releasing version 8.86

The runpipe interface is not a good one, it would be better to use
something that does not expose to the shell.

As a quick fix, quote filenames in runpipe calls. Too bad if you have a
quote character in a file though. Later need to find a better interface
or do full shell escaping.

Alien/Package/Deb.pm

@@ -110,7 +110,7 @@ sub test {
 		return map { s/\n//; $_ }
 		       grep {
 		       		! /unknown-section alien/
-		       } $this->runpipe(1, "lintian $deb");
+		       } $this->runpipe(1, "lintian '$deb'");
 	}
 	else {
 		return "lintian not available, so not testing";
@@ -130,7 +130,7 @@ sub getcontrolfile {
 	my $file=$this->filename;
 	
 	if ($this->have_dpkg_deb) {
-		return $this->runpipe(1, "dpkg-deb --info $file $controlfile 2>/dev/null");
+		return $this->runpipe(1, "dpkg-deb --info '$file' $controlfile 2>/dev/null");
 	}
 	else {
 		# Solaris tar doesn't support O
@@ -139,10 +139,10 @@ sub getcontrolfile {
 
 			return "(mkdir /tmp/tar_out.$$ &&".
 				" cd /tmp/tar_out.$$ &&".
-				" tar xf - ./$file &&".
-				" cat $file; cd /; rm -rf /tmp/tar_out.$$)";
+				" tar xf - './$file' &&".
+				" cat '$file'; cd /; rm -rf /tmp/tar_out.$$)";
 		}
-		my $getcontrol = "ar -p $file control.tar.gz | gzip -dc | ".tar_out($controlfile)." 2>/dev/null";
+		my $getcontrol = "ar -p '$file' control.tar.gz | gzip -dc | ".tar_out($controlfile)." 2>/dev/null";
 		return $this->runpipe(1, $getcontrol);
 	}
 }
@@ -212,11 +212,11 @@ sub scan {
 	my @filelist;
 	if ($this->have_dpkg_deb) {
 		@filelist=map { chomp; s:\./::; "/$_" }
-			  $this->runpipe(0, "dpkg-deb --fsys-tarfile $file | tar tf -");
+			  $this->runpipe(0, "dpkg-deb --fsys-tarfile '$file' | tar tf -");
 	}
 	else {
 		@filelist=map { chomp; s:\./::; "/$_" }
-			  $this->runpipe(0, "ar -p $file data.tar.gz | gzip -dc | tar tf -");
+			  $this->runpipe(0, "ar -p '$file' data.tar.gz | gzip -dc | tar tf -");
 	}
 	$this->filelist(\@filelist);
 
@@ -307,7 +307,7 @@ sub prep {
 			or die "patch error: $!";
 		# Look for .rej files.
 		die "patch failed with .rej files; giving up"
-			if $this->runpipe(1, "find $dir -name \"*.rej\"");
+			if $this->runpipe(1, "find '$dir' -name \"*.rej\"");
 		$this->do('find', '.', '-name', '*.orig', '-exec', 'rm', '{}', ';');
 		$this->do("chmod", 755, "$dir/debian/rules");
 
@@ -596,6 +596,8 @@ sub version {
 	# get
 	return unless defined wantarray; # optimization
 	$_=$this->{version};
+	# filter out some characters not allowed in debian versions
+	s/[^-.+~:A-Za-z0-9]//g; # see lib/dpkg/parsehelp.c parseversion
 	# Make sure the version contains digets.
 	unless (/[0-9]/) {
 		# Drat. Well, add some. dpkg-deb won't work

Alien/Package/Lsb.pm

@@ -30,7 +30,7 @@ sub checkfile {
 	my $this=shift;
 	my $file=shift;
 	return unless $file =~ m/^lsb-.*\.rpm$/;
-	my @deps=$this->runpipe(1, "LANG=C rpm -qp -R $file");
+	my @deps=$this->runpipe(1, "LANG=C rpm -qp -R '$file'");
 	return 1 if grep { s/\s+//g; $_ eq 'lsb' } @deps;
 	return;
 }

Alien/Package/Rpm.pm

@@ -83,7 +83,7 @@ sub scan {
 	foreach my $field (qw{NAME VERSION RELEASE ARCH CHANGELOGTEXT
 		              SUMMARY DESCRIPTION PREFIXES},
 	                   keys(%fieldtrans)) {
-		my $value=$this->runpipe(0, "LANG=C rpm -qp --queryformat \%{$field} $file");
+		my $value=$this->runpipe(0, "LANG=C rpm -qp --queryformat \%{$field} '$file'");
 		next if $? || $value eq '(none)';
 		my $key;
 		if (exists $fieldtrans{$field}) {
@@ -96,16 +96,16 @@ sub scan {
 	}
 
 	# Get the conffiles list.
-	$this->conffiles([map { chomp; $_ } $this->runpipe(0, "LANG=C rpm -qcp $file")]);
+	$this->conffiles([map { chomp; $_ } $this->runpipe(0, "LANG=C rpm -qcp '$file'")]);
 	if (defined $this->conffiles->[0] &&
 	    $this->conffiles->[0] eq '(contains no files)') {
 		$this->conffiles([]);
 	}
 
-	$this->binary_info(scalar $this->runpipe(0, "rpm -qpi $file"));
+	$this->binary_info(scalar $this->runpipe(0, "rpm -qpi '$file'"));
 
 	# Get the filelist.
-	$this->filelist([map { chomp; $_ } $this->runpipe(0, "LANG=C rpm -qpl $file")]);
+	$this->filelist([map { chomp; $_ } $this->runpipe(0, "LANG=C rpm -qpl '$file'")]);
 	if (defined $this->filelist->[0] &&
 	    $this->filelist->[0] eq '(contains no files)') {
 		$this->filelist([]);
@@ -128,7 +128,7 @@ sub scan {
 	}
 	unless (defined $this->copyright) {
 		# Older rpms have no licence tag, but have a copyright.
-		$this->copyright($this->runpipe(0, "LANG=C rpm -qp --queryformat \%{COPYRIGHT} $file"));
+		$this->copyright($this->runpipe(0, "LANG=C rpm -qp --queryformat \%{COPYRIGHT} '$file'"));
 
 		# Fallback.
 		if (! $this->copyright) {
@@ -424,7 +424,7 @@ sub build {
 		$opts="--buildarch ".$this->arch;
 	}
 	else {
-		# Presumably we're delaing with rpm 3.0 or above, which
+		# Presumably we're dealing with rpm 3.0 or above, which
 		# doesn't output rpmdir in any format I'd care to try to
 		# parse. Instead, rpm is now of a late enough version to
 		# notice the %define's in the spec file, that will make the
@@ -439,7 +439,7 @@ sub build {
 	$opts.=" $ENV{RPMBUILDOPT}" if exists $ENV{RPMBUILDOPT};
 	my $pwd=`pwd`;
 	chomp $pwd;
-	my $command="cd $dir; $buildcmd --buildroot=$pwd/$dir -bb $opts ".$this->name."-".$this->version."-".$this->release.".spec";
+	my $command="cd $dir; $buildcmd --buildroot='$pwd/$dir' -bb $opts '".$this->name."-".$this->version."-".$this->release.".spec'";
 	my $log=$this->runpipe(1, "$command 2>&1");
 	if ($?) {
 		die "Package build failed. Here's the log of the command ($command):\n", $log;

Alien/Package/Slp.pm

@@ -166,7 +166,7 @@ sub scan {
 	# Read in the file list.
 	my @filelist;
 	# FIXME: support gzip files too!
-	foreach ($this->runpipe(0, "bzip2 -d < $file | tar -tf -")) {
+	foreach ($this->runpipe(0, "bzip2 -d < '$file' | tar -tf -")) {
 		chomp;
 		s:^\./:/:;
 		$_="/$_" unless m:^/:;
@@ -179,7 +179,7 @@ sub scan {
 	$this->distribution('Stampede');
 	$this->origformat('slp');
 	$this->changelogtext('');
-	$this->binary_info($this->runpipe(0, "ls -l $file"));
+	$this->binary_info($this->runpipe(0, "ls -l '$file'"));
 	
 	return 1;
 }

Alien/Package/Tgz.pm

@@ -118,7 +118,7 @@ sub scan {
 	$this->group("unknown");
 	$this->origformat('tgz');
 	$this->changelogtext('');
-	$this->binary_info($this->runpipe(0, "ls -l $file"));
+	$this->binary_info($this->runpipe(0, "ls -l '$file'"));
 
 	# Now figure out the conffiles. Assume anything in etc/ is a
 	# conffile.
@@ -152,7 +152,7 @@ sub scan {
 
 	# Now get the scripts.
 	foreach my $script (keys %{scripttrans()}) {
-		$this->$script(scalar $this->runpipe(1, "tar Oxf $file install/${scripttrans()}{$script} 2>/dev/null"));
+		$this->$script(scalar $this->runpipe(1, "tar Oxf '$file' install/${scripttrans()}{$script} 2>/dev/null"));
 	}
 
 	return 1;

debian/changelog

@@ -1,3 +1,16 @@
+alien (8.86) unstable; urgency=low
+
+  * Filter out illegal characters in version number when building a deb.
+    Closes: #648531
+
+ -- Joey Hess <joeyh@debian.org>  Sat, 12 Nov 2011 13:12:35 -0400
+
+alien (8.85) unstable; urgency=low
+
+  * Avoid breaking on spaces in filenames. Closes: #618636
+
+ -- Joey Hess <joeyh@debian.org>  Sun, 19 Jun 2011 15:43:49 -0400
+
 alien (8.84) unstable; urgency=low
 
   * Silence error message when deleting build tree after making an rpm,

debian/control

@@ -3,7 +3,7 @@ Section: admin
 Priority: optional
 Build-Depends: debhelper (>= 7.0.50)
 Maintainer: Joey Hess <joeyh@debian.org>
-Standards-Version: 3.9.1
+Standards-Version: 3.9.2
 Vcs-Git: git://git.kitenet.net/alien
 Homepage: http://kitenet.net/~joey/code/alien/