Russ Allbery wrote: > Luk Claes <[EMAIL PROTECTED]> writes: > >> tags 231770 +patch >> thanks > >> Hi > >> Easy patch included for consideration. > > My concern about the simple approach to this (which I never sent to the > bug; my bad) is that the other major use of read besides prompting is for > parsing files. It's not uncommon to see a construct like: > > while read facility destination ; do > # do something with facility and destination > done < /etc/syslog.conf > > Your patch won't produce false positives with this, but I don't know if > there are any scripts that do something similar but don't use that > explicit of a loop. I don't see any in a quick check on my system, but I > only have a few packages installed.
I would be surprised to see it happen, but if it happens we can always improve
the checking, no?
> The other problem is that some packages fall back on read when debconf
> isn't available (Postfix, for example) and others intentionally don't use
> debconf (libc6). I'm not sure how to handle those cases, and this patch
> would definitely give false positives for Postfix unless we think that it
> shouldn't support a fallback if debconf is missing. There are several
> other packages on my system with similar fallbacks (flex, fvwm, and
> openssh-server) in their *.preinst files.
>
> I wonder if we could work around the case where read is used only as a
> fallback by not issuing this diagnostic for scripts that also try to use
> debconf and just assume that if the maintainer is using debconf at all,
> they know what they're doing. That leaves the packages that are
> intentionally avoiding use of debconf, but maybe if we exempt essential
> packages from this check (plus things like libc6 that are essential in
> practice), that would cut the false positives down sufficiently.
>
> What do you think?
Why would essential packages not try to use debconf if available?
I updated the patch a bit so that if db_input is used before the read it won't
barf:
- my $cat_string = "";
+ my $cat_string = "";
+ my $seen_debconf = 0;
- if (m/^\s*read(?:\s|$)) {
- tag "read-in-maintainer-script", "$file:$.";
- }
+ if (m/db_input/) {
+ $seen_debconf = 1;
+ }
+ if (m/^\s*read(?:\s|$)/ && !$seen_debconf) {
+ tag "read-in-maintainer-script", "$file:$.";
+ }
Cheers
Luk
--
Luk Claes - http://people.debian.org/~luk - GPG key 1024D/9B7C328D
Fingerprint: D5AF 25FB 316B 53BB 08E7 F999 E544 DE07 9B7C 328D
signature.asc
Description: OpenPGP digital signature
