Drill icon indicating copy to clipboard operation
Drill copied to clipboard

Invalid Debian package name

Open laurent-simon opened this issue 3 years ago • 1 comments

When Drill Debian package is installed, the reported source package name is https://github.com/yatima1460/Drill. A URL is not a valid package name. This is a problem for tools that need a real package name to work properly.

For example, debsecan (a classic tool used to scan for vulnerabilities on Debian installations) cannot work anymore due to this anomaly:

$ debsecan --suite $(lsb_release --codename --short) --source https://raw.githubusercontent.com/BBVA/ust2dsa/data/  --format detail
Traceback (most recent call last):
  File "/usr/bin/debsecan", line 1370, in <module>
    rate_system(target, options, fetch_data(options, config), history)
  File "/usr/bin/debsecan", line 1305, in rate_system
    raise SyntaxError(('package %s references '
SyntaxError: package drill-search-gtk references invalid source package 'https://github.com/yatima1460/Drill'

So, when Drill is installed, the result is that the overall system cannot be analyzed for security vulnerabilities...

Remark: I agree that debsecan should not fail like that. It should report the anomaly, discard Drill from the analysis and continue his work. But all tools that expects for a valid package name are potentially affected by this small mistake.

For information, the Debian package naming rules are (from Debian policy):

Package names (both source and binary, see Package) must consist only of lower case letters (a-z), digits (0-9), plus (+) and minus (-) signs, and periods (.). They must be at least two characters long and must start with an alphanumeric character.

Environment:

  • Installation: Debian package
  • Version: v566
  • OS: Ubuntu 20.10

laurent-simon avatar Jan 30 '21 12:01 laurent-simon

Hello, sorry if I abandoned this repo, I hope to revamp it soon

Thanks for posting issues :D

yatima1460 avatar Feb 14 '21 22:02 yatima1460