Bug#896071: debootstrap fails to retrive Release file over https
Hideki,
On 4/24/18 3:29 PM, Raphael Hertzog wrote:
> On Mon, 23 Apr 2018, Hideki Yamane wrote:
>> On Sun, 22 Apr 2018 09:40:54 +1000
>> David Margerison <deltam@electrosonics.com.au> wrote:
>>>> "$@" is extracted as '' and wget tries to fetch it and fails,
>>>> then returns 1.
>>>
>>> Regarding the proposed fix, in general using $@ without quotes is fragile.
>>
>> Most of the case, quotes is better. But in this case, "$@" is extracted like
>>>> wget '' '' '' https://deb.debian.org/debian/dist/unstable/InRelease
>> Then, it outputs
>>>> http://: Invalid host name.
>>>> http://: Invalid host name.
>>>> http://: Invalid host name.
>> and returns 1.
>
> I agree with David that using $@ without quotes is not a good idea.
> What you want is to not pass empty arguments to wgetprogress. So you should
> likely drop the quotes around the first 3 parameters on this line:
> if wgetprogress "$CHECKCERTIF" "$CERTIFICATE" "$PRIVATEKEY" -O "$dest" "$from"; then
>
> I'm suggesting only the first 3 since those are the variables that can be
> empty. And we want to keep the quote on "$dest" to be able to use path
> containing spaces (which you likely lost with your fix).
>
> But even here it's not perfect since we loose the possibility to handle
> arguments containing spaces in the first 3 parameters. A complete fix would
> involve setting up the argument list manually:
>
> set -- -O "$dest" "$from"
> if [ -n "$PRIVATEKEY" ]; then
> set -- "$PRIVATEKEY" "$@"
> fi
> if [ -n "$CERTIFICATE" ]; then
> set -- "$CERTIFICATE" "$@"
> fi
> if [ -n "$CHECKCERTIF" ]; then
> set -- "$CHECKCERTIF" "$@"
> fi
> if wgetprogress "$@"; then
> [...]
>
> Here we should be safe even if those 3 variables do contain spaces.
any new about incorporating Raphael's suggestion? There's still a grave
bug opened against debootstrap right now (on a version that is in testing).
Kind regards and thanks
Philipp Kern
Reply to: