Bug#944964: dh-make-perl: Module accesses internal dpkg database

[Guillem Jover]

Source: dh-make-perl
Source-Version: 0.107
Severity: important
User: debian-dpkg at lists.debian.org
Usertags: dpkg-db-access-blocker

Hi!

This package contains a perl module [M], which directly accesses the
dpkg internal database. Instead of using one of the public interfaces
provided by dpkg.

 [M] lib/Debian/DpkgLists.pm

The function _cat_lists() accesses the file list files directly, and
should be switched to use either «dpkg-query --listfiles» instead, or the
dpkg-query db-fsys:Files virtual field with --show. If using the former
and to avoid a performance hit, the code should batch multiple packages
on each call, taking into account command-line length limits. Each
package will get a paragraph separated by a blank line (even if it is
not installed).


This is a problem for several reasons, because even though the layout and
format of the dpkg database is administrator friendly, and it is expected
that those might need to mess with it, in case of emergency, this
“interface” does not extend to other programs besides the dpkg suite of
tools. The admindir can also be configured differently at dpkg build or
run-time. And finally, the contents and its format, will be changing in
the near future.

Thanks,
Guillem