Dear maintainers,

dcmd tries to parse the section field of changes file, instead of just
considering the line as fields of chars separated by spaces:

$ dcmd echo rust-rapidhash_4.4.1-1_i386-buildd.changes
/usr/bin/dcmd: 8: eval: Syntax error: "(" unexpected

$ grep -A4 ^Files rust-rapidhash_4.4.1-1_i386-buildd.changes
Files:
 63a73cd832acc126a809fded50a548bc 44740 rust optional librust-rapidhash-dev_4.4.1-1_i386.deb
 de2e65607feb01341c493430a8bf3804 1909252 debug optional rapidhash-dbgsym_4.4.1-1_i386.deb
 3df3a8a3c0aedcb8c243d6c37b5e3680 190632 FIXME-(packages."(name)".section) optional rapidhash_4.4.1-1_i386.deb
 2f46a6b1f97bdb5e4ab63b98db0d0d2d 7230 rust optional rust-rapidhash_4.4.1-1_i386-buildd.buildinfo

The section is definitely broken, but that should just be ignored by
dcmd which has no use for that field.

Note that's not a theoretical issue, such package exists in the archive.
The changes file can be fetched from [1] and the source package from
[2].

Regards
Aurelien

[1] https://buildd.debian.org/status/fetch.php?pkg=rust-rapidhash&arch=i386&ver=4.4.1-1&stamp=1780658005&raw=0
[2] https://snapshot.debian.org/archive/debian-debug/20260605T142719Z/pool/main/r/rust-rapidhash/rust-rapidhash_4.4.1-1.dsc

Hi,

I may have missed it, but I did not find an easy way to avoid expansions
in current shell script implementation of dcmd.

I started playing with a perl implementation and seems I got something
that is apparently working. It is by far not the best perl you can find
(I wrote it ;-)), but seems to work.

In its current shape it adds some control on allowed extensions and avoids
expansions. (Checked listing "$(id)".deb, all other commands skip it as it
does not exists). It has an additional --debug option I used when writing
things.

Feel free to use it if you find it useful in some way (let me know if you
think is better to use GPL2+), as a proof of concept or whatever else.

Hope this helps,