Source: open-infrastructure-compute-tools Source-Version: 20190811-1 Severity: important User: [email protected] Usertags: dpkg-db-access-blocker
Hi! This package contains a script («share/scripts/debconf»), which directly access the dpkg internal database, instead of using one of the public interfaces provided by dpkg. The script checks for the presence of the .list and .postinst files to assert whether packages are installed. These components should be switched to use something else. For example check the status for each of these packages via dpkg-query. This is a problem for several reasons, because even though the layout and format of the dpkg database is administrator friendly, and it is expected that those might need to mess with it, in case of emergency, this “interface” does not extend to other programs besides the dpkg suite of tools. The admindir can also be configured differently at dpkg build or run-time. And finally, the contents and its format, will be changing in the near future. Thanks, Guillem
