[Syslog-ng-maintainers] Bug#905680: syslog-ng: script directly accesses internal dpkg database

[Guillem Jover]

Source: syslog-ng
Source-Version: 3.13.2-4
Severity: important
User: debian-dpkg at lists.debian.org
Usertags: dpkg-db-access-blocker

Hi!

This package contains a script that directly accesses the dpkg
internal database [S], instead of using the correct public interface
«dpkg --verify».

  [S] contrib/syslog-ng-debun

This a problem for multiple reasons. Even though the layout and format
of the dpkg database is administrator friendly, and it's expected that
those might need to mess with it, in case of emergency, this interface
does not extend to other programs besides the dpkg suite of tools. The
admindir can also be configured differently at dpkg build or run-time.
And finally, the contents and its format, will be changing in the near
future.

Thanks,
Guillem