debsign --debs-dir is broken due to incorrectly added quotes

[Steve Beattie]

debsign from devscripts in precise has broken the --debs-dir option:

  $ ls -ld ../source
  drwxrwxr-x 2 steve steve 4096 Mar 27 23:12 ../source
  $ debsign --debs-dir ../source
 debsign: could not find directory "../source"!

strace'ing debsign shows it trying to do:

  15372 stat("\"../source\"", 0x7fffbbc3bba0) = -1 ENOENT (No such file or directory)

(notice the extra \" in there.)

Looking at the source, when handling the option, it does the following:

        --debs-dir)
            shift
            opt_debsdir="$(echo \"${1%/}\" | sed -e 's%/\+%/%g')"

note that this is slightly different than how the default directory is generated

  DEBRELEASE_DEBS_DIR="`echo \"$DEBRELEASE_DEBS_DIR\" | sed -e 's%/\+%/%g; s%\(.\)/$%\1%;'`"

in that the latter uses shell backticks rather than $() to run subcommands. This will behave differently, at least under dash:

$ cat dash.sh
#!/bin/sh

FOO="$(echo \"foo bar\")"
BAR="`echo \"foo bar\"`"

$ sh -xe dash.sh
+ echo "foo bar"
+ FOO="foo bar"
+ echo foo bar
+ BAR=foo bar

Bash behaves similarly. Changing the opt_debsdir definition line to the following:

  opt_debsdir="$(echo "${1%/}" | sed -e 's%/\+%/%g')"

(i.e. removing the backslash escaping of ") causes things to work as expected.

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: devscripts 2.11.4ubuntu1
ProcVersionSignature: Ubuntu 3.2.0-17.27-generic 3.2.6
Uname: Linux 3.2.0-17-generic x86_64
ApportVersion: 1.95-0ubuntu1
Architecture: amd64
CheckboxSubmission: 9c15077a0ca11678d04e060687c26674
CheckboxSystem: 5dc75472945f57d094b84e90feb97396
Date: Tue Mar 27 23:05:42 2012
InstallationMedia: Ubuntu 11.04 "Natty Narwhal" - Release amd64 (20110426)
ProcEnviron:
 TERM=screen
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: devscripts
UpgradeStatus: Upgraded to precise on 2012-01-30 (57 days ago)

[Steve Beattie (sbeattie)]

Note that this same problematic code exists in debian's devscripts 2.11.5 version.

[Steve Beattie (sbeattie)]

And here's a debdiff, in case somebody would like to sponsor this.

[Benjamin Drung (bdrung)]

Note that devscripts is seeded on some CDs.

[Jani Monoses (jani)]

Steve, can you update the debdiff to pick the exact commit from Debian's git tree? It has an extra line fixed..the changelog then needs to be reworded to reflect it's coming from upstream. Thank you.

[Launchpad Janitor (janitor)]

This bug was fixed in the package devscripts - 2.11.6ubuntu1

---------------
devscripts (2.11.6ubuntu1) precise; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Demote Recommends to Suggests:
      + libcrypt-ssleay-perl: only needed for a corner case (uscan on SSL
        download sites), wasn't installed by default in previous releases
        either, and seems quite dead upstream; universe only.
      + debian-keyring: not useful enough in Ubuntu; universe only.
      + equivs: too much of a hack to install by default; universe only.
      + libsoap-lite-perl: only needed for one less common command ("select")
        for bts, which isn't useful for Ubuntu itself, and pulls in a lot of
        other universe Perl libraries; universe only.
    - scripts/debchange.{pl,1}:
      + Adjust --security template for Ubuntu.
      + Add -U/--upstream flag that forces original "just increment
        the end" behaviour; Ubuntu is upstream for some pieces of software.
      + Add --distributor= and DEBCHANGE_DISTRIBUTOR to override lsb_release
        output.
      + Default to "precise" as distribution.
      + Add "ubuntu1" to version string for new versions, with tweaks for
        special cases.
      + Add -R/--rebuild flag for Ubuntu's no-change rebuilds.
      + Don't use the last distribution in debian/changelog when doing
        "dch -r" on Ubuntu. "Just because it was last uploaded to jaunty
        doesn't mean that's the right thing to do now."
    - Add test/debchange.pl, test/Makefile: debchange test suite.
    - Rename XS-Vcs-* to XS-Debian-Vcs-*.

devscripts (2.11.6) unstable; urgency=low

  [ James McCoy ]
  * mk-build-deps: Fix handling of debian/control files. (Closes: #665496)
  * uscan: Fix formatting in man page. Thanks to Samuel Bronson for the
    patch. (Closes: #665325)
  * debsign: Fix quoting in handling of --debs-dir.
    (Closes: #666048, LP: #966867)

  [ Benjamin Drung ]
  * cowpoke.1, deb-reversion.dbk, dscextract.1: Fix typos "occured",
    "transfered", and "addtional". Thanks to A. Costa for the patches.
    (Closes: #655681)
  * debcommit:
    + Subversion 1.7 has only one .svn folder per working copy.
      Thanks to Simon Olofsson for the patch. (Closes: #645106)
    + Support .hg in parent directories.
      Thanks to Simon Olofsson for the patch. (Closes: #652967)

  [ David Prévot ]
  * Typo and stylish fix for dscextract(1). (Closes: #630423)

devscripts (2.11.5) unstable; urgency=low

  [ Adam D. Barratt ]
  * deb-reversion:
    + Re-fix handling of multi-word hooks. (Closes: #660782).
      This was originally fixed in 2.9.14 but accidentally broken again in
      2.9.26.
    + Correctly handle cases where a changelog file was not found, possibly
      because of the use of symlinks. (Closes: #660788)

  [ Jakub Wilk ]
  * deb-reversion: Simplify option parsing, also allowing simpler quoting of
    arguments.

  [ James McCoy ]
  * dd-list: Fix correlation of given package name when it does not match the
    source package name. (Closes: #655854)
  * dcmd: Escape directory name so it doesn't interfere with sed command.
    (Closes: #649227)
  * debsnap: Check whether architect...