Package: dbconfig-common
Version: 2.0.0
Severity: serious
Justification: Policy 10.4
The construct `…` for pre-POSIX style command substitutions
is unportable when double quotes are used both inside and
outside the substitution.
There has recently been an issue raised with POSIX about the
interpretation of the standard regarding this issue, as the
POSIX standard per se *is* clear on this, but the current
interpretation, which is shared by the yash developers, does not
match current shell practice. This only affects constructs like:
echo "`echo \"foo\"`"
which shows
foo
in almost all current and some historic shells, and
"foo"
in mksh’s POSIX mode, yash, and some other historic shells.
Your script relies on one interpretation of this unportability
(and the one which doesn’t match current POSIX at that):
tglase@tglase:~ $ grep -r '".*`.*".*`.*"' /usr/share/dbconfig-common
/usr/share/dbconfig-common/internal/mysql: dbc_error="mysql said: `cat
\"$l_errfile\"`"
/usr/share/dbconfig-common/dpkg/common: mkdir -p "`dirname
\"$dbc_packageconfig\"`"
The effect of this is that, when any package using dbconfig-common
is configured while lksh (from the mksh package) or yash is /bin/sh
a directory called ‘"’ is created under the current working directory.
The fix is trivial: use the modern and recommended (since the 1980s
or so) form of command substitution:
mkdir -p "$(dirname "$dbc_packageconfig")"
Further readings:
– GNU autoconf texinfo documentation, section *Portable Shell::
– http://austingroupbugs.net/view.php?id=1015 in which I ask
POSIX to standardise on current practice (which would make
your script in theory valid, but still unportable; funnily,
since people nowadays only ever use ‘`’ to be m̲o̲r̲e̲ portable).
-- System Information:
Debian Release: stretch/sid
APT prefers unreleased
APT policy: (500, 'unreleased'), (500, 'buildd-unstable'), (500, 'unstable')
Architecture: x32 (x86_64)
Foreign Architectures: i386, amd64
Kernel: Linux 4.3.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=C, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/lksh
Init: sysvinit (via /sbin/init)
Versions of packages dbconfig-common depends on:
ii debconf [debconf-2.0] 1.5.58
ii ucf 3.0031
dbconfig-common recommends no packages.
Versions of packages dbconfig-common suggests:
pn dbconfig-mysql | dbconfig-pgsql | dbconfig-sqlite | dbconfig-sqlite <none>
-- debconf information:
dbconfig-common/mysql/method: Unix socket
* dbconfig-common/remote-questions-default: false
dbconfig-common/pgsql/method: TCP/IP
dbconfig-common/dbconfig-remove: true
dbconfig-common/missing-db-package-error: abort
dbconfig-common/db/basepath:
dbconfig-common/pgsql/revertconf: false
dbconfig-common/pgsql/no-user-choose-other-method:
dbconfig-common/pgsql/authmethod-user: password
dbconfig-common/database-type:
dbconfig-common/pgsql/authmethod-admin: ident
dbconfig-common/mysql/admin-user: root
dbconfig-common/remote/newhost:
dbconfig-common/pgsql/manualconf:
dbconfig-common/purge: false
dbconfig-common/db/app-user:
dbconfig-common/internal/reconfiguring: false
dbconfig-common/passwords-do-not-match:
dbconfig-common/remote/port:
dbconfig-common/remove-error: abort
dbconfig-common/dbconfig-install: true
dbconfig-common/upgrade-backup: true
dbconfig-common/pgsql/changeconf: false
dbconfig-common/pgsql/no-empty-passwords:
dbconfig-common/dbconfig-upgrade: true
dbconfig-common/dbconfig-reinstall: false
dbconfig-common/install-error: abort
dbconfig-common/pgsql/admin-user: postgres
* dbconfig-common/remember-admin-pass: true
dbconfig-common/upgrade-error: abort
dbconfig-common/remote/host:
dbconfig-common/internal/skip-preseed: false
dbconfig-common/db/dbname:
