Hi,

rust-derivre 0.3.12-1 proudly declares in its debian/control:

    Section: FIXME-(packages."(name)".section)

which leads to a dsc file containing

    Package-List:
     derivre deb FIXME-(packages."(name)".section) optional arch=any
     librust-derivre-dev deb rust optional arch=any

I suspect that should be rejected earlier. You are in good company though,
the archive does not detect this either, and takes over the Package-List:
as a Binary tag into the Sources file -_- .

   Simon

Hi!

Yes, thanks for the report! This has been a common problem in dpkg,
where many things historically have not been validated, which means
we then get garbage/unexpected values. The problem is always when
introducing validation, where it breaks people's workflows. :/

I started a local branch with erroring in dpkg itself, and then also in
the various dpkg-dev tools, but I need to revisit the latter to centralize
the validation triggering point (so to do it during field transfer,
instead of having to call the validation functions explicitly all over
the place).

For now I've made the validators accept only:

  Section → ^[[:alnum:][:digit:]-]+$
  Priority → ^[[:alpha:]-]+$

But re-reading that now, I should probably disallow starting and ending
'-'. And I'm not sure whether these are going to be too strong anyway (I
suspect someone might be using weird values for these… :/ ).

Thanks,
Guillem

Hi,

FWIW my parser[1] uses /[a-z0-9-]+/ and has no other complaints on any
Packages or Sources file contained in the the current Release file.

I think /[a-z0-9]+(-[a-z0-9]+)*/ should also work, that also excludes
two consecutive dashes, or even /[a-z][a-z0-9]*(-[a-z][a-z0-9]*)*/ to
disallow leading digits.

Same for Priority, that can probably be limited to lowercase characters
as well.

    Simon

[1] https://git.sr.ht/~sjr/elim-debian/tree/main/item/pkglist.l