Dear Maintainer,
10_aide_os-release turns VERSION_CODENAME into part of a macro name:
_codename_uc="$(echo "$OS_RELEASE_VERSION_CODENAME" | tr '[:lower:]'
'[:upper:]')"
printf '@@define OS_RELEASE_VERSION_CODENAME_%s %s\n' "${_codename_uc}"
"${_codename_uc}"
The codename is only upper-cased, not sanitized. On a derivative whose
codename contains a hyphen, such as Kali (VERSION_CODENAME=kali-rolling,
also
kali-last-snapshot), the generated line is
@@define OS_RELEASE_VERSION_CODENAME_KALI-ROLLING KALI-ROLLING
and AIDE rejects the whole configuration:
ERROR: /etc/aide/aide.conf.d/10_aide_os-release (stdout):1: syntax error,
unexpected group name, expecting end of file (line: '@@define
OS_RELEASE_VERSION_CODENAME_KALI-ROLLING KALI-ROLLING')
As a result, aide --check, --init and dailyaidecheck all stop working on
those systems. Debian's own codenames (trixie, forky, sid) are not affected.
Combined with #1127751, the daily check can fail without anyone noticing.
The same thing happens with any codename containing characters that are not
valid in a macro name (for example "1.0-beta"). The other OS_RELEASE_*
fields
are not affected because they only appear as macro values.
Steps to reproduce (any system with aide-common 0.19.5-1):
1. printf 'ID=test\nVERSION_CODENAME=kali-rolling\n' > /tmp/os-release
2. sed 's|^import_file /etc/os-release|import_file /tmp/os-release|' \
/usr/share/aide/config/aide/aide.conf.d/10_aide_os-release > /tmp/gen.sh
3. sh /tmp/gen.sh | grep CODENAME_ > /tmp/out.conf
4. printf '@@x_include /tmp/out.conf\n/x p\n' > /tmp/t.conf
5. aide -c /tmp/t.conf --config-check -> syntax error as above
(Remove /usr/lib/os-release and /etc/initrd-release from the script too if
they set a different codename on the test machine.)
The script is unchanged in 0.19.5-2 (unstable, 28 Oct 2026), so the bug is
still present there.
Proposed fix: map every character that is not valid in a macro name to "_".
I tested it with dash and bash against kali-rolling, kali-last-snapshot,
trixie, an empty codename and 1.0-beta. aide --config-check accepts all of
them, and the output for Debian codenames is identical to before. Nothing
else in aide-common references OS_RELEASE_VERSION_CODENAME_*, so renaming
KALI-ROLLING to KALI_ROLLING breaks nothing.
--- a/usr/share/aide/config/aide/aide.conf.d/10_aide_os-release
+++ b/usr/share/aide/config/aide/aide.conf.d/10_aide_os-release
@@ -32,7 +32,7 @@
fi
fi