Dear Maintainer,

I get a false positive in debsums on a file with a space in the filename:

# debsums -a homegear-zigbee | grep bbaa
debsums: missing file /etc/homegear/devices/26/bbaaPlug (from homegear-zigbee package)
# grep bbaa /var/lib/dpkg/info/homegear-zigbee.list
/etc/homegear/devices/26/bbaaPlug 013.xml
# grep bbaa /var/lib/dpkg/info/homegear-zigbee.conffiles
/etc/homegear/devices/26/bbaaPlug 013.xml
# ll /etc/homegear/devices/26/bbaaPlug*
-rw-r--r-- 1 root root 12178 Okt  9 17:14 '/etc/homegear/devices/26/bbaaPlug 013.xml'
# dpkg-query -L homegear-zigbee |grep bbaa
/etc/homegear/devices/26/bbaaPlug 013.xml

Note that debsums reports a missing file "bbaaPlug", not "bbaaPlug 013.xml".
dpkg-query, on the other hand, correctly lists the filename.
Next, I tried to check it it is really the space that causes the problem:

# cp /etc/homegear/devices/26/bbaaPlug\ 013.xml /etc/homegear/devices/26/bbaaPlug
# debsums -a homegear-zigbee | grep bbaa
dpkg-query: no path found matching pattern /etc/homegear/devices/26/bbaaPlug

That's strange, I cannot explain that output. After some digging, I found /var/lib/dpkg/status.
And there we have:
# grep /etc/homegear/devices/26/bbaaPlug /var/lib/dpkg/status
 /etc/homegear/devices/26/bbaaPlug 013.xml 77462256c1635499de5b2ba4498243ad

I then altered the .list and .conffile

# grep bbaa /var/lib/dpkg/info/homegear-zigbee.list /var/lib/dpkg/info/homegear-zigbee.conffiles
/var/lib/dpkg/info/homegear-zigbee.list:/etc/homegear/devices/26/bbaaPlug
/var/lib/dpkg/info/homegear-zigbee.conffiles:/etc/homegear/devices/26/bbaaPlug

# dpkg-query -L homegear-zigbee |grep bbaa
/etc/homegear/devices/26/bbaaPlug

# /usr/bin/debsums -ex homegear-zigbee
debsums: changed file /etc/homegear/devices/26/bbaaPlug (observed:77462256c1635499de5b2ba4498243ad expected:013) (from homegear-zigbee package)

It seems that debsums does not process the status file correctly. It is confused by the space
in the filename and takes the part after the space as md5sum. In order to verify, I tried to
escape the space in the status file. I tried to quote the whole filename with " or ', or
escape the space with "\ " but to no avail. It really seems that debsums cannot handle spaces
while processing the status file.

I tried to fix it myself, but I'm not sure if this is correct:
--- /usr/bin/debsums.orig	2021-11-02 15:34:32.689829644 +0100
+++ /usr/bin/debsums	2021-11-02 16:49:18.669901591 +0100
@@ -264,7 +264,7 @@
             $package_name{$field{"Package"}} = $field{"binary:Package"};
         }
         $installed{$field{"binary:Package"}}{Conffiles} = {
-            map m!^\s*/(\S+)\s+([\da-f]+)!,
+            map m!^\s*/(.+)\s+([\da-f]+)!,
                 grep { not ($ignore_obsolete and / obsolete$/) }
                 split /\n/, $field{Conffiles}
         } if $field{Conffiles};

Hi Tom,

Tom wrote:

Thanks for the bug report!

Thanks for the example. But from where is that package? Doesn't seem
to be an official Debian package. Am I right, that the package is from
https://apt.homegear.eu/?

(Yes, I can construct a package with that characteristica, but being
able to work on the exactly same package might be easier.)

Not sure from a first glance either. This \S looks as if was there on
purpose. Will need a closer look.

		Regards, Axel

Hi Axel
deb https://apt.homegear.eu/Debian/ bullseye/

If the package itsself is responsible for the entries in
/var/lib/dpkg/status and if there is a way to escape a space, then the
bug should be filed against the package.

I'm not sure either. But if this regex is greedy, it will stop at the
first space. My version stops before the last space before the md5sum.
That being said, my version will also fail (as will the current version
of debsums) if:
- the name contains spaces and
- the last portion after a space contains digits and a-f
- there is no md5sum (which probably should not happen)

Cheers
Tom