[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Bug#878901: dh-make-perl: FTBFS with dpkg >= 1.19: "Insecure dependency in eval while running with -T switch"

On Tue, Oct 17, 2017 at 05:44:26PM +0200, gregor herrmann wrote:
> Package: dh-make-perl
> Version: 0.95
> Severity: serious
> Tags: buster sid
> Justification: fails to build from source

> As first seen on ci.debian.net, dh-make-perl's test suite fails with
> libdpkg-perl 1.19.0 and
> Insecure dependency in eval while running with -T switch at /usr/share/perl5/Dpkg/Vendor.pm line 164.

> The -T seems to come from t/debian-version.t itself; no idea yet why
> it is a problem now and why it's used here in the first place.

It looks like Dpkg::Vendor::get_vendor_info() contents have become
tainted, probably due to changes in Dpkg::Control::HashCore. It used to
dig the values out with regexp captures but now uses split.


A test case is

  perl -T -MDpkg::Vendor=get_vendor_info -MScalar::Util=tainted -e 'die if tainted get_vendor_info()->{Vendor}'

which dies on libdpkg-perl but not 1.18.24.

I don't know if the earlier untainting was accidental or intended.
Copying the dpkg maintainers.

Hope this helps a bit,

Reply to: