Dear Florian,

Thank you very much for sharing your technical
skill to generously maintain Debian's important
debsecan package.

I happened to notice it crashes when a package's
Maintainer field in /var/lib/dpkg/status contains
non-Latin characters.

Screen shots of the characters are attached.

Maybe you can duplicate the bug by

    1.) copying the cut down version of

            /var/lib/dpkg/status

        below to your computer and


    2.) running debsecan at the command line

        $ debsecan


debsecan fails on my computer with

    $ debsecan
    Traceback (most recent call last):
      File "/usr/bin/debsecan", line 1370, in <module>
        rate_system(target, options, fetch_data(options, config), history)
      File "/usr/bin/debsecan", line 1287, in rate_system
        for pkg in packages:
      File "/usr/bin/debsecan", line 137, in __iter__
        line = self.file.readline()
               ^^^^^^^^^^^^^^^^^^^^
      File "<frozen codecs>", line 322, in decode
    UnicodeDecodeError: 'utf-8' codec can't decode byte 0xa3 in position 122: invalid start byte


Feel free to let me know if you happen to have any
questions or concerns.

Thanks,
Kingsley


##############################################################################
#
#   CUT DOWN VERSION OF /var/lib/dpkg/status STARTS
#
##############################################################################

Package: libharfbuzz0a
Status: deinstall ok config-files
Priority: optional
Section: libs
Installed-Size: 662
Maintainer: £Ø­Ù…د المحمودي (Ahmed El-Mahmoudy) <aelmahmoudy@sabily.org>
Architecture: i386
Multi-Arch: same
Source: harfbuzz
Version: 0.9.19-1
Config-Version: 0.9.19-1
Replaces: libharfbuzz0
Depends: libc6 (>= 2.4), libfreetype6 (>= 2.3.9), libglib2.0-0 (>= 2.30.0), libgraphite2-3 (>= 1.2.2)
Pre-Depends: multiarch-support
Breaks: libharfbuzz0
Description: OpenType text shaping engine (shared library)
 HarfBuzz is an implementation of the OpenType Layout engine (aka layout
 engine) and the script-specific logic (aka shaping engine).
 .
 This package contains the shared libraries.
Homepage: http://www.freedesktop.org/wiki/Software/HarfBuzz

##############################################################################
#
#   CUT DOWN VERSION OF /var/lib/dpkg/status STOPS
#
##############################################################################

* Kingsley G. Morse, Jr.:

The control file of the package has valid UTF-8, so something must
have happened to your version to /var/lib/dpkg/status.

Do you have anything on your system that depends on libharfbuzz0a?
Maybe you can just deinstall the package.

Hi Florian,

Thank you very, very much for your

    quick,
    clear,
    generous and
    smart

email.

All are fine qualities!

I

    am happy to report you helped me stop debsecan
    from crashing with

        root$ aptitude purge libharfbuzz0a xmovie

    think my /var/lib/dpkg/status file had
    non-utf-8 data because my computer still had
    configuration files for obsolete removed
    packages,

    found them with

        $ grep -B 10 -axv '.*' /var/lib/dpkg/status

    learned they're obsolete with

        $ apt-cache policy libharfbuzz0a:i386 xmovie

    and revealled their configuration files with

        $ dpkg -l libharfbuzz0a xmovie


I wonder if line 137 in __iter__ of
/usr/bin/debsecan could have a nice python "try
block" added around it to

    check for errors,

    report which package in /var/lib/dpkg/status
    crashed it and

    make the important package debsecan more
    resilient.

Thanks again Florian.

Your help was cool.

Kind regards,
Kingsley