#1149032 does not reject invalid sections and copies them to Sources file

#1149032#5
Date:
2026-09-26 06:47:31 UTC
From:
To:
Hi,

rust-derivre 0.3.12-1 proudly declares in its debian/control:

    Section: FIXME-(packages."(name)".section)

which leads to a dsc file containing

    Package-List:
     derivre deb FIXME-(packages."(name)".section) optional arch=any
     librust-derivre-dev deb rust optional arch=any

which is taken over into the Sources index verbatim.

   Simon
-----BEGIN PGP SIGNATURE-----

iQFDBAEBCgAtFiEEtjuqOJSXmNjSiX3Tfr04e7CZCBEFAmq3aoMPHHNqckBkZWJp
YW4ub3JnAAoJEH69OHuwmQgR1VAH/jnYZJL6FOucZgtriYlIuaO9wMsk+Exkb1NP
LP4qDUQ3ErvYfx8rTiT9TFePphoL7P5uQfi1YnCz1k8ikGk7txiJF3R2HTZYdVYa
doflt8auysWlftagShBQVnxAyBXjxEdABvxY62j3BgPf7CW/JgWe2cHCDW7CTAGl
gD2Ao6j1zd0ABlkSEa+l4ijSPXRIBqGpvZl9DHv6y+AWKzUfTiUWGRZ15oePkTpc
iCGwVkXmkrKxffnAJMVG5SEK12TSjx3qh9ioRJgoLdppS9NOxelhCjixvg8Sf6rm
+nUX2jtOTJY5iQ6R4WWmyNIBhjdjgnp6CkvOf9BUMD7hBLJKQ3I=
=T08q
-----END PGP SIGNATURE-----

#1149032#10
Date:
2026-09-26 07:45:40 UTC
From:
To:
Control: tag -1 + wontfix

The archive uses either the value provided as an override or falls back
to the value provided by the package. That works as intended.

In the past, the NEW process did only add valid overrides, but that
process was abandoned in favor of no longer checking this by a previous
project leader.

Ansgar

#1149032#15
Date:
2026-09-28 04:30:43 UTC
From:
To:
Hi,

My point is that this value should still follow the section naming
rules. There's no reason why quotation marks or parentheses should ever
show up in a section name, and I don't believe there's any plan to use
uppercase characters or dots.

In my parser, I use a /[a-z0-9-]+/ regex, and this is the only instance
I've seen that fails that test, so that would be an easy way to check,
or maybe /[a-z0-9]+(-[a-z0-9]+)*/ to also make sure the first and last
character isn't a dash and there are no two consecutive dashes.

This should have been caught way earlier, before it even reaches the
archive, but I think the archive should really make sure the generated
package lists are well-formed.

    Simon