[Debconf-devel] Bug#636219: How can we quote # in a value passed to debconf-set-selections?

[Steven Chamberlain]

Hi,

On 26/03/12 19:27, Joey Hess wrote:
> How do you know that Squeeze users are not depending on preseed files
> with embedded comments in production?

Yes that could be a problem, but according to the manual of the version
in Squeeze it seems that embedded comments should not have been allowed.
 From debconf-set-selections(1):

> DATA FORMAT
>        The data is a series of lines. Lines beginning with a # character are
>        comments. Blank lines are ignored. All other lines set the value...

On the other hand, there are some packages that do expect to be able to
use a literal '#' in preseed files.  Which is how #589519, #636219 and
#665696 came to be.


> AFAIK, a crypted password string will not contain a `#`.

It seems Debian Edu were using the raw passwords, which is why.  That in
itself is probably bad, and should be reconsidered...

> Also, d-i's password preseeding does not involve debconf's version
> of debconf-set-selections.

Maybe not for password entry, but there will be some questions asked
that allow free text input.

Is it possible that a '#' character might appear in a /dev/disk/by-id/
entry?  Or even in some filename?  (It may then get quoted as \# but
debconf would still truncate it).

Regards,
-- 
Steven Chamberlain
steven at pyro.eu.org