[DRE-maint] Bug#944966: ruby-debian: Module accesses internal dpkg database

[Guillem Jover]

Source: ruby-debian
Source-Version: 0.3.10
Severity: important
User: debian-dpkg at lists.debian.org
Usertags: dpkg-db-access-blocker

Hi!

This package contains the «debian» module, which directly accesses
the dpkg internal database, instead of using one of the public
interfaces provided by dpkg.

The module should stop reading the files list files, and switched to
use something like:

  «dpkg-query \
    --showformat 'Package: ${Package}\nFiles:\n${db-fsys:Files}\n' \
    --show»

to get them.

To get the status and available files it should instead call
«dpkg-query --status» or «dpkg-query --print-avail» which now support
dumping the entire databases, and which will take care of including
live or pending journal entries.


This is a problem for several reasons, because even though the layout and
format of the dpkg database is administrator friendly, and it is expected
that those might need to mess with it, in case of emergency, this
“interface” does not extend to other programs besides the dpkg suite of
tools. The admindir can also be configured differently at dpkg build or
run-time. And finally, the contents and its format, will be changing in
the near future.

Thanks,
Guillem