Control: severity -1 important
thanks
On Fri, Feb 28, 2025 at 10:49:47AM +0000, Simon McVittie wrote:
> $ podman run --rm -it debian:sid-slim
> # apt update
> # export ENV=/dev/null
> # apt install apt-cacher-ng
> ...
> Insecure $ENV{ENV} while running with -T switch at
> /usr/share/perl5/Debian/AdduserLogging.pm line 157.
> id: 'apt-cacher-ng': no such user
> dpkg: error processing package apt-cacher-ng (--configure):
> installed apt-cacher-ng package post-installation script subprocess returned
> error exit status 1
>
> In real life ENV would normally be set to the path to a dotfile, but
> /dev/null is enough to demonstrate the problem. dbus-system-bus-common and
> apt-cacher-ng are two arbitrary examples of packages that invoke adduser.
>
> adduser 3.137 does not appear to be affected by this, it's a regression
> somewhere between trixie and sid.
>
> Unsetting $ENV{ENV} before calling system() might be a solution, or at
> least a workaround.
I think it would be THE solution.
Submitter, can you give that a try please?
I'm going to wait with uploading the fix until 3.142 has migrated to
trixie; I'd like to give the code more test coverage and more
possibility to break.
Greetings
Marc
