Bug#704480: dh-make-perl: Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.

[Robert Norris]

I have a reliable reproduction for this bug:

# dh-make-perl --cpan Net::Domain::ExpireDate
Going to read '/root/.cpan/Metadata'
  Database was generated on Mon, 20 May 2013 07:41:03 GMT
CPAN: Digest::SHA loaded ok (v5.61)
Checksum for /root/.cpan/sources/authors/id/D/DE/DESPAIR/Net-Domain-ExpireDate-1.11.tar.gz ok
CPAN: Archive::Tar loaded ok (v1.76)
Net-Domain-ExpireDate-1.11/
Net-Domain-ExpireDate-1.11/MANIFEST.SKIP
Net-Domain-ExpireDate-1.11/t/
Net-Domain-ExpireDate-1.11/t/01.t
Net-Domain-ExpireDate-1.11/lib/
Net-Domain-ExpireDate-1.11/lib/Net/
Net-Domain-ExpireDate-1.11/lib/Net/Domain/
Net-Domain-ExpireDate-1.11/lib/Net/Domain/ExpireDate.pm  
Net-Domain-ExpireDate-1.11/MANIFEST
Net-Domain-ExpireDate-1.11/META.json
Net-Domain-ExpireDate-1.11/Build.PL
Net-Domain-ExpireDate-1.11/Changes
Net-Domain-ExpireDate-1.11/META.yml
Net-Domain-ExpireDate-1.11/README
Net-Domain-ExpireDate-1.11/domdates
Net-Domain-ExpireDate-1.11/Makefile.PL
CPAN: File::Temp loaded ok (v0.22)
CPAN: Module::Build loaded ok (v0.4001)
Using META.json
Found: Net-Domain-ExpireDate 1.10 (libnet-domain-expiredate-perl arch=all)
Using cached Contents from Tue May 21 02:12:37 2013
+ Getopt::Long >= 2 found in perl-base (>= 2)
+ Net::Whois::Raw >= 1 found in libnet-whois-raw-perl (>= 1)
= Time::Piece  is in core

Needs the following debian packages: perl-base (>= 2), libnet-whois-raw-perl (>= 1), perl
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
+ Module::Build >= 0.40 found in libmodule-build-perl ( 0.40) | perl-modules ( 0.40)
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.

Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
Needs the following debian packages during building: libmodule-build-perl ( 0.40) | perl-modules ( 0.40)
Using maintainer: root <root at utility2.nyi.mail.srv.osa>  
Found docs: README
Using rules: /usr/share/dh-make-perl/rules.dh7.tiny
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
Use of uninitialized value in concatenation (.) or string at /usr/share/perl5/Debian/Dependency.pm line 157.
**********
Copyright information incomplete!

Upstream copyright information could not be automatically determined.

If you are building this package for your personal use, you might disregard
this information; however, if you intend to upload this package to Debian
(or in general, if you plan on distributing it), you must look into the
complete copyright information.

The causes for this warning are:
Licensing information is present, but cannot be parsed   
--- Done
Switched to a new branch 'master'
pristine-tar: committed libnet-domain-expiredate-perl_1.10.orig.tar.gz.delta to branch pristine-tar
Reading package lists... Done
Building dependency tree
Reading state information... Done


Looking at META.json for this package, we see:

   "prereqs" : {
      "configure" : {
         "requires" : {
            "Module::Build" : "0.40"
         }
      },
   ...
   }


Because Module::Build is in core, an alternative dependency pair of
either perl-modules or libmodule-build-perl is created:

Debian::Dependency::new(/usr/share/perl5/Debian/Dependency.pm:87):
87:         my $class = shift;
  DB<4> x @_
0  'Debian::Dependency'
1  ARRAY(0xedc5ff8)
   0  HASH(0xedb43e8)
      'pkg' => 'libmodule-build-perl'
      'ver' => 0.40
   1  HASH(0xedc5db8)
      'pkg' => 'perl-modules'
      'ver' => 0.40

(depending on perl-modules >= 0.40 is stupid, but that's something for
another ticket perhaps).


This results in two calls back into new(), one for each dependency. They
end up in the HASH block on line 94:

    $pkg = delete $_[0]->{pkg};
    $rel = delete $_[0]->{rel};
    $ver = delete $_[0]->{ver};


So naturally, $rel is undefined at this point. Then later at line 157:

    return (
          $self->ver
        ? $self->pkg . ' (' . $self->rel . ' ' . $self->ver . ')'
        : $self->pkg
    );

The first option is taken, attempting to concatenate the undefined
$self->rel, causing the warning.


More critically, this produces a dependency on (eg)
"libmodule-build-perl ( 0.40)" (note the space in front of the version).
This is is rejected later by dpkg-source during package build:

dpkg-source: warning: can't parse dependency libmodule-build-perl ( 0.40)


The fix is probably to do what the two-arg form of
Debian::Dependency::new does - default $rel to '>=' if its missing.