Hi,

sploitscan installs configuration files in the system Python modules
directory:

/usr/lib/python3/dist-packages/sploitscan/templates/report_template.html
/usr/lib/python3/dist-packages/sploitscan/config.json

As per Debian Policy 10.7.2 configuration files must reside in /etc (or
in case of multiple configuration files it is suggested to put them in
a subdirectory named after the package).

Best regards,

Peter

We believe that the bug you reported is fixed in the latest version of
sploitscan, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1072816@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Josenilson Ferreira da Silva <nilsonfsilva@hotmail.com> (supplier of updated sploitscan package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 24 Jun 2024 10:39:14 -0300
Source: sploitscan
Architecture: source
Version: 0.9.1-3
Distribution: unstable
Urgency: medium
Maintainer: Debian Security Tools <team+pkg-security@tracker.debian.org>
Changed-By: Josenilson Ferreira da Silva <nilsonfsilva@hotmail.com>
Closes: 1072747 1072816 1072882
Changes:
 sploitscan (0.9.1-3) unstable; urgency=medium
 .
   * debian/control:
     - Bumped to version 4.7.0
     - Fixed Vcs urls (Closes: #1072882)
   * debian/rules: Files fixed after compilation (Closes: #1072747)
   * debian/sploitscan.links: Created symbolic links to usr/lib
   * debian/sploitscan.install: Files moved to usr/share (Closes: #1072816)
Checksums-Sha1:
 0b54e617d0b10ca813a44dcc14197401fbfd6f74 2104 sploitscan_0.9.1-3.dsc
 2fc5bf5b58b899afa2996de30fdcd3f363e842d1 3160 sploitscan_0.9.1-3.debian.tar.xz
 69df8703aed32390f1f8422ada80a840fb8deb27 8508 sploitscan_0.9.1-3_source.buildinfo
Checksums-Sha256:
 6bd04eca575742ce2f98c1579c18d0b9d91699cfdca8353dbf45e32e96400c68 2104 sploitscan_0.9.1-3.dsc
 315740ae133a77b8fec764291d3029ad04dfe31505baf75ec3fa65368d808579 3160 sploitscan_0.9.1-3.debian.tar.xz
 f48eface5ea3238c5f87f77d710c36717066361154d01c32a5187c44979d965f 8508 sploitscan_0.9.1-3_source.buildinfo
Files:
 9714798106a8f7e4edaf1300031a643c 2104 misc optional sploitscan_0.9.1-3.dsc
 63f1bfcd6e43c878aaec4ca0fc245399 3160 misc optional sploitscan_0.9.1-3.debian.tar.xz
 fe0da1be3e5d0dc5a921e9adffc3af25 8508 misc optional sploitscan_0.9.1-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEqBlNXRF+LQLfMNMNB6n1YjE0Rs0FAmZ7bbsACgkQB6n1YjE0
Rs2S2BAAmlU90cTr7QDXZg8WXYR1+K+0BeCvP5/1YlDDf3aD1smiQ5PcppE943e+
FGQKjPN2fdqFyoXRvqWjtrXTmZjV8fJc1I1/e6TZsexRSdXh9uxMAUkRjzzBqMen
8YyFgv2MOtS+PiA5rS4rfE9i2cTh6JjJbWCKgImh7AMR5KHaz3vuodBT5n9fVZ3w
WauCzmcrGPJ7ZPZpZ4eKoebLL8s6UtbVEx1WeWHVjoWst2sm0Xn+D0jYthmYUPq2
A5nQnM8L4f8cwFH8NOFXvG8m8jLjAFkJqeBV/1h9SCJDunS9meIgXxzny+uqFd9O
zrg+X0+laEuZByoHjPE9sfQet1fNpRNzhS5qpAAsGhzTw19K2s4eg6WDIB+YoxoL
pWhtLkZgIZvR3x8BrGSn77Pd/pkMxY/3fCURaWQzK2WgJvvEm8oDpaC6KCJQPppz
n7USMPTfEC5lRmY0AOUNuWA3PD3DHw71mJs3Hk1saNnLQZTTp5L8cWQsgjus3YgJ
AHPLcByZw1K1mvjmuiX/ksBbhM6IJI1yKWyGEqST6aT0XKCRzZ1duQFUqLfvR4Ru
tGsIBPusP7AmU9czxd7fRQt4hNaoJmft4JCcpi0UxK92u73eiW4REHiPKPx7kxz3
0yEJN6g8nPrb+h33laXooOor8ALgKhF3cscQg0Mq0g7+JvWutXE=
=/5ky
-----END PGP SIGNATURE-----

Control: reopen -1

Dear Maintainer,

in my opinion version 0.9.1-3 does not provide a proper fix for the
above issue. Now the situation looks like this:

/usr/lib/python3/dist-packages/sploitscan/templates/report_template.html
-> ../../../../../share/doc/sploitscan/templates/report_template.html

/usr/lib/python3/dist-packages/sploitscan/config.json ->
/etc/sploitscan/config.json

 From my point of view moving the report template (report_template.html)
to the documentation directory (/usr/share/doc/sploitscan) is
inappropriate. Putting example configuration files under
/usr/share/doc/sploitscan is fine but putting a file that controls the
behavior of the program under /usr/share/doc/sploitscan violates Debian
Policy. I think this file is a configuration file in the sense of Debian
Policy 10.7.1 rather than documentation and therefore must go into /etc
or a subdirectory thereof. It seems that upstream has even arranged to
put this file into this location [0].

I also noticed that local changes in report_template.html are not
preserved on package upgrades as required by Debian Policy 10.7.3.

In addition I found two minor issues:

1. Looking at the sploitscan code [1], I suppose that the link

/usr/lib/python3/dist-packages/sploitscan/config.json ->
/etc/sploitscan/config.json

is not necessary (although I have not tested this).

2. The changelog entry closing this bug

----------------------------------------------------------------------
debian/sploitscan.install: Files moved to usr/share (Closes: #1072816)
----------------------------------------------------------------------

and the corresponding commit message [2] do not properly describe the
actual change being performed. The change includes moving only a single
file to usr/share, it moves another file to etc/sploitscan and in
addition it removes the installation of yet another file.

Best regards,

Peter

[0]
https://salsa.debian.org/pkg-security-team/sploitscan/-/blob/605deb3647c2c43315e0cd6e83f447bd7fab35c2/sploitscan/sploitscan.py#L620

[1]
https://salsa.debian.org/pkg-security-team/sploitscan/-/blob/605deb3647c2c43315e0cd6e83f447bd7fab35c2/sploitscan/sploitscan.py#L412

[2]
https://salsa.debian.org/pkg-security-team/sploitscan/-/commit/ce316a01edd1bb6449424d3ad0227a59e07a7528

Hi Peter!
On this point, I agree with you.  I was also in doubt and that's why I opened a
“question”: https://github.com/xaitax/SploitScan/issues/23 and it was answered.
I'll move it to /etc/sploitscan/
To avoid mistaken corrections, could you clarify this point with a practical example?
This bug has generated a lot of learning. Thank you very much, in advance

Will this answer your question?
https://github.com/xaitax/SploitScan/issues/23


best wishes,
Nilson F. Silva

Hi Nilson,

I did not see your answer earlier since I was not subscribed to this bug
(I am now). I am sorry for that.

 >> I also noticed that local changes in report_template.html are not
 >> preserved on package upgrades as required by Debian Policy 10.7.3.
 > To avoid mistaken corrections, could you clarify this point with a
 > practical example?

Luckily Debian tooling comes to your help. dpkg will take care of it for
all files installed below /etc. Thus if you change sploitscan packaging
to install all configuration files under /etc/sploitscan, dpkg will do
the rest and make sure local changes are preserved on package upgrades.

You can find more information on this topic (including more complicated
situations) on [0].

 >> . Looking at the sploitscan code [1], I suppose that the link
 >> /usr/lib/python3/dist-packages/sploitscan/config.json ->
 >> /etc/sploitscan/config.json
 >> is not necessary (although I have not tested this).
 >
 > Will this answer your question?
 > https://github.com/xaitax/SploitScan/issues/23

This confirms what I saw in the code.

If you have further questions, do not hesitate to ask.

Best regards,

Peter

[0] https://www.debian.org/doc/debian-policy/ap-pkg-conffiles.html

We believe that the bug you reported is fixed in the latest version of
sploitscan, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1072816@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Josenilson Ferreira da Silva <nilsonfsilva@hotmail.com> (supplier of updated sploitscan package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 09 Jul 2024 10:39:03 -0300
Source: sploitscan
Architecture: source
Version: 0.10.3-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Security Tools <team+pkg-security@tracker.debian.org>
Changed-By: Josenilson Ferreira da Silva <nilsonfsilva@hotmail.com>
Closes: 1072816 1074476 1074771
Changes:
 sploitscan (0.10.3-1) unstable; urgency=medium
 .
   [ Dmitry Shachnev ]
   * Use links file to symlink config.json
 .
   [ Josenilson Ferreira da Silva ]
   * New upstream version 0.10.3 (Closes: #1074476, #1074771)
   * debian/rules: Removed unnecessary command
   * debian/sploitscan.install:
      Configuration file moved to /etc directory (Closes:  #1072816 )
   * debian/sploitscan.links: Changed symbolic link
Checksums-Sha1:
 451dfd84a05759f45ba8df4162d5c6051ea8da07 2111 sploitscan_0.10.3-1.dsc
 c4204a43ad4fc1778abbf8b3bf562653e160ffa9 34983 sploitscan_0.10.3.orig.tar.gz
 8916d1175b056bc52477c9723e9fac4596f77bf9 3268 sploitscan_0.10.3-1.debian.tar.xz
 65ecccd4d7af7c37a95f6a0455caeed7ff5964e7 9934 sploitscan_0.10.3-1_source.buildinfo
Checksums-Sha256:
 82fe339f955bca0c3efaca7c70163b3bd99f49e04ce18c42979520a410501b30 2111 sploitscan_0.10.3-1.dsc
 9c8490e2a75f3073412fdb311a6029258e3961decdbf8bf9bce5ef03c980e98d 34983 sploitscan_0.10.3.orig.tar.gz
 099dc5c86113e65e853d71ff53dd7ae3e8c3d59b398b0389e79315f953ad4658 3268 sploitscan_0.10.3-1.debian.tar.xz
 b251ace422c819597cf679220415b241bd91839993ec6ea1e6b9a171ebcc0b53 9934 sploitscan_0.10.3-1_source.buildinfo
Files:
 52bb9e1990a5cc95e14a953a64dfa651 2111 misc optional sploitscan_0.10.3-1.dsc
 517031b6ecddb9fad3506588ebc4e5ab 34983 misc optional sploitscan_0.10.3.orig.tar.gz
 5daa012f1b07039db201d3f33e174b56 3268 misc optional sploitscan_0.10.3-1.debian.tar.xz
 956ea345508aae2ba7ab9e1d249a654d 9934 misc optional sploitscan_0.10.3-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEqBlNXRF+LQLfMNMNB6n1YjE0Rs0FAmaNZ2cACgkQB6n1YjE0
Rs2SfhAApFEetxY2+XtQL4UhMFJNmvDS7S1dFdhBtQRcyyR4Qn/UOG5Ul/KCBXET
ZmROdcGz+rOXr95g36JxH+D5Ef2j09dvbM9E+1LXN3p8RTUzQjx/zi2D71vsVzZ6
wN22ZLb6nXlUMv09uhe+0MzU90hKPc22JRU4Nbt02T0sEcTZJ8S4GveQjE9RvaGl
TW95VP/T60UjGxZyQ8EspGTi2RJMC8PZtinL4wG5SQvfvOVy/woghW3M13JRHkJu
WNPDWkwgSsc5XWE0hg7yP6ZfdcGF+q9jouySGu2jffJrz4InOdIOFcb42NTcUIDW
1PFe0a862kWVJx+Jm/hILreAXqGkR9L+5asQJONItErqfDVybtPbkYEM2xBmFobq
DUvynsMgcaKpmojXzoqJljmobCPBEZvv2DNB0eO7gawqQGcYcYk4pZK6So0yNvnE
m6T8xdp3TA+28mp4Or0cC6OBFCQOHt6eKevEaV6VT/grwdDJlfwZQ6eYF0C/psRu
2Vpy8BP87p+k/HWcChKkolv3F9UwelAVaQZr8LnsaJ4Kg15QmSkbXRfK7z7HlWYN
+HNnypOkBEuBY3Dfwh9Np72XjbEyRgTnWMOmnVPmhi0TudF04+jE+PXHvNLHkuLP
rIGIIBxTJC27xBkZTeShwWvB37BQWrzlqLVyA5/XE+j9/DwLyeM=
=SV0+
-----END PGP SIGNATURE-----