Bug#681713: lintian: Please add a test which checks Vcs-Browser headers for hardcoded revisions/commits

[Axel Beckert]

Package: lintian
Version: 2.5.10
Severity: wishlist

Dear Lintian Maintainers,

today I noticed that the Vcs-Browser header of the debian-junior source
package included query string ?rev=0&sc=0 which leads to an empty view
of the repository (due to containing no commit). See
http://bugs.debian.org/681709 for details.

To keep the header useful even for people without any knowledge of the
used VCS viewer, suffixes like this should never be included in the
Vcs-Browser header.

After filing the bug report I noticed that many more package are
affected by the same issue, although mostly from the Debian Pure Blend,
Debian Science and Debian Med teams (X-Debbugs-Cc'ed):

$ fgrep -h rev= /var/lib/apt/lists/ftp.ch.debian.org_debian_dists_{experimental,sid}_main_source_Sources | sort -u
Vcs-Browser: https://labs.riseup.net/code/projects/backupninja/repository/show?rev=debian
Vcs-Browser: http://svn.debian.org/wsvn/blends/blends/trunk/blends/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/blends/projects/debichem/trunk/debichem/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/blends/projects/ezgo/trunk/debian-ezgo/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/blends/projects/gis/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/blends/projects/junior/trunk/debian-junior/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/cdd/cdd/trunk/cdd/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/collab-maint/ext-maint/alpine/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-edu/trunk/src/debian-edu/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-edu/trunk/src/libpam-mklocaluser/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-edu/trunk/src/sitesummary/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/pkg-games/packages/trunk/box2d/box2d-2.0.1/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/community/infrastructure/getData/?rev=0&sc=0trunk
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/abacas/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/alien-hunter/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/amap-align/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/ampliconnoise/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/biococoa/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/ctn/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/dialign/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/dialign-t/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/dotur/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/emboss-explorer/trunk/?rev=0&sc=0trunk
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/ensembl/libbio-das-lite-perl/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/figtree/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/glam2/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/igstk/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/insighttoolkit/wrapitk/python/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/libace-perl/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/libbio-mage-perl/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/libbio-mage-utils-perl/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/libctapimkt/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/libg2/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/libgenome/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/libgo-perl/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/libjam-java/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/libjebl2-java/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/loki/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/melting/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/mencal/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/minc/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/mriconvert/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/muscle/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/plasmidomics/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/primer3/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/probalign/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/python-biopython/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/python-cogent/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/pythonqt/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/rostlab/disulfinder/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/rostlab/libai-fann-perl/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/rostlab/pp-popularity-contest/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/rostlab/profnet/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/R/r-bioc-hilbertvis/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/R/r-cran-epitools/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/R/r-cran-g.data/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/R/r-cran-medadherence/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/seqan/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/sibsim4/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/sim4/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/snap/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/srf/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/staden-io-lib/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/tigr-glimmer/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/volpack/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-med/trunk/packages/vxl/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-science/packages/cimg/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-science/packages/libgtkdatabox/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-science/packages/openigtlink/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-science/packages/R/r-cran-amore/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-science/packages/R/r-cran-colorspace/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-science/packages/R/r-cran-msm/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-science/packages/R/r-cran-sp/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-science/packages/R/r-cran-teachingdemos/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-science/packages/R/r-cran-xtable/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-science/packages/slicer/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/debian-science/packages/z88/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/pkg-discover/discover-data/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/pkg-escience/sumo-analyzer/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/pkg-escience/torque/trunk/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/pkg-exppsy/psignifit/?rev=0&sc=0
Vcs-Browser: http://svn.debian.org/wsvn/pkg-postgresql/trunk/postgresql-plr/?rev=0&sc=0

Since mass-bug-filing is surely not the right way in this case, I
strongly suggest a lintian source control header check for such URLs.

The above fgrep search though already brought one false positive to
daylight:

Vcs-Browser: https://labs.riseup.net/code/projects/backupninja/repository/show?rev=debian

So maybe the check should only egrep for rev=[0-9] or similar.

The test could likely be adopted to other VCS and maybe other web-based
repository viewers, but at least a search for hardcoded git commits
currently luckily is unsuccessful:

egrep -h '^Vcs-Browser.*h=[0-9a-fA-F]' /var/lib/apt/lists/ftp.ch.debian.org_debian_dists_{experimental,sid}_main_source_Sources | sort -u

-- 
		Regards, Axel