Your message dated Mon, 06 Jul 2026 12:04:38 +0000
with message-id <[email protected]>
and subject line Bug#1140552: fixed in devscripts 2.26.10
has caused the Debian Bug report #1140552,
regarding debrebuild: mmdebstrap builder silently skips dpkg-buildpackage on
quoted Environment values
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1140552: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140552
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: devscripts
X-Debbugs-Cc: [email protected], [email protected]
Version: 2.26.9
Severity: normal
Tags: patch
Dear Maintainer,
When constructing the mmdebstrap customize hook, debrebuild does not escape
the variables from the .buildinfo file's Environment block. This can result
in
build failures if DEB_BUILD_OPTIONS contains multiple options. It could
also be
used to create a malicious buildinfo file with extra commands added, which
would run in the build environment. The Trixie version of the package is
also affected, but I haven't checked any others.
Single DEB_BUILD_OPTIONS parameter (working):
$ mkdir -p /tmp/debrebuild
$ cd /tmp/debrebuild/
$ wget
https://buildinfos.debian.net/buildinfo-pool/h/hello/hello_2.12.3-1_amd64.buildinfo
$ debrebuild hello_2.12.3-1_amd64.buildinfo --buildresult=./out
--builder=mmdebstrap
./out/ ends up with the correct build files.
Multiple parameters (no build in out/):
Edit hello_2.12.3-1_amd64.buildinfo:
@@ -176,7 +176,7 @@
xz-utils (= 5.8.3-1),
zlib1g (= 1:1.3.dfsg+really1.3.2-3)
Environment:
- DEB_BUILD_OPTIONS="parallel=6"
+ DEB_BUILD_OPTIONS="parallel=6 terse"
LANG="C.UTF-8"
LC_COLLATE="C.UTF-8"
LC_CTYPE="C.UTF-8
$ rm -rf out
$ debrebuild hello_2.12.3-1_amd64.buildinfo --buildresult=./out
--builder=mmdebstrap
./out/ contains a partial build
I've attached a patch that resolves the issue for me.
Kind regards,
Serge
-- Package-specific info:
--- /etc/devscripts.conf ---
Empty.
--- ~/.devscripts ---
Not present
-- System Information:
Debian Release: forky/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.90+deb13.1-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8),
LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages devscripts depends on:
ii dpkg-dev 1.23.7
ii file 1:5.47-4
ii gpg 2.4.9-4
ii gpg-agent 2.4.9-4
ii gpgv 2.4.9-4
ii libconfig-inifiles-perl 3.000003-5
ii libdpkg-perl 1.23.7
ii libfile-dirlist-perl 0.05-3
ii libfile-homedir-perl 1.006-2
ii libfile-touch-perl 0.12-2
ii libio-string-perl 1.08-4
ii libmoo-perl 2.005005-1
ii libwww-perl 6.83-1
ii libyaml-libyaml-perl 0.907.0+ds-1
ii patchutils 0.4.5-1
ii perl 5.40.1-8
ii python3 3.13.9-3+b1
ii sensible-utils 0.0.26
ii wdiff 1.2.2-9
Versions of packages devscripts recommends:
ii apt 3.3.1
ii curl 8.20.0-5
ii dctrl-tools 2.24-3+b1
ii debian-keyring 2026.05.24
ii debian-tag2upload-keyring 1.2
ii diffstat 1.69-1
ii dput 1.2.4
ii equivs 2.3.3
ii git-debpush 15.10
ii libdistro-info-perl 1.15
ii libencode-locale-perl 1.05-3
ii libgitlab-api-v4-perl 0.27-1
ii libjson-perl 4.10000-1
ii liblwp-protocol-https-perl 6.15-1
ii libmetacpan-client-perl 2.043000-1
ii libsoap-lite-perl 1.27-3
ii libstring-shellquote-perl 1.04-3
ii liburi-perl 5.35-1
ii licensecheck 3.3.9-1
ii lintian 2.136.2
ii lzip 1.26-1
ii man-db 2.13.1-1
ii patch 2.8-2
ii pristine-tar 1.50+nmu2
ii python3-apt 3.1.0
ii python3-debian 1.1.1
ii python3-magic 2:0.4.27-5
ii python3-requests 2.32.5+dfsg-1
ii python3-unidiff 0.7.5-2
ii python3-xdg 0.28-3
ii sbuild 0.91.9
ii strace 7.0+ds-1
ii unzip 6.0-29
ii wget 1.25.0-2
ii xz-utils 5.8.3-1
Versions of packages devscripts suggests:
pn adequate <none>
pn at <none>
pn autopkgtest <none>
pn bls-standalone <none>
pn bsd-mailx | mailx <none>
ii build-essential 12.12
pn check-all-the-things <none>
ii debhelper 14.1
pn default-mta | mail-transport-agent <none>
pn diffoscope <none>
pn disorderfs <none>
pn docker.io <none>
pn dose-extra <none>
pn duck <none>
pn elpa-devscripts <none>
pn faketime <none>
pn gnuplot <none>
pn how-can-i-help <none>
ii libauthen-sasl-perl 2.2000-1
pn libdbd-pg-perl <none>
pn libterm-size-perl <none>
ii libtimedate-perl 2.3500-1
ii mmdebstrap 1.5.7-3
pn mutt <none>
ii openssh-client [ssh-client] 1:10.3p1-4
pn piuparts <none>
pn postgresql-client <none>
pn pristine-lfs <none>
ii python3-debianbts 4.1.1
pn python3-pycurl <none>
pn quilt <none>
pn ratt <none>
pn reprotest <none>
pn svn-buildpackage <none>
pn w3m <none>
-- no debconf information
From fca32754b6b2f7cb7751847a86921ae4c1f0a1c8 Mon Sep 17 00:00:00 2001
From: Serge Schneider <[email protected]>
Date: Tue, 16 Jun 2026 14:12:41 +0100
Subject: [PATCH] debrebuild: shell-quote the mmdebstrap customize-hook script
The buildinfo's Environment values are interpolated verbatim into the
inner shell script, and their literal double quotes collide with the
outer sh -c "...". Wrap the whole inner script in shell_quote so the
nested quotes can't terminate the outer one early.
Without this, dpkg-buildpackage silently never runs for any buildinfo
that has a quoted Environment value (e.g. DEB_BUILD_OPTIONS with a
space).
---
scripts/debrebuild.pl | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/scripts/debrebuild.pl b/scripts/debrebuild.pl
index 4b2a4b54..8962629e 100755
--- a/scripts/debrebuild.pl
+++ b/scripts/debrebuild.pl
@@ -715,8 +715,8 @@ if ($builder eq "none") {
. (String::ShellQuote::shell_quote $dsc_fname)
. " \"\$1\""
),
- '--customize-hook=chroot "$1" sh -c "'
- . (
+ '--customize-hook=chroot "$1" sh -c '
+ . String::ShellQuote::shell_quote(
join ' && ',
"mkdir -p "
. (String::ShellQuote::shell_quote(dirname $custom_build_path)),
@@ -727,8 +727,7 @@ if ($builder eq "none") {
@binnmucmds,
"env $environment dpkg-buildpackage -uc -a $host_arch --build=$build",
'cd /',
- 'rm -r ' . (String::ShellQuote::shell_quote $custom_build_path))
- . '"',
+ 'rm -r ' . (String::ShellQuote::shell_quote $custom_build_path)),
'--customize-hook=sync-out '
. (dirname $custom_build_path)
. " $outdir",
--
2.43.0
--- End Message ---
--- Begin Message ---
Source: devscripts
Source-Version: 2.26.10
Done: Jochen Sprickerhof <[email protected]>
We believe that the bug you reported is fixed in the latest version of
devscripts, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Jochen Sprickerhof <[email protected]> (supplier of updated devscripts
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 06 Jul 2026 12:19:08 +0200
Source: devscripts
Architecture: source
Version: 2.26.10
Distribution: unstable
Urgency: medium
Maintainer: Devscripts Maintainers <[email protected]>
Changed-By: Jochen Sprickerhof <[email protected]>
Closes: 681779 1123934 1126347 1140552 1140560 1140744
Changes:
devscripts (2.26.10) unstable; urgency=medium
.
* Team upload.
.
[ Jochen Sprickerhof ]
* Revert "Remove mmdebstrap from recommends again"
* Fix groff-messages reported by lintian
.
[ Daniel Gröber ]
* bts: Fix 'severity' and 'forwarded' failing with omitted bug number
* bts reply: Remove "Re:" prefix from Subject
* bts show|status: Establish implicit 'context', not 'reply' (MUA)
* bts: Fix --no-mutt being ineffective
* bts: Bail if STDIN is unexpecteldy a TTY inside MUA
* bts: Fix aerc quoting in $mailreader default
* bts: Fix Handling of multiple done commands (Closes: #1126347)
* bts: Fall back to STDIN when /dev/tty fails to open (Closes: #1123934)
* bts reply|context: Show a "reading from STDIN" message
.
[ Yadd ]
* uscan: set Uversion-Mangle to "auto" by default in Github template
* [uscan] Ignore Ctype version when not > 0
.
[ Nikolas Nyby ]
* Fix typo in bts errors: implict -> implicit
.
[ Johannes Schauer Marin Rodrigues ]
* scripts/debrebuild.pl: refactor mmdebstrap builder to avoid confusing
double shell quoting (Closes: #1140552)
.
[ Serge Schneider ]
* debrebuild: default Build-Path in dpkg/mmdebstrap when buildinfo omits it
(Closes: #1140560)
* debsnap: avoid infinite loop when .dsc lacks a Files: stanza
(Closes: #1140744)
.
[ Anders Kaseorg ]
* dpkg-genbuilddeps: exit 0 for --help, --version
* debchange: Use ###VERSION###
* hardening-check: exit 0 for --help
* who-permits-upload: Write to stdout, exit 0 for --help
* cowpoke: Write to stdout for --help
.
[ наб ]
* Reset "Successfully signed" message after writing it
.
[ Jacob Mealy ]
* getbuildlog: report error if no results available (Closes: #681779)
Checksums-Sha1:
e9159156c9ec38f0def5dcd6dcd00018aba93c3d 3626 devscripts_2.26.10.dsc
10a6afa8cbe404c1396d015d44d36e25d5c7dd39 1119312 devscripts_2.26.10.tar.xz
Checksums-Sha256:
b90e88de9cd202508eb4f3edf64139baf1d2004c24e42dd8dff2e42be387f610 3626
devscripts_2.26.10.dsc
c5778b09ada6f8a084f97828721ced03d2fc03a07244911c9e072ccdb9b9400e 1119312
devscripts_2.26.10.tar.xz
Files:
fc8a0cc70bb25758a679cc57c0823782 3626 devel optional devscripts_2.26.10.dsc
4768a5b288b5a5b8a2d2df5bb0d529d3 1119312 devel optional
devscripts_2.26.10.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEc7KZy9TurdzAF+h6W//cwljmlDMFAmpLl0oACgkQW//cwljm
lDOznQ/7BDDkQ8mIJaXDmjOFaKZn0PMtAzAkeef7tw7OM2VtcnbO7zufrsMmTRs6
UxSQDna0grULyAfZuFZCSOD7qAicR0lPvSplimv2ZI3JHb/A6eMMvALokknj7DiF
3+EfKqeyVcvbj0lSJuPcpxScWHzXDiVW2vqjh6Vct1q5H4SPjR758zgRQlzVlJev
AzJwUkVd1pSSZko4WE7xHoFQv0QnNTp0KZVJftUYp7FBjSoOO7lx3eu9wgHvIzus
yOAgaquUy+etlBgYkbW+r9ohmXJKqZuiCFc+F7pncHm8ATx4Ox9vboJYLHjLa0LA
8sdK3SuaYnL6ZhUCdoOIClEYGlmShzS8C1lgqtgFgNJkG9sw2JXro6B8GCZo41sh
X9B0w9Z3ZxbONlLLgtHiCP0KzejWVaM3u1/oC1nGpcHtKH5r04lqe8gd4UBK71zE
Z/VidgnE2fRIsge9QvmB0quXOVrndVNpwDku89RL3nzbxb65U0EYIUZyUhJUDNfL
SEC6qCrKi3loTN4VTFpTBqS6/SO6et1guBmIS11EGuUvG/GYav42JMyeSBGPs3dm
3RoT+pFSzCO/RIbkjJt0IAJTXRN8s4BVHcSR1c0CnOYzjzVWMeYd+92E8LAmiA8z
BNlgGGjoLXhv6+aY3AggSsp03yXYOH3LVkfZNAExWNQyr9LAxCs=
=IS9w
-----END PGP SIGNATURE-----
pgpZAbGSwjuJj.pgp
Description: PGP signature
--- End Message ---
