Control: severity -1 important

Hi!

On Fri, 6 Jan 2023 12:31:47 +0100 =?utf-8?B?0L3QsNCx?= 
<nabijaczlew...@nabijaczleweli.xyz> wrote:
> Hi!
> 
> On Fri, Jan 06, 2023 at 10:52:31AM +0100, Andrej Shadura wrote:
> > On Thu, 5 Jan 2023, at 21:32, наб wrote:
> > > Bisecting over the upstream git, I got
> > >   commit 8f9cca055bc661c4c690a5f5e1ca71370d129bc3 (HEAD, refs/bisect/bad)
> > >   Author: Herbert Xu <herb...@gondor.apana.org.au>
> > >   Date:   Wed Jan 19 16:37:54 2022 +1100
> > >  
> > >       expand: Always quote caret when using fnmatch
> > 
> > > as the first bad commit with default configuration (HAVE_FNMATCH=1).
> > >
> > > I /cannot/ find a set-up where configuring like Debian
> > > (--disable-fnmatch --disable-lineno --disable-glob)
> > > isn't broken.
> > 
> > I’m not sure why this also affects configurations with --disable-fnmatch — 
> > from the description of it, it shouldn’t?
> 
> Well, dash's built-in globs Just Don't Support ^. Never have.
> (Defined as "current code doesn't and it blames to start-of-git".)
> They're strictly POSIX, and ^ is a regular character for them.
> 
> 8f9cca0 fixes the fact that glibc fnmatch() has a special meaning for ^
> by unconditionally escaping it (if configured for libc fnmatch) ‒
> it normalises [^0-9] to always mean [0-9^],
> regardless of --with-fnmatch/--disable-fnmatch.
> 
> > > Y'know what, I bisected the Salsa git, too, but then I consulted POSIX.
> > > Apparently, this is fine.
> > 
> > > Please for the love of god add this to the NEWS.
> > > I /guarantee/ people are using '[^0-9]' to mean "not 0-9",
> > > and similar constructs, even if they are well-versed in the shell 
> > > language.
> > >
> > > This is a breaking change going from bullseye, and quite an insidious one.
> > > I assume my reaction is gonna mirror others' quite well.
> > >
> > > /Please/ add this to the NEWS.
> > 
> > I’m actually considering reverting that patch, as it seems a bit too late 
> > in the release cycle to introduce such a breaking change.
> 
> I've bisected across snapshot.d.o, and the first Debian version
> that exhibits this behaviour is 0.5.11+git20210903+057cd650a4ed-4:
>   
> http://snapshot.debian.org/package/dash/0.5.11%2Bgit20210903%2B057cd650a4ed-4/
> 
> Which, if I understand it right, has landed in sid on 2022-03-04.
> Since march of last year, sid and testing have been using this;
> quoth tracker.d.o:
>   [2022-03-07] dash 0.5.11+git20210903+057cd650a4ed-7 MIGRATED to testing 
> (Debian testing watch) 
> 
> So it's been a good part of a year and no-one's complained
> (maybe I'm the idiot what doesn't know globs are negated with !s),
> from the point of view of "system compatibility",
> I think this has passed the test.
> 
> From the point of user code, a NEWS entry I'd consider sufficient,
> as usual for breaking-for-compat user-observable changes.
> 
> Reverting this now would probably have the opposite effect

I am taking the liberty to increase the severity of this bug. I'd say it
is serious, but I'd let the maintainer or the release team to decide on
that.

I am aware of at least one user hit by this. If the current behaviour
would be part of bookworm, a NEWS entry would be great.

Thanks,

 -- Santiago

Attachment: signature.asc
Description: PGP signature

Reply via email to