Drill
Drill copied to clipboard
Invalid Debian package name
When Drill Debian package is installed, the reported source package name is https://github.com/yatima1460/Drill
. A URL is not a valid package name. This is a problem for tools that need a real package name to work properly.
For example, debsecan (a classic tool used to scan for vulnerabilities on Debian installations) cannot work anymore due to this anomaly:
$ debsecan --suite $(lsb_release --codename --short) --source https://raw.githubusercontent.com/BBVA/ust2dsa/data/ --format detail
Traceback (most recent call last):
File "/usr/bin/debsecan", line 1370, in <module>
rate_system(target, options, fetch_data(options, config), history)
File "/usr/bin/debsecan", line 1305, in rate_system
raise SyntaxError(('package %s references '
SyntaxError: package drill-search-gtk references invalid source package 'https://github.com/yatima1460/Drill'
So, when Drill is installed, the result is that the overall system cannot be analyzed for security vulnerabilities...
Remark: I agree that debsecan
should not fail like that. It should report the anomaly, discard Drill from the analysis and continue his work. But all tools that expects for a valid package name are potentially affected by this small mistake.
For information, the Debian package naming rules are (from Debian policy):
Package names (both source and binary, see Package) must consist only of lower case letters (a-z), digits (0-9), plus (+) and minus (-) signs, and periods (.). They must be at least two characters long and must start with an alphanumeric character.
Environment:
- Installation: Debian package
- Version: v566
- OS: Ubuntu 20.10
Hello, sorry if I abandoned this repo, I hope to revamp it soon
Thanks for posting issues :D