debhelper.pod

@@ -663,6 +663,9 @@ and B<dh_installman> now accept the parameter B<--sourcedir> with same
 meaning as B<dh_install>. Furthermore, they now also fall back to
 F<debian/tmp> like B<dh_install>.
 
+Migration note: A bug in debhelper 11 up to 11.1.5 made
+B<dh_installinfo> incorrectly ignore B<--sourcedir>.
+
 =item -
 
 The B<perl-makemaker> and B<perl-build> build systems no longer pass

debian/changelog

@@ -13,6 +13,29 @@ debhelper (11.1.6) UNRELEASED; urgency=medium
   * autopkgtests: Remove "use-name" tests as it no longer works.
     The debhelper module makes assumptions in which directory it is
     run from and the test breaks these assumptions.
+  * debian/control: Comment out versioned dependency on make.
+    It is not strictly necessary for Debian and causes issues with
+    make-guile.  On the other hand, it is useful for people
+    backporting debhelper on derivatives and hench leaving it as a
+    comment.  (Closes: #892586)
+  * debian/control: Bump dependency on dh-autoreconf for the fix for
+    #889567.
+  * dh_installinfo: Accept --sourcedir like the documentation says
+    for compat 11.  Prevently the option was incorrectly silently
+    ignored.  Thanks to Nicolas Boulenguez for the report and the
+    patch.  (Closes: #894226)
+  * dh_ucf.1: Apply patch from Nicolas Boulenguez to add missing
+    documentation of the "--all" and non-option parameters.
+    (Closes: #894228)
+  * dh_installxfonts: Apply patch from Nicolas Boulenguez.  This
+    ensures that the generated maintscript snippets are bit-for-bit
+    reproducible when a package ships xfons in multiple fonts
+    directories.  (Closes: #894227)
+  * Dh_Lib: Improve the "make_symlink" code to avoid non-compliant
+    symlinks when the link name was not a normalized path.  Note
+    that ".."-segments are now disallowed in the link name (but not
+    the link target).  Thanks to Nicolas Boulenguez for reporting
+    the bug plus the test cases.  (Closes: #894229)
 
  -- Niels Thykier <niels@thykier.net>  Mon, 26 Feb 2018 19:32:52 +0000
 

debian/control

@@ -16,10 +16,11 @@ Vcs-Browser: https://salsa.debian.org/debian/debhelper
 Package: debhelper
 Architecture: all
 Depends: autotools-dev,
-# Version 12 is where dh-autoreconf supports --sourcedirectory.  Can be
-# relaxed if no packages rely on it.
-# Version 16 fixes #887482
-         dh-autoreconf (>= 16~),
+# Version 12 is where dh-autoreconf supports --sourcedirectory.
+# Version 16 fixes #887482, version 17 fixes #889567
+# Constraint can be relaxed if packages do not rely/require any of the
+# above fixes
+         dh-autoreconf (>= 17~),
 # Version constraint is to get a version of dh-strip-nondeterminism
 # without several bugs.  The constraint can be relaxed if an older
 # version is sufficient.
@@ -31,7 +32,8 @@ Depends: autotools-dev,
          libdpkg-perl (>= 1.17.14),
 # makefile.pm uses -O which according to #768791 requires make (>= 4~).
 # The -O is an aid to maintainers, debhelper works perfectly fine without it.
-         make (>= 4~),
+# (commented to avoid issues with make-guile, #892586)
+#         make (>= 4~),
          man-db,
          po-debconf,
          ${misc:Depends},

dh_installinfo

@@ -63,7 +63,9 @@ all packages if B<-A> is specified).
 
 =cut
 
-init();
+init(options => {
+	"sourcedir=s" => \$dh{SOURCEDIR},
+});
 
 # PROMISE: DH NOOP WITHOUT info
 

dh_installxfonts

@@ -68,7 +68,8 @@ foreach my $package (@{$dh{DOPACKAGES}}) {
 		my @cmds;
 		my @cmds_postinst;
 		my @cmds_postrm;
-		foreach my $f (@fontdirs) {
+		# Sort items for reproducible binary package contents.
+		foreach my $f (sort @fontdirs) {
 			# This must come before update-fonts-dir.
 			push @cmds, "update-fonts-scale $f"
 				if -f "$tmp/etc/X11/fonts/$f/$package.scale";
@@ -76,7 +77,6 @@ foreach my $package (@{$dh{DOPACKAGES}}) {
 			if (-f "$tmp/etc/X11/fonts/$f/$package.alias") {
 				push @cmds_postinst, "update-fonts-alias --include /etc/X11/fonts/$f/$package.alias $f";
 				push @cmds_postrm, "update-fonts-alias --exclude /etc/X11/fonts/$f/$package.alias $f";
-				addsubstvar($package, "misc:Depends", "xfonts-utils (>= 1:7.5+2)");
 			}
 		}
 
@@ -85,9 +85,13 @@ foreach my $package (@{$dh{DOPACKAGES}}) {
 		autoscript($package, "postrm", "postrm-xfonts",
 			{ 'CMDS' => join(";", @cmds, @cmds_postrm) });
 
+		if (@cmds_postrm) {
+			addsubstvar($package, "misc:Depends", "xfont-utils", ">= 1:7.5+2");
+		} else {
 			addsubstvar($package, "misc:Depends", "xfonts-utils");
 		}
 	}
+}
 
 =head1 SEE ALSO
 

dh_ucf

@@ -14,7 +14,7 @@ our $VERSION = DH_BUILTIN_VERSION;
 
 =head1 SYNOPSIS
 
-B<dh_ucf> [S<I<debhelper options>>] [B<-n>]
+B<dh_ucf> [S<I<debhelper options>>] [B<-A>] [B<-n>] [S<I<file> ...>]
 
 =head1 DESCRIPTION
 
@@ -41,10 +41,20 @@ A dependency on ucf will be generated in B<${misc:Depends}>.
 
 =over 4
 
+=item B<-A>, B<--all>
+
+Install all files specified by command line parameters in ALL packages
+acted on.
+
 =item B<-n>, B<--no-scripts>
 
 Do not modify F<postinst>/F<postrm> scripts. Turns this command into a no-op.
 
+=item I<file> ...
+
+Install these info files into the first package acted on. (Or in
+all packages if B<-A> is specified).
+
 =back
 
 =head1 NOTES

lib/Debian/Debhelper/Dh_Lib.pm

@@ -1822,8 +1822,16 @@ sub make_symlink{
 	my $src = _expand_path(shift);
 	my $tmp = shift;
 	$tmp = '' if not defined($tmp);
-	$src=~s:^/::;
-	$dest=~s:^/::;
+
+	if ($dest =~ m{(?:^|/)*[.]{2}(?:/|$)}) {
+		error("Invalid destination/link name (contains \"..\"-segments): $dest");
+	}
+
+	$src =~ s{^(?:[.]/+)++}{};
+	$dest =~ s{^(?:[.]/+)++}{};
+
+	$src=~s:^/++::;
+	$dest=~s:^/++::;
 
 	if ($src eq $dest) {
 		warning("skipping link from $src to self");
@@ -1835,8 +1843,8 @@ sub make_symlink{
 	# Policy says that if the link is all within one toplevel
 	# directory, it should be relative. If it's between
 	# top level directories, leave it absolute.
-	my @src_dirs=split(m:/+:,$src);
-	my @dest_dirs=split(m:/+:,$dest);
+	my @src_dirs = grep { $_ ne '.' } split(m:/+:,$src);
+	my @dest_dirs = grep { $_ ne '.' } split(m:/+:,$dest);
 	if (@src_dirs > 0 && $src_dirs[0] eq $dest_dirs[0]) {
 		# Figure out how much of a path $src and $dest
 		# share in common.

t/dh_link/03-894229.t

+#!/usr/bin/perl
+
+use strict;
+use warnings;
+
+use Test::More;
+plan(tests => 1);
+
+use File::Path qw(remove_tree);
+use File::Basename qw(dirname);
+use lib dirname(dirname(__FILE__));
+use Debian::Debhelper::Dh_Lib qw(!dirname);
+use Test::DH;
+
+
+sub test_tricky {
+    my ($link_name, $denoted_dest, $expected_link_target) = @_;
+    my $tmpdir = 'debian/debhelper';
+    my $link_path = "${tmpdir}/${link_name}";
+
+    make_symlink($link_name, $denoted_dest, $tmpdir);
+    if (ok(-l $link_path, 'Link made in correct directory')) {
+        my $target = readlink($link_path);
+        is($target, $expected_link_target, 'Link points correctly')
+            or diag("Expected ${expected_link_target}, actual ${target}");
+        rm_files($link_path);
+    }
+    return;
+}
+
+sub test_invalid {
+    my ($link_name, $denoted_dest) = @_;
+    eval {
+        make_symlink($link_name, $denoted_dest);
+    };
+    like($@, qr{^(?:\S*:\s*)?Invalid destination/link name});
+}
+
+each_compat_subtest {
+
+    remove_tree('debian/debhelper/a/b/c');
+
+    install_dir('debian/debhelper/a/b/c');
+
+    test_invalid('../../wow', 'a');
+    # This is a can be made valid but at the moment we do not support
+    # it.
+    test_invalid('a/b/../link21', 'a');
+
+
+    test_tricky('//a/b/link03', 'a/b/c', 'c');
+    test_tricky('./a/link18', 'a', '.');
+    test_tricky('a/./b/link19', 'a/b', '.');
+};
+