Subject: debdelta: Script accesses internal dpkg database

From: Guillem Jover <[email-masked]>
Date: Wed, 14 Nov 2018 04:13:55 +0100

Source: debdelta
Source-Version: 0.62
Severity: important
User: [email-masked]
Usertags: dpkg-db-access-blocker

Hi!

This package contains a script («debdelta»), which directly accesses
the dpkg internal database, instead of using one of the public interfaces
provided by dpkg. The code in do_patch_, should be switched to use:

  «dpkg-query --showformat='${Conffiles}\n' --show»

to fetch the list of conffiles. Then _symlink_data_tree should be switched
to always use dpkg_L, and dpkg_L_faster should be removed. Finally the
code handling 'old-control-tree' should be switched to use something like:

  «dpkg-query --control-list»

This is a problem for several reasons, because even though the layout and
format of the dpkg database is administrator friendly, and it is expected
that those might need to mess with it, in case of emergency, this
“interface” does not extend to other programs besides the dpkg suite of
tools. The admindir can also be configured differently at dpkg build or
run-time. And finally, the contents and its format, will be changing in
the near future.

Thanks,
Guillem

---

From: A Mennucc1 <[email-masked]>
Date: Sat, 2 Feb 2019 10:59:05 +0100

Dear Guillem,

I see your point;

but (as the name " dpkg_L_faster" suggests), using the dpkg commands to
obtain meta-information is quite slow; so I will have to think about it

BTW: you write

>  And finally, the contents and its format, will be changing in
> the near future.
May you please point me to some more info regarding this change?

Thanks,

a.

---

From: Guillem Jover <[email-masked]>
Date: Thu, 17 Jun 2021 04:07:48 +0200

Hi!

[ Sorry, it seems I missed replying to this. ]

> obtain meta-information is quite slow; so I will have to think about it

Ok, the dpkg_L function can be improved substantially by querying
multiple packages at once, batched up to the ARG_MAX command-line
limit. This should improve the query substantially up to or even
faster times than the current code.

If you need the entire files database, you could instead do something
like:

  ,---
  dpkg-query \
    --showformat='Package: ${Package}\nFiles:\n${db-fsys:Files}\n' \
    --show
  `---

> May you please point me to some more info regarding this change?

This would be <https://wiki.debian.org/Teams/Dpkg/Spec/MetadataTracking>.

Thanks,
Guillem