search

yatima1460 / Drill

Search files without indexing, but fast crawling
https://drill.software/
GNU General Public License v2.0
269 stars 21 forks source link

Invalid Debian package name #73

Open laurent-simon opened 3 years ago

laurent-simon commented 3 years ago

When Drill Debian package is installed, the reported source package name is https://github.com/yatima1460/Drill. A URL is not a valid package name. This is a problem for tools that need a real package name to work properly.

For example, debsecan (a classic tool used to scan for vulnerabilities on Debian installations) cannot work anymore due to this anomaly:

$ debsecan --suite $(lsb_release --codename --short) --source https://raw.githubusercontent.com/BBVA/ust2dsa/data/  --format detail
Traceback (most recent call last):
  File "/usr/bin/debsecan", line 1370, in <module>
    rate_system(target, options, fetch_data(options, config), history)
  File "/usr/bin/debsecan", line 1305, in rate_system
    raise SyntaxError(('package %s references '
SyntaxError: package drill-search-gtk references invalid source package 'https://github.com/yatima1460/Drill'

So, when Drill is installed, the result is that the overall system cannot be analyzed for security vulnerabilities...

Remark: I agree that debsecan should not fail like that. It should report the anomaly, discard Drill from the analysis and continue his work. But all tools that expects for a valid package name are potentially affected by this small mistake.

For information, the Debian package naming rules are (from Debian policy):

Package names (both source and binary, see Package) must consist only of lower case letters (a-z), digits (0-9), plus (+) and minus (-) signs, and periods (.). They must be at least two characters long and must start with an alphanumeric character.

Environment:

yatima1460 commented 3 years ago

Hello, sorry if I abandoned this repo, I hope to revamp it soon

Thanks for posting issues :D