Debian Bug report logs - #913696
debdelta: Script accesses internal dpkg database

version graph

Package: src:debdelta; Maintainer for src:debdelta is A Mennucc1 <[email protected]>;

Reported by: Guillem Jover <[email protected]>

Date: Wed, 14 Nov 2018 03:18:02 UTC

Severity: important

Found in version debdelta/0.62

Reply or subscribe to this bug.

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to [email protected], A Mennucc1 <[email protected]>:
Bug#913696; Package src:debdelta. (Wed, 14 Nov 2018 03:18:04 GMT) (full text, mbox, link).


Acknowledgement sent to Guillem Jover <[email protected]>:
New Bug report received and forwarded. Copy sent to A Mennucc1 <[email protected]>. (Wed, 14 Nov 2018 03:18:04 GMT) (full text, mbox, link).


Message #5 received at [email protected] (full text, mbox, reply):

From: Guillem Jover <[email protected]>
To: [email protected]
Subject: debdelta: Script accesses internal dpkg database
Date: Wed, 14 Nov 2018 04:13:55 +0100
Source: debdelta
Source-Version: 0.62
Severity: important
User: [email protected]
Usertags: dpkg-db-access-blocker

Hi!

This package contains a script («debdelta»), which directly accesses
the dpkg internal database, instead of using one of the public interfaces
provided by dpkg. The code in do_patch_, should be switched to use:

  «dpkg-query --showformat='${Conffiles}\n' --show»

to fetch the list of conffiles. Then _symlink_data_tree should be switched
to always use dpkg_L, and dpkg_L_faster should be removed. Finally the
code handling 'old-control-tree' should be switched to use something like:

  «dpkg-query --control-list»


This is a problem for several reasons, because even though the layout and
format of the dpkg database is administrator friendly, and it is expected
that those might need to mess with it, in case of emergency, this
“interface” does not extend to other programs besides the dpkg suite of
tools. The admindir can also be configured differently at dpkg build or
run-time. And finally, the contents and its format, will be changing in
the near future.

Thanks,
Guillem



Information forwarded to [email protected], A Mennucc1 <[email protected]>:
Bug#913696; Package src:debdelta. (Sat, 02 Feb 2019 10:09:03 GMT) (full text, mbox, link).


Acknowledgement sent to A Mennucc1 <[email protected]>:
Extra info received and forwarded to list. Copy sent to A Mennucc1 <[email protected]>. (Sat, 02 Feb 2019 10:09:03 GMT) (full text, mbox, link).


Message #10 received at [email protected] (full text, mbox, reply):

From: A Mennucc1 <[email protected]>
To: Guillem Jover <[email protected]>, [email protected]
Subject: Re: Bug#913696: debdelta: Script accesses internal dpkg database
Date: Sat, 2 Feb 2019 10:59:05 +0100
[Message part 1 (text/plain, inline)]
Dear Guillem,

I see your point;

but (as the name " dpkg_L_faster" suggests), using the dpkg commands to
obtain meta-information is quite slow; so I will have to think about it

BTW: you write

>  And finally, the contents and its format, will be changing in
> the near future.
May you please point me to some more info regarding this change?

Thanks,

a.

Il 14/11/18 04:13, Guillem Jover ha scritto:
> Source: debdelta
> Source-Version: 0.62
> Severity: important
> User: [email protected]
> Usertags: dpkg-db-access-blocker
>
> Hi!
>
> This package contains a script («debdelta»), which directly accesses
> the dpkg internal database, instead of using one of the public interfaces
> provided by dpkg. The code in do_patch_, should be switched to use:
>
>   «dpkg-query --showformat='${Conffiles}\n' --show»
>
> to fetch the list of conffiles. Then _symlink_data_tree should be switched
> to always use dpkg_L, and dpkg_L_faster should be removed. Finally the
> code handling 'old-control-tree' should be switched to use something like:
>
>   «dpkg-query --control-list»
>
>
> This is a problem for several reasons, because even though the layout and
> format of the dpkg database is administrator friendly, and it is expected
> that those might need to mess with it, in case of emergency, this
> “interface” does not extend to other programs besides the dpkg suite of
> tools. The admindir can also be configured differently at dpkg build or
> run-time. And finally, the contents and its format, will be changing in
> the near future.
>
> Thanks,
> Guillem
>


[signature.asc (application/pgp-signature, attachment)]

Information forwarded to [email protected], A Mennucc1 <[email protected]>:
Bug#913696; Package src:debdelta. (Thu, 17 Jun 2021 02:09:02 GMT) (full text, mbox, link).


Acknowledgement sent to Guillem Jover <[email protected]>:
Extra info received and forwarded to list. Copy sent to A Mennucc1 <[email protected]>. (Thu, 17 Jun 2021 02:09:02 GMT) (full text, mbox, link).


Message #15 received at [email protected] (full text, mbox, reply):

From: Guillem Jover <[email protected]>
To: A Mennucc1 <[email protected]>
Cc: [email protected]
Subject: Re: Bug#913696: debdelta: Script accesses internal dpkg database
Date: Thu, 17 Jun 2021 04:07:48 +0200
Hi!

[ Sorry, it seems I missed replying to this. ]

On Sat, 2019-02-02 at 10:59:05 +0100, A Mennucc1 wrote:
> I see your point;
> 
> but (as the name " dpkg_L_faster" suggests), using the dpkg commands to
> obtain meta-information is quite slow; so I will have to think about it

Ok, the dpkg_L function can be improved substantially by querying
multiple packages at once, batched up to the ARG_MAX command-line
limit. This should improve the query substantially up to or even
faster times than the current code.

If you need the entire files database, you could instead do something
like:

  ,---
  dpkg-query \
    --showformat='Package: ${Package}\nFiles:\n${db-fsys:Files}\n' \
    --show
  `---

> BTW: you write
> 
> >  And finally, the contents and its format, will be changing in
> > the near future.

> May you please point me to some more info regarding this change?

This would be <https://wiki.debian.org/Teams/Dpkg/Spec/MetadataTracking>.

Thanks,
Guillem



Send a report that this bug log contains spam.


Debian bug tracking system administrator <[email protected]>. Last modified: Tue May 13 13:55:42 2025; Machine Name: bembo

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU General Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.