Bug#985149: debootstrap stumbles over tabs in include parameter

[Christian Lamparter <chunkeey@gmail.com>]

Package: debootstrap
Version: 1.0.123
Severity: normal

Dear Maintainer,

I ran into an issue when I was using debootstrap in order to setup a chroot-
environment.

I: Retrieving InRelease
I: Checking Release signature
I: Valid Release signature (key id 6D33866EDD8FFA41C0143AEDDCC9EFBF77E11517)
I: Retrieving Packages
I: Validating Packages
I: Resolving dependencies of required packages...
I: Resolving dependencies of base packages...
I: Checking component main on http://deb.debian.org/debian...
E: Couldn't find these debs: 48477576

I was surprised to see that "48477576". I expected to get the
name of the package that was causing this, instead of a number.
I dug deeper to see what's causing this and I was surprised
when I found out that the parameter '--include=<tab>package'
that was passed to debootstrap was causing this.

Here's a reproducer (can be copied into bash). It fetches the
current debian stable for amd64 with "gzip" as an extra package.
(that $(printf \\t) is in this example, here so the "tab" won't
get lost when copying&pasting)

--- reproducer.sh one-liner ---

/usr/sbin/debootstrap --foreign "--include=$(printf \\t)gzip" --arch=amd64
stable "$(mktemp -d)" "http://deb.debian.org/debian";

--- reproducer.sh EOF ---

Since I now know what to look for, I edited /usr/share/debootstrap/functions
to remove tabs from the $leftoverdebs in the download_release() function.

--- remove-tabs-from-include.patch ---
--- /usr/share/debootstrap/functions.orig       2021-03-13 17:43:18.058708393
+0100
+++ /usr/share/debootstrap/functions    2021-03-13 17:43:39.792093090 +0100
@@ -804,7 +804,7 @@ download_release () {
        leftoverdebs="$*"

        # Fix possible duplicate package names, which would screw up counts:
-       leftoverdebs=$(printf "$leftoverdebs"|tr ' ' '\n'|sort -u|tr '\n' ' ')
+       leftoverdebs=$(printf "$leftoverdebs"|tr -d '\t'|tr ' ' '\n'|sort -u|tr
'\n' ' ')
        numdebs=$(printf "$leftoverdebs"|wc -w)

        for s in $SUITE $EXTRA_SUITES; do
--- remove-tabs-from-include.patch EOF ---

This "fixed" the issue for me. But I know that this is quick and dirty.

Cheers,
Christian


-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386, powerpc, mips, arm64

Kernel: Linux 5.12.0-rc2-wt+ (SMP w/8 CPU threads)
Kernel taint flags: TAINT_OOT_MODULE
Locale: LANG=en_DE.UTF-8, LC_CTYPE=C.UTF-8 (charmap=locale: Cannot set
LC_MESSAGES to default locale: No such file or directory
locale: Cannot set LC_ALL to default locale: No such file or directory
UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /bin/bash
Init: systemd (via /run/systemd/system)

Versions of packages debootstrap depends on:
ii  wget  1.21-1+b1

Versions of packages debootstrap recommends:
ii  arch-test               0.17-1
ii  debian-archive-keyring  2021.1.1
ii  gnupg                   2.2.27-1

Versions of packages debootstrap suggests:
pn  squid-deb-proxy-client  <none>
pn  ubuntu-archive-keyring  <none>

-- debconf information excluded

-- debsums errors found:
perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
        LANGUAGE = "en_US:en",
        LC_ALL = (unset),
        LC_CTYPE = "C.UTF-8",
        LANG = "en_DE.UTF-8"
    are supported and installed on your system.
perl: warning: Falling back to the standard locale ("C").