Bug#1115987: cozy: Ampersand in README causes xmlParseEntityRef error in apt update

Wed, 24 Sep 2025 01:45:17 -0700 

Control: tags 1115987 = moreinfo unreproducible

Hi Jesse,

thanks for your report.

Am 2025-09-22 20:50, schrieb Jesse Cooke:

Package: cozy
Severity: normal
X-Debbugs-Cc: [email protected]

Dear Maintainer,

When I ran `sudo apt update` this morning I saw the following error:

```
➜ sudo apt update
[sudo: authenticate] Password:
Hit:1 http://deb.debian.org/debian testing InRelease
Hit:2 http://security.debian.org/debian-security testing-security InRelease 
Hit:3 http://deb.debian.org/debian testing-updates InRelease
Entity: line 4: parser error : xmlParseEntityRef: no name
      ZhengMa, WuBi, ErBi, CangJie, &.  But some tables for other
                                     ^
Entity: line 8: parser error : Opening and ending tag mismatch: li line 8 and root 
  <li>Lots of emojis</root>
                           ^
Entity: line 5: parser error : xmlParseEntityRef: no name
<li>Listen to your DRM free mp3, m4b, m4a (aac, ALAC, &), flac, ogg and wav au 
                                                         ^
254 packages can be upgraded. Run 'apt list --upgradable' to see them.
```
On a new install of Debian 13 and an upgrade to 'testing' the issue doesn't appear. 


I used the following commands to track down the specific source

```
➜ sudo apt update -o Debug::pkgAcquire::Worker=1 2>&1 | grep -B10 -A2 "xmlParseEntityRef" <- http:102%20Status%0aMessage:%20Waiting%20for%20headers%0aURI:%20http://deb.debian.org/debian/dists/testing-updates/InRelease <- http:201%20URI%20Done%0aIMS-Hit:%20true%0aLast-Modified:%20Mon,%2022%20Sep%202025%2014:12:38%20+0000%0aFilename:%20/var/lib/apt/lists/partial/deb.debian.org_debian_dists_testing-updates_InRelease%0aURI:%20http://deb.debian.org/debian/dists/testing-updates/InRelease 
Hit:2 http://deb.debian.org/debian testing-updates InRelease
<- http:201%20URI%20Done%0aIMS-Hit:%20true%0aLast-Modified:%20Mon,%2022%20Sep%202025%2018:04:47%20+0000%0aFilename:%20/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_testing-security_InRelease%0aURI:%20http://security.debian.org/debian-security/dists/testing-security/InRelease Hit:3 http://security.debian.org/debian-security testing-security InRelease <- sqv:201%20URI%20Done%0aSigned-By:%2004B54C3CDCA79751B16BC6B5225629DF75B188BD%0a%20B8B80B5B623EAB6AD8775C45B7C5D7D6350947F8%0aFilename:%20/var/lib/apt/lists/deb.debian.org_debian_dists_testing_InRelease%0aURI:%20sqv:/var/lib/apt/lists/deb.debian.org_debian_dists_testing_InRelease -> sqv:600%20URI%20Acquire%0aURI:%20sqv:/var/lib/apt/lists/deb.debian.org_debian_dists_testing-updates_InRelease%0aFilename:%20/var/lib/apt/lists/deb.debian.org_debian_dists_testing-updates_InRelease%0aTarget-Type:%20index%0aTarget-Release:%20testing-updates%0aTarget-Repo-URI:%20http://deb.debian.org/debian/%0aTarget-Base-URI:%20http://deb.debian.org/debian/dists/testing-updates/%0aTarget-Site:%20http://deb.debian.org/debian%0aIndex-File:%20true%0aMaximum-Size:%2010000000%0aLast-Modified:%20Mon,%2022%20Sep%202025%2014:12:38%20GMT%0aFail-Ignore:%20true%0aSigned-By:%20/usr/share/keyrings/debian-archive-keyring.gpg%0a%0a <- sqv:201%20URI%20Done%0aSigned-By:%2004B54C3CDCA79751B16BC6B5225629DF75B188BD%0a%20B8B80B5B623EAB6AD8775C45B7C5D7D6350947F8%0aFilename:%20/var/lib/apt/lists/deb.debian.org_debian_dists_testing-updates_InRelease%0aURI:%20sqv:/var/lib/apt/lists/deb.debian.org_debian_dists_testing-updates_InRelease -> sqv:600%20URI%20Acquire%0aURI:%20sqv:/var/lib/apt/lists/security.debian.org_debian-security_dists_testing-security_InRelease%0aFilename:%20/var/lib/apt/lists/security.debian.org_debian-security_dists_testing-security_InRelease%0aTarget-Type:%20index%0aTarget-Release:%20testing-security%0aTarget-Repo-URI:%20http://security.debian.org/debian-security/%0aTarget-Base-URI:%20http://security.debian.org/debian-security/dists/testing-security/%0aTarget-Site:%20http://security.debian.org/debian-security%0aIndex-File:%20true%0aMaximum-Size:%2010000000%0aLast-Modified:%20Mon,%2022%20Sep%202025%2018:04:47%20GMT%0aFail-Ignore:%20true%0aSigned-By:%20/usr/share/keyrings/debian-archive-keyring.gpg%0a%0a <- sqv:201%20URI%20Done%0aSigned-By:%2005AB90340C0C5E797F44A8C8254CF3B5AEC0A8F0%0a%205E04A1E3223A19A20706E20F9904613D4CCE68C6%0aFilename:%20/var/lib/apt/lists/security.debian.org_debian-security_dists_testing-security_InRelease%0aURI:%20sqv:/var/lib/apt/lists/security.debian.org_debian-security_dists_testing-security_InRelease 
Entity: line 4: parser error : xmlParseEntityRef: no name
      ZhengMa, WuBi, ErBi, CangJie, &.  But some tables for other
                                     ^
Entity: line 8: parser error : Opening and ending tag mismatch: li line 8 and root 
  <li>Lots of emojis</root>
                           ^
Entity: line 5: parser error : xmlParseEntityRef: no name
<li>Listen to your DRM free mp3, m4b, m4a (aac, ALAC, &), flac, ogg and wav au 

```


The ampersand isn't in upstream, nor in Debian:
https://sources.debian.org/src/cozy/1.3.0-3/README.md#L26


```
➜ bash -c 'for f in /var/lib/apt/lists/*Components*.gz; do
      echo "=== $f ==="
zcat "$f" | grep -A5 -B5 "ZhengMa\\|DRM free" 2>/dev/null || echo "Not found" 
  done'
=== /var/lib/apt/lists/deb.debian.org_debian_dists_testing_main_dep11_Components-amd64.yml.gz === 

Nor on the origin of the file, try:
$ curl https://ftp.debian.org/debian/dists/testing/main/dep11/Components-amd64.yml.gz 2> /dev/null | zcat | grep -A5 -B5 "ZhengMa\\|DRM free" 


    <p>Cozy is a audio book player. Here are some of the features:</p>

    <ul>
<li>Import all your audio books into Cozy to browse them comfortably</li> <li>Listen to your DRM free mp3, m4b, m4a (aac, ALAC, &), flac, ogg and wav audio books</li> 
      <li>Remembers your playback position</li>
      <li>Sleep timer</li>
      <li>Playback speed control for each book individually</li>
      <li>Search your library</li>
      <li>Multiple storage location support</li>
--
  C: Table based input method
  pt-PT: Tabela baseada no modo de entrada
Description:
  ca: >-
<p>Ibus-table és un marc de treball de mètode d'entrada per als mètodes d'entrada basats en taules. Sobretot s'utilitza per als mètodes d'entrada xinesos com ara ZhengMa, WuBi, ErBi, CangJie, &. No obstant això, també hi ha disponible algunes taules per a altres idiomes.</p> 
  tr: >-
<p>Ibus-table, tablo tabanlı giriş yöntemleri için bir giriş yöntemi çerçevesidir. Çoğunlukla ZhengMa, WuBi, ErBi, CangJie, ... gibi Çince giriş yöntemleri için kullanılır. Ancak diğer diller için de kullanılabilir bazı tablolar bulunmaktadır.</p> 
  fr: >-
<p>Ibus-table est un cadriciel pour les méthodes de saisie basées sur des tables. Il est principalement utilisé pour les méthodes de saisie Chinoises telles que ZhengMa, Wubizixing, ErBi, CangJie… Mais des tables pour d’autres langues sont également disponibles.</p> 
  de: >-
<p>Ibus-table ist eine Inputsystem für tabellenbasierte Inputmethoden. Es wird hauptsächlich für chinesiche Inputmethoden wie ZhengMa, WuBi, ErBi, CangJie usw. benutzt. Aber es gibt auch einige Tabellen für andere Sprachen.</p> 
  pt-BR: >-
<p>Ibus-table é uma framework de método de entrada para métodos de entrada baseados em tabela. É usado principalmente para métodos de entrada chineses, como ZhengMa, WuBi, ErBi, CangJie, &. Mas algumas tabelas para outros idiomas também estão disponíveis.</p> 
  uk: >-
<p>Ibus-table >болонка Aпособів 2ведення Aимволів 7а 4опомогою Bаблиці. дебільшого 2икористовується 4ля Aпособів 2ведення Aимволів :итайської, 7окрема ZhengMa, WuBi, ErBi, CangJie, & ле ?ередбачено V Bаблиці 4ля 4еяких Vнших <ов.</p> 
  zh-Hans-CN: >-
<p>Ibus-table /个适用于码表输入法的输入法框架。通常用在中文输入法上，比如郑码、五笔、二笔、仓颉等等……但也有其他语言的码表使用此框架。</p> 
  ru: >-
<p>Ibus-table - Mто Dреймворк Aпособов 2вода Aимволов >снованных =а Bаблицах. >сновном 8спользуется 4ля <етодов 2вода :итайских Aимволов, Bаких :ак ZhengMa, WuBi, ErBi, CangJie, &. о Bакже 4оступны =екоторые Bаблицы 4ля 4ругих Oзыков.</p> 
  es: >-
<p>Ibus-table es un marco común para métodos de entrada basados en tablas. Se usa sobre todo para métodos de entrada de chino, como ZhengMa, WuBi, ErBi o CangJie, aunque también hay tablas para otros idiomas.</p> 
  pt-PT: >-
<p>Tabela Ibus é uma estrutura de método de entrada para métodos de entrada baseados em tabela. É utilizado principalmente para os métodos de entrada chineses, tais como ZhengMa, WuBi, ErBi, CangJie, &. Mas também estão disponíveis algumas tabelas para outros idiomas.</p> 
  C: >-
    <p>
          Ibus-table is an input method framework for table-based input
          methods.  Mostly it is used for Chinese input methods such as
          ZhengMa, WuBi, ErBi, CangJie, &.  But some tables for other
          languages are available as well.
        </p>
Developer:
  id: io.github.mike-fabian
  name:
=== /var/lib/apt/lists/deb.debian.org_debian_dists_testing_non-free-firmware_dep11_Components-amd64.yml.gz === 
```

It looks like the cozy README is the problem?
Here is the current line, which does not quite match the error because
I'm guessing the ... is being converted to an &.
https://github.com/geigi/cozy/blob/0be2d30e0743ebf27ff272c8c074591418e4f2cc/README.md#L28
cozy is in the same version in multiple Debian suites. I don't expect it is the root of this problem. Also I cannot reproduce it and don't see the relevant characters in upstream or the Components.gz on the Debian mirrors.

Reply via email to