Debian Bug report logs - #921750
security-warning hook not found, fails open

Reply or subscribe to this bug.

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Antoine Beaupre <anarcat@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: security-warning hook not found, fails open

Date: Fri, 08 Feb 2019 15:18:55 -0500

Package: dput-ng
Version: 1.22
Severity: important

Hi!

I tried switching to dput-ng again, and here's what happened:

anarcat@curie:dist$ dput security-master libreoffice_4.3.3-2+deb8u12_amd64.changes
Uploading libreoffice using ftp to security-master (host: ftp.security.upload.debian.org; directory: /pub/SecurityUploadQueue)
running allowed-distribution: check whether a local profile permits uploads to the target distribution
running protected-distribution: warn before uploading to distributions where a special policy applies
running checksum: verify checksums before uploading
running suite-mismatch: check the target distribution for common errors
running gpg: check GnuPG signatures before the upload
Could not execute /usr/share/dput/helper/security-warning: [Errno 2] No such file or directory: '/usr/share/dput/helper/security-warning': '/usr/share/dput/helper/security-warning'
Error: You've set a hook (pre_upload_command) to run (`/usr/share/dput/helper/security-warning`), but it can't be found (and doesn't appear to exist). Please verify the path and correct it.
Uploading libreoffice_4.3.3-2+deb8u12.dsc
Uploading libreoffice_4.3.3-2+deb8u12.debian.tar.xz
Uploading libreoffice_4.3.3-2+deb8u12_amd64.deb
[...]

ie. it didn't find the `security-warning` file it's supposed to show
and prompt the user but worse, it then just went on uploading the
package normally.

The warning should be shown, and failing that, the upload should fail
if the hook is missing.

Thanks for the nice work! :)

A.

-- System Information:
Debian Release: buster/sid
  APT prefers testing
  APT policy: (500, 'testing'), (1, 'experimental'), (1, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-2-amd64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=fr_CA.UTF-8, LC_CTYPE=fr_CA.UTF-8 (charmap=UTF-8), LANGUAGE=fr_CA.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages dput-ng depends on:
ii  python3       3.7.2-1
ii  python3-dput  1.22

dput-ng recommends no packages.

Versions of packages dput-ng suggests:
pn  dput-ng-doc      <none>
pn  python3-twitter  <none>

-- no debconf information

Message #10 received at 921750@bugs.debian.org (full text, mbox, reply):

From: Santiago Ruano Rincón <santiagorr@riseup.net>

To: 921750@bugs.debian.org, Antoine Beaupre <anarcat@debian.org>

Subject: Re: security-warning hook not found, fails open

Date: Fri, 22 Mar 2024 14:23:08 -0300

[Message part 1 (text/plain, inline)]

On Fri, 08 Feb 2019 15:18:55 -0500 Antoine Beaupre <anarcat@debian.org> wrote:
> Package: dput-ng
> Version: 1.22
> Severity: important
> 
> Hi!
> 
> I tried switching to dput-ng again, and here's what happened:
> 
> anarcat@curie:dist$ dput security-master libreoffice_4.3.3-2+deb8u12_amd64.changes
> Uploading libreoffice using ftp to security-master (host: ftp.security.upload.debian.org; directory: /pub/SecurityUploadQueue)
> running allowed-distribution: check whether a local profile permits uploads to the target distribution
> running protected-distribution: warn before uploading to distributions where a special policy applies
> running checksum: verify checksums before uploading
> running suite-mismatch: check the target distribution for common errors
> running gpg: check GnuPG signatures before the upload
> Could not execute /usr/share/dput/helper/security-warning: [Errno 2] No such file or directory: '/usr/share/dput/helper/security-warning': '/usr/share/dput/helper/security-warning'
> Error: You've set a hook (pre_upload_command) to run (`/usr/share/dput/helper/security-warning`), but it can't be found (and doesn't appear to exist). Please verify the path and correct it.
> Uploading libreoffice_4.3.3-2+deb8u12.dsc
> Uploading libreoffice_4.3.3-2+deb8u12.debian.tar.xz
> Uploading libreoffice_4.3.3-2+deb8u12_amd64.deb
> [...]
> 
> ie. it didn't find the `security-warning` file it's supposed to show
> and prompt the user but worse, it then just went on uploading the
> package normally.
> 
> The warning should be shown, and failing that, the upload should fail
> if the hook is missing.
> 
> Thanks for the nice work! :)

I've also been hit by this. And the problem seems to be the old-style
/etc/dput.cf, that overrides the dput-ng profiles. I've purged dput,
hoping this would help the next time.

FWIW, dput-ng comes with a protected-distribution hook, that has the
same goal of security-warning.

Cheers,

 -- Santiago

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.