Package: apt-utils Version: 1.8.2 Severity: minor Dear Maintainer,
Packages files created by apt-ftparchive will sometimes contain non- canonicalized filenames, e.g. "./pool/dummy_1.0_all.deb". This conflicts with the field's format specification, according to the wiki (https://wiki.debian.org/DebianRepository/Format#Filename). The problem occurs whenever the "path" parameter contains "." or ".." in any combination. Presumably, the path is just used as-is without any attempt at canonicalization. Steps to reproduce (one example): equivs-build /dev/null apt-ftparchive packages . The resulting output will contain a Filename field with a non-canonical path: Filename: ./equivs-dummy_1.0_all.deb Regards, Robin -- System Information: Debian Release: 10.2 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.19.0-6-amd64 (SMP w/12 CPU cores) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8) Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages apt-utils depends on: ii apt 1.8.2 ii libapt-inst2.0 1.8.2 ii libapt-pkg5.0 1.8.2 ii libc6 2.28-10 ii libdb5.3 5.3.28+dfsg1-0.5 ii libgcc1 1:8.3.0-6 ii libstdc++6 8.3.0-6 apt-utils recommends no packages. apt-utils suggests no packages. -- no debconf information