Bug#972629: lintian: Detect sed -e 's@$(CURDIR)@...@' in debian/rules

["Chris Lamb" <lamby@debian.org>]

Package: lintian
Version: 2.98.0
Severity: wishlist

Hi,

The debian/rules snippet:

  sed -ie 's@$(CURDIR)@...@' target

… initially appears to be harmless. However, $(CURDIR) can contain
regular expression metacharacters (specifically, the '+' character)
which can affect exactly what it can match.

In some cases, this has led to silently broken builds (#585678). We
should be able to detect most instances of this (there are many on
codesearch.debian.net), possibly suggesting the following replacement:

  perl -pi -e 's@\Q$(CURDIR)\E@...@' target

Variants such as $(shell pwd) should probably be checked for too.


Regards,

--
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-