Subject: Bug#900354: lintian: warn against guarding adduser/addgroup calls

From: Julien Cristau <[email-masked]>
Date: Tue, 29 May 2018 14:22:31 +0200

Package: lintian
Severity: wishlist

<@weasel> not that I'd file a bug about this, but I don't like this pattern:
<@weasel>     if ! getent group "$REPRO_GROUP" >/dev/null; then
<@weasel>         addgroup --system "$REPRO_GROUP" || exit 1
<@weasel>     fi
<@weasel> the goal of --system is to a) not fail if the group exists and
is a system group
<@weasel> but also, to b) fail if the group exists and isn't a system group
<@jcristau> ack
<@weasel> since in that case we don't want to use that group as it might
be for whoknowswhat.
<@weasel> maybe this is something that should be brought to the
attention of qa, release, or the developers at large.
<@weasel> "guarding adduser calls considered harmful"
<@jcristau> seems like something lintian could catch
<@weasel> yup

Cheers,
Julien

---

From: Chris Lamb <[email-masked]>
Date: Tue, 29 May 2018 15:28:11 +0100

tags 900354 + moreinfo
thanks

Hi Julien,

Thanks for the report.

> <@weasel> "guarding adduser calls considered harmful"

… regardless of --system or? oh, some concrete examples of "good" and
"bad" would be really helpful here in ensuring we implement exactly
what you after if you could spend a couple of seconds on that?

Best wishes,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      [email-masked] / chris-lamb.co.uk
       `-

---

From: Julien Cristau <[email-masked]>
Date: Tue, 29 May 2018 16:33:21 +0200

> what you after if you could spend a couple of seconds on that?
I would think adduser/addgroup without --system in maintainer scripts
should be verboten altogether.  I'll try to poke through codesearch to
find other examples later.

Cheers,
Julien

---

From: Chris Lamb <[email-masked]>
Date: Fri, 01 Jun 2018 09:22:44 +0100

Dear Julien,

> find other examples later.

Great stuff — looking forward to receiving these. :)

Regards,

---

From: Chris Lamb <[email-masked]>
Date: Mon, 14 Jan 2019 23:52:30 +0000

> Great stuff — looking forward to receiving these. :)

Gentle ping on this, Julien?

Regards,