Bug#919959: isorelax: Dangerous use of "find" in debian/rules

[Santiago Vila]

Package: src:isorelax
Version: 20041111-11
Tags: patch

Dear maintainer:

I tried to build this package in buster but it failed:

--------------------------------------------------------------------------------
[...]
 debian/rules build-indep
dh build-indep --with maven_repo_helper
   dh_update_autotools_config -i
   dh_autoreconf -i
   debian/rules override_dh_auto_build
make[1]: Entering directory '/<<PKGBUILDDIR>>'
javac -classpath /usr/share/java/ant.jar -source 1.8 -target 1.8 `find jp org -name \*.java`
warning: [options] bootstrap class path not set in conjunction with -source 8
Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
Note: Some input files use unchecked or unsafe operations.
Note: Recompile with -Xlint:unchecked for details.
1 warning
javadoc -locale en -encoding UTF-8 -notimestamp -classpath /usr/share/java/ant.jar -link /usr/share/doc/default-jdk-doc/api -link /usr/share/doc/ant/api/ -source 1.8 -d api `find . -name \*.java`
Loading source file ./jp/gr/xml/relax/sax/RELAXEntityResolver.java...
Loading source file ./jp/gr/xml/relax/sax/LexicalHandlerBase.java...
Loading source file ./jp/gr/xml/relax/sax/DeclHandlerBase.java...
Loading source file ./jp/gr/xml/relax/sax/DTDSkipper.java...
Loading source file ./jp/gr/xml/relax/sax/DOMSAXProducer.java...
Loading source file ./jp/gr/xml/relax/sax/DOMSAXProducerVisitor.java...
Loading source file ./jp/gr/xml/relax/sax/SimpleEntityResolver.java...
Loading source file ./jp/gr/xml/relax/xml/UXML.java...
Loading source file ./jp/gr/xml/relax/dom/IDOMVisitor.java...
Loading source file ./jp/gr/xml/relax/dom/DOMVisitorException.java...
Loading source file ./jp/gr/xml/relax/dom/UDOM.java...
Loading source file ./jp/gr/xml/relax/dom/XMLMaker.java...
Loading source file ./jp/gr/xml/relax/dom/UDOMVisitor.java...
Loading source file ./org/iso_relax/catalog/RELAXCatalog.java...
Loading source file ./org/iso_relax/ant/JARVTask.java...
Loading source file ./org/iso_relax/ant/ErrorHandlerImpl.java...
Loading source file ./org/iso_relax/dispatcher/IslandSchemaReader.java...
Loading source file ./org/iso_relax/dispatcher/AttributesDecl.java...
Loading source file ./org/iso_relax/dispatcher/Dispatcher.java...
Loading source file ./org/iso_relax/dispatcher/IslandSchema.java...
Loading source file ./org/iso_relax/dispatcher/impl/IgnoreVerifier.java...
Loading source file ./org/iso_relax/dispatcher/impl/AbstractSchemaProviderImpl.java...
Loading source file ./org/iso_relax/dispatcher/impl/DispatcherImpl.java...
Loading source file ./org/iso_relax/dispatcher/impl/IgnoredSchema.java...
Loading source file ./org/iso_relax/dispatcher/IslandVerifier.java...
Loading source file ./org/iso_relax/dispatcher/ElementDecl.java...
Loading source file ./org/iso_relax/dispatcher/SchemaProvider.java...
Loading source file ./org/iso_relax/dispatcher/AttributesVerifier.java...
Loading source file ./org/iso_relax/jaxp/ValidatingSAXParser.java...
Loading source file ./org/iso_relax/jaxp/ValidatingDocumentBuilder.java...
Loading source file ./org/iso_relax/jaxp/ValidatingSAXParserFactory.java...
Loading source file ./org/iso_relax/jaxp/ValidatingDocumentBuilderFactory.java...
Loading source file ./org/iso_relax/verifier/VerifierFilter.java...
Loading source file ./org/iso_relax/verifier/Schema.java...
Loading source file ./org/iso_relax/verifier/VerifierFactory.java...
Loading source file ./org/iso_relax/verifier/impl/VerifierFilterImpl.java...
Loading source file ./org/iso_relax/verifier/impl/VerifierImpl.java...
Loading source file ./org/iso_relax/verifier/impl/ForkContentHandler.java...
Loading source file ./org/iso_relax/verifier/impl/SAXEventGenerator.java...
Loading source file ./org/iso_relax/verifier/VerifierConfigurationException.java...
Loading source file ./org/iso_relax/verifier/Verifier.java...
Loading source file ./org/iso_relax/verifier/VerifierHandler.java...
Loading source file ./org/iso_relax/verifier/VerifierFactoryLoader.java...
Loading source file ./org/iso_relax/verifier/VerifierException.java...
Loading source file ./.pc/build/org/iso_relax/jaxp/ValidatingDocumentBuilderFactory.java...
Constructing Javadoc information...
Creating destination directory: "api/"
javadoc: error - The code being documented uses packages in the unnamed module, but the packages defined in /usr/share/doc/default-jdk-doc/api/ are in named modules.
Standard Doclet version 11.0.2
Building tree for all the packages and classes...
Generating api/org/iso_relax/ant/ErrorHandlerImpl.html...
Generating api/org/iso_relax/ant/JARVTask.html...
Generating api/org/iso_relax/catalog/RELAXCatalog.html...
Generating api/org/iso_relax/dispatcher/AttributesDecl.html...
Generating api/org/iso_relax/dispatcher/AttributesVerifier.html...
Generating api/org/iso_relax/dispatcher/Dispatcher.html...
Generating api/org/iso_relax/dispatcher/Dispatcher.NotationDecl.html...
Generating api/org/iso_relax/dispatcher/Dispatcher.UnparsedEntityDecl.html...
Generating api/org/iso_relax/dispatcher/ElementDecl.html...
Generating api/org/iso_relax/dispatcher/IslandSchema.html...
Generating api/org/iso_relax/dispatcher/IslandSchemaReader.html...
Generating api/org/iso_relax/dispatcher/IslandVerifier.html...
./org/iso_relax/dispatcher/IslandVerifier.java:70: warning - @param argument "assignedLabel" is not a parameter name.
Generating api/org/iso_relax/dispatcher/SchemaProvider.html...
Generating api/jp/gr/xml/relax/dom/DOMVisitorException.html...
Generating api/jp/gr/xml/relax/dom/IDOMVisitor.html...
Generating api/jp/gr/xml/relax/dom/UDOM.html...
Generating api/jp/gr/xml/relax/dom/UDOMVisitor.html...
Generating api/jp/gr/xml/relax/dom/XMLMaker.html...
Generating api/org/iso_relax/dispatcher/impl/AbstractSchemaProviderImpl.html...
Generating api/org/iso_relax/dispatcher/impl/DispatcherImpl.html...
Generating api/org/iso_relax/dispatcher/impl/DispatcherImpl.Context.html...
Generating api/org/iso_relax/dispatcher/impl/IgnoredSchema.html...
Generating api/org/iso_relax/dispatcher/impl/IgnoreVerifier.html...
Generating api/org/iso_relax/verifier/impl/ForkContentHandler.html...
Generating api/org/iso_relax/verifier/impl/SAXEventGenerator.html...
Generating api/org/iso_relax/verifier/impl/VerifierFilterImpl.html...
Generating api/org/iso_relax/verifier/impl/VerifierImpl.html...
Generating api/org/iso_relax/jaxp/ValidatingDocumentBuilderFactory.html...
Generating api/org/iso_relax/jaxp/ValidatingSAXParserFactory.html...
Generating api/jp/gr/xml/relax/sax/DeclHandlerBase.html...
Generating api/jp/gr/xml/relax/sax/DOMSAXProducer.html...
Generating api/jp/gr/xml/relax/sax/DOMSAXProducerVisitor.html...
Generating api/jp/gr/xml/relax/sax/DTDSkipper.html...
Generating api/jp/gr/xml/relax/sax/LexicalHandlerBase.html...
Generating api/jp/gr/xml/relax/sax/RELAXEntityResolver.html...
Generating api/jp/gr/xml/relax/sax/SimpleEntityResolver.html...
Generating api/org/iso_relax/verifier/Schema.html...
Generating api/org/iso_relax/verifier/Verifier.html...
Generating api/org/iso_relax/verifier/VerifierConfigurationException.html...
Generating api/org/iso_relax/verifier/VerifierException.html...
Generating api/org/iso_relax/verifier/VerifierFactory.html...
./org/iso_relax/verifier/VerifierFactory.java:52: warning - @param argument "uri" is not a parameter name.
./org/iso_relax/verifier/VerifierFactory.java:168: warning - @param argument "file" is not a parameter name.
Generating api/org/iso_relax/verifier/VerifierFactoryLoader.html...
Generating api/org/iso_relax/verifier/VerifierFilter.html...
Generating api/org/iso_relax/verifier/VerifierHandler.html...
Generating api/jp/gr/xml/relax/xml/UXML.html...
Generating api/jp/gr/xml/relax/dom/package-summary.html...
Generating api/jp/gr/xml/relax/dom/package-tree.html...
Generating api/jp/gr/xml/relax/sax/package-summary.html...
Generating api/jp/gr/xml/relax/sax/package-tree.html...
Generating api/jp/gr/xml/relax/xml/package-summary.html...
Generating api/jp/gr/xml/relax/xml/package-tree.html...
Generating api/org/iso_relax/ant/package-summary.html...
Generating api/org/iso_relax/ant/package-tree.html...
Generating api/org/iso_relax/catalog/package-summary.html...
Generating api/org/iso_relax/catalog/package-tree.html...
Generating api/org/iso_relax/dispatcher/package-summary.html...
Generating api/org/iso_relax/dispatcher/package-tree.html...
Generating api/org/iso_relax/dispatcher/impl/package-summary.html...
Generating api/org/iso_relax/dispatcher/impl/package-tree.html...
Generating api/org/iso_relax/jaxp/package-summary.html...
./.pc/build/org/iso_relax/jaxp/ValidatingDocumentBuilderFactory.java:11: warning - Tag @link: reference not found: DocumentBuilderFactory
Generating api/org/iso_relax/jaxp/package-tree.html...
Generating api/org/iso_relax/verifier/package-summary.html...
Generating api/org/iso_relax/verifier/package-tree.html...
Generating api/org/iso_relax/verifier/impl/package-summary.html...
Generating api/org/iso_relax/verifier/impl/package-tree.html...
Generating api/constant-values.html...
Generating api/serialized-form.html...
Building index for all the packages and classes...
Generating api/overview-tree.html...
Generating api/index-all.html...
Building index for all classes...
Generating api/allclasses-index.html...
Generating api/allpackages-index.html...
Generating api/deprecated-list.html...
Building index for all classes...
Generating api/allclasses.html...
Generating api/allclasses.html...
Generating api/index.html...
Generating api/overview-summary.html...
Generating api/help-doc.html...
1 error
4 warnings
make[1]: *** [debian/rules:25: override_dh_auto_build] Error 1
make[1]: Leaving directory '/<<PKGBUILDDIR>>'
make: *** [debian/rules:21: build-indep] Error 2
dpkg-buildpackage: error: debian/rules build-indep subprocess returned exit status 2
--------------------------------------------------------------------------------

The FTBFS part is probably Bug #919895, but it's not what I'd like to report here,
but instead the fact that the build log contains this:

Loading source file ./.pc/build/org/iso_relax/jaxp/ValidatingDocumentBuilderFactory.java...

This happens because the various "find" commands include the .pc directory used by
dpkg and quilt. In some cases this leads to the package failing to build in unexpected ways.

I would highly recommend avoiding this.
The (untested) patch below would probably work:

--- a/debian/rules
+++ b/debian/rules
@@ -22,11 +22,11 @@ JARFILE=isorelax-20041111.jar
 
 override_dh_auto_build:
 	$(JAVAC) $(JAVAFLAGS) `find jp org -name \*.java`
-	$(JAVADOC) $(JAVADOCFLAGS) -d api `find . -name \*.java`
+	$(JAVADOC) $(JAVADOCFLAGS) -d api `find * -name \*.java`
 
-	$(JAR) c `find . -name \*.class -o -name \*.rxm -o -name \*.rxg -o -name \*.dtd -o -name \*.mod -o -name \*.MF` > $(JARFILE)
+	$(JAR) c `find * -name \*.class -o -name \*.rxm -o -name \*.rxg -o -name \*.dtd -o -name \*.mod -o -name \*.MF` > $(JARFILE)
 
 override_dh_auto_clean:
-	rm -f `find . -name \*.class`
+	rm -f `find * -name \*.class`
 	rm -f $(JARFILE)
 	rm -fr api

Thanks.