things can be clarified, to avoid further
confusion. :)

Thanks,
Guillem

Bug#811267: handling issues of package contents in the case of --path-exclude

[Marc Haber]

Package: dpkg
Version: 1.18.4
Severity: normal

I am trying to checkout the --path-exclude option of dpkg in a test
chroot by first removing /usr/share/zoneinfo and then trying to
install the tzdata package. I have found the following issues:

root@fan:/# dpkg --install --path-exclude=/usr/share/zoneinfo 
/var/cache/apt/archives/tzdata_2015g-1_all.deb
(Reading database ... 9271 files and directories currently installed.)
Preparing to unpack .../tzdata_2015g-1_all.deb ...
Unpacking tzdata (2015g-1) over (2015g-1) ...
dpkg: error processing archive /var/cache/apt/archives/tzdata_2015g-1_all.deb 
(--install):
 unable to create '/usr/share/zoneinfo/leap-seconds.list.dpkg-new' (while 
processing './usr/share/zoneinfo/leap-seconds.list'): No such file or directory
dpkg-deb: error: subprocess paste was killed by signal (Broken pipe)
Errors were encountered while processing:
 /var/cache/apt/archives/tzdata_2015g-1_all.deb
root@fan:/#

In this case, dpkg should not try to unpack leap-seconds.list since it
is in the excluded directory.

root@fan:/# dpkg --install --path-exclude=/usr/share/zoneinfo/* 
/var/cache/apt/archives/tzdata_2015g-1_all.deb
(Reading database ... 9271 files and directories currently installed.)
Preparing to unpack .../tzdata_2015g-1_all.deb ...
Unpacking tzdata (2015g-1) over (2015g-1) ...
dpkg: error processing archive /var/cache/apt/archives/tzdata_2015g-1_all.deb 
(--install):
 error creating directory './usr/share/zoneinfo/right/Etc': No such file or 
directory
dpkg-deb: error: subprocess paste was killed by signal (Broken pipe)
Errors were encountered while processing:
 /var/cache/apt/archives/tzdata_2015g-1_all.deb
root@fan:/#

In this case, dpkg should not try to create the
/usr/share/zoneinfo/right/Etc directory since it is in the excluded
path.

A third case needed a removed and excluded /usr/share/man:

root@fan:/# dpkg --install --path-exclude=/usr/share/man/man1/sh.1.gz 
var/cache/apt/archives/dash_0.5.7-4+b1_amd64.deb
(Reading database ... 6927 files and directories currently installed.)
Preparing to unpack .../dash_0.5.7-4+b1_amd64.deb ...
ln: failed to create symbolic link '/usr/share/man/man1/sh.1.gz.tmp': No such 
file or directory
dpkg: error processing archive var/cache/apt/archives/dash_0.5.7-4+b1_amd64.deb 
(--install):
 subprocess new pre-installation script returned error exit status 1
Errors were encountered while processing:
 var/cache/apt/archives/dash_0.5.7-4+b1_amd64.deb
root@fan:/#

The error message is the same regardless whether the excluded path is
/usr/share/man/man1/*, /usr/share/man/*/*,
/usr/share/man/* or /usr/share/man. In this case, dpkg should honor
excluded paths even for symlinks.

In any case, dpkg probably should not error out but try to create the
parent directories first. In the case of --path-exclude, dpkg should
handle excluded directories recursively, e.g. not try to create
/usr/share/zoneinfo/right/Etc if the excluded path is
/usr/share/zoneinfo/*.

Greetings
Marc

Bug#811267: handling issues of package contents in the case of --path-exclude

[Guillem Jover]

Control: severity -1 wishlist

Hi!

On Sun, 2016-01-17 at 13:10:42 +0100, Marc Haber wrote:
> Package: dpkg
> Version: 1.18.4
> Severity: normal

> I am trying to checkout the --path-exclude option of dpkg in a test
> chroot by first removing /usr/share/zoneinfo and then trying to
> install the tzdata package. I have found the following issues:

Ok, let's see. :)

> root@fan:/# dpkg --install --path-exclude=/usr/share/zoneinfo 
> /var/cache/apt/archives/tzdata_2015g-1_all.deb
> (Reading database ... 9271 files and directories currently installed.)
> Preparing to unpack .../tzdata_2015g-1_all.deb ...
> Unpacking tzdata (2015g-1) over (2015g-1) ...
> dpkg: error processing archive /var/cache/apt/archives/tzdata_2015g-1_all.deb 
> (--install):
>  unable to create '/usr/share/zoneinfo/leap-seconds.list.dpkg-new' (while 
> processing './usr/share/zoneinfo/leap-seconds.list'): No such file or 
> directory
> dpkg-deb: error: subprocess paste was killed by signal (Broken pipe)
> Errors were encountered while processing:
>  /var/cache/apt/archives/tzdata_2015g-1_all.deb
> root@fan:/#
> 
> In this case, dpkg should not try to unpack leap-seconds.list since it
> is in the excluded directory.

Actually, in this case given how the filters work, ideally, the exclusion
should be ignored. What you actually requested was:

  exclude /usr/share/zoneinfo
  include /usr/share/zoneinfo/*

But the filter code has no knowlegde that a specifically excluded path
might be needed by some future entry (that has not been explicitly
included back).

If this needs fixing, it's probably in the documentation. I don't
think changing the semantics (w/o much thought) would be wise at this
point in time.

> root@fan:/# dpkg --install --path-exclude=/usr/share/zoneinfo/* 
> /var/cache/apt/archives/tzdata_2015g-1_all.deb
> (Reading database ... 9271 files and directories currently installed.)
> Preparing to unpack .../tzdata_2015g-1_all.deb ...
> Unpacking tzdata (2015g-1) over (2015g-1) ...
> dpkg: error processing archive /var/cache/apt/archives/tzdata_2015g-1_all.deb 
> (--install):
>  error creating directory './usr/share/zoneinfo/right/Etc': No such file or 
> directory
> dpkg-deb: error: subprocess paste was killed by signal (Broken pipe)
> Errors were encountered while processing:
>  /var/cache/apt/archives/tzdata_2015g-1_all.deb
> root@fan:/#
>
> In this case, dpkg should not try to create the
> /usr/share/zoneinfo/right/Etc directory since it is in the excluded
> path.

This works for me, and I cannot reproduce. Did you happen to try that
with a (partially-)populated /usr/share/zoneinfo/? Try instead quoting
the argument like  «--path-exclude='/usr/share/zoneinfo/*'» to avoid the
shell expanding the glob.

> A third case needed a removed and excluded /usr/share/man:
> 
> root@fan:/# dpkg --install --path-exclude=/usr/share/man/man1/sh.1.gz 
> var/cache/apt/archives/dash_0.5.7-4+b1_amd64.deb
> (Reading database ... 6927 files and directories currently installed.)
> Preparing to unpack .../dash_0.5.7-4+b1_amd64.deb ...
> ln: failed to create symbolic link '/usr/share/man/man1/sh.1.gz.tmp': No such 
> file or directory
> dpkg: error processing archive 
> var/cache/apt/archives/dash_0.5.7-4+b1_amd64.deb (--install):
>  subprocess new pre-installation script returned error exit status 1
> Errors were encountered while processing:
>  var/cache/apt/archives/dash_0.5.7-4+b1_amd64.deb
> root@fan:/#
> 
> The error message is the same regardless whether the excluded path is
> /usr/share/man/man1/*, /usr/share/man/*/*,
> /usr/share/man/* or /usr/share/man. In this case, dpkg should honor
> excluded paths even for symlinks.

That's not dpkg's fault, that's the maintainer script not coping with
an excluded path. If this needs to be fixed it is in dash itself:

  $ dpkg-query --control-show dash preinst

I can probably add a note about this kind of situations in the man
page.

> In any case, dpkg probably should not error out but try to create the
> parent directories first. In the case of --path-exclude, dpkg should
> handle excluded directories recursively, e.g. not try to create
> /usr/share/zoneinfo/right/Etc if the excluded path is
> /usr/share/zoneinfo/*.

See above.

Thanks,
Guillem

Bug#811267: handling issues of package contents in the case of --path-exclude

[Marc Haber]

Hi,

On Sun, Jan 17, 2016 at 05:27:06PM +0100, Guillem Jover wrote:
> On Sun, 2016-01-17 at 13:10:42 +0100, Marc Haber wrote:
> > Package: dpkg
> > Version: 1.18.4
> > Severity: normal
> 
> > I am trying to checkout the --path-exclude option of dpkg in a test
> > chroot by first removing /usr/share/zoneinfo and then trying to
> > install the tzdata package. I have found the following issues:
> 
> Ok, let's see. :)

Thanks for considering that fast.

> > root@fan:/# dpkg --install --path-exclude=/usr/share/zoneinfo 
> > /var/cache/apt/archives/tzdata_2015g-1_all.deb
> > (Reading database ... 9271 files and directories currently installed.)
> > Preparing to unpack .../tzdata_2015g-1_all.deb ...
> > Unpacking tzdata (2015g-1) over (2015g-1) ...
> > dpkg: error processing archive 
> > /var/cache/apt/archives/tzdata_2015g-1_all.deb (--install):
> >  unable to create '/usr/share/zoneinfo/leap-seconds.list.dpkg-new' (while 
> > processing './usr/share/zoneinfo/leap-seconds.list'): No such file or 
> > directory
> > dpkg-deb: error: subprocess paste was killed by signal (Broken pipe)
> > Errors were encountered while processing:
> >  /var/cache/apt/archives/tzdata_2015g-1_all.deb
> > root@fan:/#
> > 
> > In this case, dpkg should not try to unpack leap-seconds.list since it
> > is in the excluded directory.
> 
> Actually, in this case given how the filters work, ideally, the exclusion
> should be ignored. What you actually requested was:
> 
>   exclude /usr/share/zoneinfo
>   include /usr/share/zoneinfo/*

Why?

However, excluding both leads to the second problem:

root@fan:/# dpkg --install --path-exclude='/usr/share/zoneinfo' 
--path-exclude='/usr/share/zoneinfo/*' 
/var/cache/apt/archives/tzdata_2015g-1_all.deb
(Reading database ... 9271 files and directories currently installed.)
Preparing to unpack .../tzdata_2015g-1_all.deb ...
Unpacking tzdata (2015g-1) over (2015g-1) ...
dpkg: error processing archive /var/cache/apt/archives/tzdata_2015g-1_all.deb 
(--install):
 error creating directory './usr/share/zoneinfo/right/Etc': No such file or 
directory
dpkg-deb: error: subprocess paste was killed by signal (Broken pipe)
Errors were encountered while processing:
 /var/cache/apt/archives/tzdata_2015g-1_all.deb
root@fan:/#

dpkg should not try to unpack files in a directory that was excluded.

I don't think that it would be helpful to exclude
/usr/share/zoneinfo/*/* and /usr/share/zoneinfo/*/*/* as well, since
one never knows whether in the future, the directory tree will grow
another level.

If you absolutely want to keep the current semantics and don't agree
that this is a bug, I'd like to suggest a rsync-like syntax like
--path-exclude=/usr/share/zoneinfo/** to specify a recursive exclude.

> > root@fan:/# dpkg --install --path-exclude=/usr/share/zoneinfo/* 
> > /var/cache/apt/archives/tzdata_2015g-1_all.deb
> > (Reading database ... 9271 files and directories currently installed.)
> > Preparing to unpack .../tzdata_2015g-1_all.deb ...
> > Unpacking tzdata (2015g-1) over (2015g-1) ...
> > dpkg: error processing archive 
> > /var/cache/apt/archives/tzdata_2015g-1_all.deb (--install):
> >  error creating directory './usr/share/zoneinfo/right/Etc': No such file or 
> > directory
> > dpkg-deb: error: subprocess paste was killed by signal (Broken pipe)
> > Errors were encountered while processing:
> >  /var/cache/apt/archives/tzdata_2015g-1_all.deb
> > root@fan:/#
> >
> > In this case, dpkg should not try to create the
> > /usr/share/zoneinfo/right/Etc directory since it is in the excluded
> > path.
> 
> This works for me, and I cannot reproduce.

See above, same with quoted path.

>  Did you happen to try that with a (partially-)populated
>  /usr/share/zoneinfo/? Try instead quoting the argument like
>  «--path-exclude='/usr/share/zoneinfo/*'» to avoid the shell expanding
>  the glob.

Ouch, idiot me, but that was not the issue since my
/usr/share/zoneinfo didn't even exist.

> > A third case needed a removed and excluded /usr/share/man:
> > 
> > root@fan:/# dpkg --install --path-exclude=/usr/share/man/man1/sh.1.gz 
> > var/cache/apt/archives/dash_0.5.7-4+b1_amd64.deb
> > (Reading database ... 6927 files and directories currently installed.)
> > Preparing to unpack .../dash_0.5.7-4+b1_amd64.deb ...
> > ln: failed to create symbolic link '/usr/share/man/man1/sh.1.gz.tmp': No 
> > such file or directory
> > dpkg: error processing archive 
> > var/cache/apt/archives/dash_0.5.7-4+b1_amd64.deb (--install):
> >  subprocess new pre-installation script returned error exit status 1
> > Errors were encountered while processing:
> >  var/cache/apt/archives/dash_0.5.7-4+b1_amd64.deb
> > root@fan:/#
> > 
> > The error message is the same regardless whether the excluded path is
> > /usr/share/man/man1/*, /usr/share/man/*/*,
> > /usr/share/man/* or /usr/share/man. In this case, dpkg should honor
> > excluded paths even for symlinks.
> 
> That's not dpkg's fault, that's the maintainer script not coping with
> an excluded path. If