#1129961 /usr/bin/dput: local install method ignores errors from install(8)

Package:
dput-ng
Source:
dput-ng
Submitter:
Ian Jackson
Date:
2026-04-14 13:53:02 UTC
Severity:
normal
Tags:
#1129961#5
Date:
2026-03-06 17:15:40 UTC
From:
To:
Steps:

Run dput-ng with
   method                  = local
   incoming                = a mode 555 directory

Expected results:

Error message(s) on stderr and a nonzero exit status.

Actual results:

Reports of successful upload, a zero exit status,
but nothing has actually been copied.

I have verifed with strace that
  - dput-ng has swallowed the stderr from install(8)
  - install(8) exited nonzero
  - dput-ng ignored this

Transcript below.

I have a git branch in which I try to fix this.
I will make an MR on Salsa.

Ian.

zealot:bpd> cat ../dput.cf
[test-dummy]
method                  = local
incoming                = /home/ian/things/Dgit/dgit/tests/tmp/push-retries/incoming
run_dinstall            = 0
zealot:bpd> ll ../incoming/
total 8
dr-xr-xr-x  2 ian ian 4096 Mar  6 17:04 ./
drwxrwxr-x 12 ian ian 4096 Mar  6 17:05 ../
zealot:bpd> dput --unchecked --config=/home/ian/things/Dgit/dgit/tests/tmp/push-retries/dput.cf test-dummy /home/ian/things/Dgit/dgit/tests/tmp/push-retries/bpd/example_1.0_source.changes
Uploading example using local to test-dummy (host: test-dummy; directory: /home/ian/things/Dgit/dgit/tests/tmp/push-retries/incoming)
running allowed-distribution: check whether a local profile permits uploads to the target distribution
running checksum: verify checksums before uploading
running suite-mismatch: check the target distribution for common errors
running gpg: check GnuPG signatures before the upload
Not checking GPG signature due to allow_unsigned_uploads being set.
Uploading example_1.0.dsc
Uploading example_1.0.tar.gz
Uploading example_1.0_source.changes
zealot:bpd> echo $?
0
zealot:bpd> ll ../incoming/
total 8
dr-xr-xr-x  2 ian ian 4096 Mar  6 17:04 ./
drwxrwxr-x 12 ian ian 4096 Mar  6 17:05 ../
zealot:bpd>

#1129961#10
Date:
2026-03-06 17:31:08 UTC
From:
To:
Hi.  Here's that MR:

https://salsa.debian.org/debian/dput-ng/-/merge_requests/47

Thanks for your attention.

Ian.

#1129961#15
Date:
2026-04-14 13:26:06 UTC
From:
To:
Hello,

Bug #1129961 in dput-ng reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/dput-ng/-/commit/3d9c5d6e03f266764a7cfd7c200dca2105321512
------------------------------------------------------------------------
local uploader: Fix silent lossage bug

Every call site of dput.util.run_command, except this one, checks the
exit status.

Delete the commented-out exit status check in run_command, and replace
it with:
  - the missing exit status check in local.py
  - documentation saying that the caller must check the exit status
  - A TODO complaining that this is a bad API

Closes: #1129961
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1129961

#1129961#26
Date:
2026-04-14 13:51:59 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
dput-ng, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1129961@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Colin Watson <cjwatson@debian.org> (supplier of updated dput-ng package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 14 Apr 2026 14:31:24 +0100
Source: dput-ng
Architecture: source
Version: 1.45
Distribution: unstable
Urgency: medium
Maintainer: dput-ng Maintainers <dput-ng@packages.debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Closes: 1129961
Changes:
 dput-ng (1.45) unstable; urgency=medium
 .
   [ Ian Jackson ]
   * local uploader: Don't ignore errors from install(8) (closes: #1129961).
Checksums-Sha1:
 da3a078a17a1fd28583acec2d3164d0b2d8906f5 2494 dput-ng_1.45.dsc
 266a9a024234c2c56f85661c663910bb78b9fddf 89964 dput-ng_1.45.tar.xz
 fe343f1a5c08a7ea5a7c19562268bf86d3bf9b4c 191340 dput-ng_1.45.git.tar.xz
 45fe733d793efa9aa1a616b539851c2629e1d47c 17322 dput-ng_1.45_source.buildinfo
Checksums-Sha256:
 ec13b4cb4043f95f5424b59f6d939a76667dd6e75e4bef725064d49abb07289e 2494 dput-ng_1.45.dsc
 0854f3128e37d3d56f245691dac908e29abcdb4c23dbac958396022743b702e0 89964 dput-ng_1.45.tar.xz
 7e12fed5686a198fa449e6c327281325ec64cf21c73461f222fd804149fe2f4c 191340 dput-ng_1.45.git.tar.xz
 40d1a0cc45c81aac75833e64969546c7581c464022d1e82bc78aac9b5a848105 17322 dput-ng_1.45_source.buildinfo
Files:
 67b591c6d9b44b19a539dda7065d5bb3 2494 devel optional dput-ng_1.45.dsc
 be19794a241470faa55f9f6b9502f6ae 89964 devel optional dput-ng_1.45.tar.xz
 2edbe1ea07cc25e19fdfa4f34e491612 191340 devel optional dput-ng_1.45.git.tar.xz
 01f50c0b4f049381b77e2891a5a231d3 17322 devel optional dput-ng_1.45_source.buildinfo
Git-Tag-Info: tag=afbd4bcd3dd58e09b1f9ce931cd24b2b854b6c95 fp=ac0a4ff12611b6fccf01c111393587d97d86500b
Git-Tag-Tagger: Colin Watson <cjwatson@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmneQkwACgkQYG0ITkaD
wHmsrw//UIscPmipRB9bXlw0BZOLEL1ftuDwjOhQPKS0FWNJy3VlZxPKsKXSXSEo
MO0pISdXbtZ9MA93JmlKoXC9dYbTYlFkObaU06LZqO4ZlkpA7uV18Qm/PKs0H8lu
Yf1S7X5NMaWS50+kh3SlO4hJyWCWaJ0dD+8xkeQOHYmhBNL0MXrqQXhjelMvtwjO
+4nPTX8hbqmiG4rPsRFicfWTt5IBASKLq3IkZwtYXJWZ33sWKruVIlps76yhAkAn
3Jl1elFY/JhcX43GwS9BO9pNYtkh9Pim0LrWbHtcX9qzQG//WDPB1oS+m4WyUpba
5Stwx0ZZ7ZZ6DU42Ew16a800IHQqTBQMtuPD4P199YVlENRm3E8bxaGdW16XNUoX
8RgpcDaNnE8O9lrnEavFMKyJfhypBmLhWISCmDFfR8o9aXM0Rp5Nm7EL/ERli42X
7xrnfrdVOsq8PiBI8QAwJIpvX873L5+Yhv5Lw9oM+1ycX0sPDyEGuDVjGrdjo93D
9qcyyS56am0ZEjKpgik/etXdsxqOJs4yxGjA1UOlew2ZYpJrC+/vTVgcEIKyp/kz
b0AyRYrOLY6I2jM2rO9fUqc5fpqj/XxvNZ9IJ/wMZ6ubW2bUR4u5Uk2l3Gv4ITmG
bkVN8N4ekAsWCDfh2S6Tuh3awTp6H2BYRFUv8yxD9Kx7qgZWYp8=
=wWHR
-----END PGP SIGNATURE-----