Source: avfs
Source-Version: 1.1.1-1
Severity: important
User: [email protected]
Usertags: dpkg-db-access-blocker
Hi!
This package contains the «extfs/apt.in», «extfs/debd.in» and
«extfs/dpkg.in» modules, which directly accesses the dpkg internal
database, instead of using one of the public interfaces provided by
dpkg.
---
The «extfs/apt.in» module should stop reading the status database
and the files list files, and be switched to use something like:
«dpkg-query \
--showformat 'Package: ${Package}\n\
Status: ${db:Status-Status}\n\
Section: ${Section}\n\
Installed-Size: ${Installed-Size}\n\
Mtime: ${db-fsys:Last-Modified}\n' \
--show»
to get them.
---
The «extfs/debd.in» module should stop poking into the control files
database, and instead use something like:
«dpkg-query --control-list $pkg»
to get the list of control files present. It should also stop reading
the files list file directly and instead switch the initial «dpkg -s»
call into something like:
«dpkg-query \
--showformat 'Package: ${Package}\n\
Status: ${db:Status-Status}\n\
Files:\n${db-fsys:Files}\n' \
--show $pkg»
to get them. And it instead of «cat»'ing the control files it should
be using:
«dpkg-query --control-show $pkg $ctrfile»
there is currently no way to externally trigger the execution of a
maint-script, even though it looks like the one in the fun() function
is bogus as it will not pass any of the expected environment variables
nor expected arguments.
---
The «extfs/dpkg.in» module should stop readind the status and available
databases directly, and use instead:
«dpkg-query --status»
«dpkg-query --print-avail»
which will dump the entire things. To get the package last-modified
time it should do something similar to the «extfs/apt.in» module.
This is a problem for several reasons, because even though the layout and
format of the dpkg database is administrator friendly, and it is expected
that those might need to mess with it, in case of emergency, this
“interface” does not extend to other programs besides the dpkg suite of
tools. The admindir can also be configured differently at dpkg build or
run-time. And finally, the contents and its format, will be changing in
the near future.
Thanks,
Guillem
