[SRU] Make sbuild usable for '<email address hidden>' users

[Carlos Nihelton]

[Impact]

With the increasing adoption of tools like authd, it's very likely that Linux desktop users in corporate environments end up with their usernames like '<email address hidden>', what doesn't play nice with sbuild/schroot. Without properly escaping the username, the '@' character ends up being interpreted as a string interpolation what breaks the lock_chroot() subroutine.

Fore more information about the issue, please check the upstream bug: https://salsa.debian.org/debian/sbuild/-/issues/4

[ Test plan ]

1. Make sure to have a user account containing the '@' character in its name, such as '<email address hidden>'.
2. Make sure to have a schroot environment ready. `mk-sbuild oracular` for example to create one for oracular. Note: the mk-sbuild command is provided by the ubuntu-dev-tools package, so make sure to have it installed.
3. Retrieve the sources of a simple package: `pull-lp-source hello noble`
4. Build the binary package with sbuild: `cd hello-2.10/ && sbuild -d noble-amd64` (adjust the schroot environment name according to your computer's architecture)

Expected results without the patches herein proposed is a failure like:

```
I: NOTICE: Log filtering will replace 'var/run/schroot/mount/plucky-amd64-c9a17ed0-5932-4df1-ad6e-d4df512a37b0' with '<<CHROOT>>'
Possible unintended interpolation of @org in string at -e line 50.
Global symbol "@org" requires explicit package name (did you forget to declare "my @org"?) at -e line 50.
Execution of -e aborted due to compilation errors.
E: Error locking chroot session: skipping livecd-rootfs
```

Building the package should proceed normally with the patches applied.

[ Where problems could occur ]

The scope of the changes herein proposed is so small and self-contained that I
don't expect any issues arising from it under any circumstances.

[ Other Info ]

I'm skipping 'Questing', as I expect it to receive the fix via debian merges,
sbuild version 0.89.2 (just accepted into Debian unstable) contains this patch (alongside other stuff).

[Carlos Nihelton (cnihelton)]

Here's the debdiff for plucky

[Carlos Nihelton (cnihelton)]

Here's the debdiff for oracular

[Carlos Nihelton (cnihelton)]

Here's the debdiff for noble.

[Christian Ehrhardt (paelzer)]

Merged upstream (=debian), needs a release name bump for questing but otherwise all of these look correct.
And they are more and more needed the more people bump into that using a laptop deployment making their user be <email address hidden> :-)

I'm not merging 0.89.2 as I'm no subject matter expert and the list 0.88.3->0.89.2 is many pages long.
But this fix as proposed make sense to be applied immediately.

While testing if this would build fine (or fall victim to massive perl changes) I was testing the very change already applying it manually on my noble system. Got it to work well - sbuild builds the pkg just fine now!

Double checked debdiff as git-ubuntu was down made me use some detours, all good.
Sponsoring for questing

[Christian Ehrhardt (paelzer)]

https://launchpad.net/ubuntu/+source/sbuild/0.88.3ubuntu3 is there now and started building - that is the ahrd pre-dep for an SRU.

Looking at SRUs ...

Setting plucky version to 0.88.3ubuntu2.1 for an SRU
=> All else was fine - sponsoring for Plucky

Oracular for the same rules needs to be 0.85.10ubuntu1.1
the former one should have been 0.1 but anyway - let us continue correctly from ubuntu1 to ubuntu1.1
(see https://github.com/canonical/ubuntu-maintainers-handbook/blob/main/VersionStrings.md if you ever struggle, I tried to put all conditions in one place)
It also missed to run update-maintainer
=> Both fixed up and sponsored for oracular

Noble also missed update-maintainer
Fixed and sponsored after double checking debdiff again
=> sponsored into Noble SRU unapproved queue

[Christian Ehrhardt (paelzer)]

Questing built in the meantime, hoping for a smooth transition.

N tested manually on my system - fix works fine.

N/O/P are now waiting in the unapproved queue for the SRU team.

[Timo Aaltonen (tjaalton)]

Hello Carlos, or anyone else affected,

Accepted sbuild into plucky-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/sbuild/0.88.3ubuntu2.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-plucky to verification-done-plucky. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-plucky. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Timo Aaltonen (tjaalton)]

An upload of sbuild to oracular-proposed has been rejected from the upload queue for the following reason: "d/changelog.rej cruft in the package".

[Timo Aaltonen (tjaalton)]

Hello Carlos, or anyone else affected,

Accepted sbuild into noble-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/sbuild/0.85.10ubuntu0.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-noble to verification-done-noble. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-noble. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Launchpad Janitor (janitor)]

This bug was fixed in the package sbuild - 0.88.3ubuntu3

---------------
sbuild (0.88.3ubuntu3) questing; urgency=medium

  [ Carlos Nihelton ]
  * chroot: Quote escape username to prevent unintended interpolation
    - make sbuild usable for '<email address hidden>' users (LP: #2109853)

 -- Carlos Nihelton <email address hidden> Fri, 02 May 2025 13:37:06 -0300

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted sbuild (0.85.10ubuntu0.2) for noble have finished running.
The following regressions have been reported in tests triggered by the package:

dgit/11.8 (ppc64el)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/noble/update_excuses.html#sbuild

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted sbuild (0.88.3ubuntu2.1) for plucky have finished running.
The following regressions have been reported in tests triggered by the package:

autopkgtest/5.47 (amd64, arm64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/plucky/update_excuses.html#sbuild

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Christian Ehrhardt (paelzer)]

Thank you Timo for accepting these.

In regard to the test reports, they both seem not to be due to this change.
- Noble is a Blocked write in autopkgtest-virt-ssh on ppc64
- Plucky is fauling autopkgtest tests itself, but both failed by nova errors in autopkgtest-virt-ssh

Sadly both look like infrastructure issues and for now I just restarted them.

[Christian Ehrhardt (paelzer)]

Sorry for the cruft that made it into the Oracular upload.
Thanks for spotting, I found it hiding in the debdiff and confirm my mistake.

I reworked it.

debdiff sbuild_0.85.10ubuntu1.dsc sbuild_0.85.10ubuntu1.1.dsc | diffstat
 debian/changelog | 8 ++++++++
 debian/control | 3 ++-
 lib/Sbuild/Chroot.pm | 2 +-
 3 files changed, 11 insertions(+), 2 deletions(-)

That looks more like it should be.
Uploaded again.

[Christian Ehrhardt (paelzer)]

The issue and fix is in
  libsbuild-perl: /usr/share/perl5/Sbuild/Chroot.pm
I had modified that to overcome the issue, but for verification I go back and test proposed.

$ dpkg --verify libsbuild-perl
??5?????? /usr/share/perl5/Sbuild/Chroot.pm
$ sudo apt install --reinstall libsbuild-perl
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 0 not upgraded.
Need to get 86.9 kB of archives.
After this operation, 0 B of additional disk space will be used.
Get:1 http://de.archive.ubuntu.com/ubuntu noble-updates/main amd64 libsbuild-perl all 0.85.10ubuntu0.1 [86.9 kB]
Fetched 86.9 kB in 0s (603 kB/s)
(Reading database ... 287078 files and directories currently installed.)
Preparing to unpack .../libsbuild-perl_0.85.10ubuntu0.1_all.deb ...
Unpacking libsbuild-perl (0.85.10ubuntu0.1) over (0.85.10ubuntu0.1) ...
Setting up libsbuild-perl (0.85.10ubuntu0.1) ...
$ dpkg --verify libsbuild-perl

Ok, back to the beginning, the issue is present

lappi 10:25:22 ~/work/qemu id
uid=1474078681(<email address hidden>) gid=1323124718(<email address hidden>) groups=1323124718(<email address hidden>),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),100(users),114(lpadmin),127(libvirt),131(sbuild)
lappi 10:25:23 ~/work/qemu DEB_BUILD_OPTIONS="parallel=12" sbuild -Adquesting-amd64 qemu_10.0.0+ds-2ubuntu1~questingppa4.dsc
sbuild (Debian sbuild) 0.85.10ubuntu0.1 (15 December 2024) on lappi

+================================================================================+
| qemu 1:10.0.0+ds-2ubuntu1~questingppa4 (amd64) Thu, 22 May 2025 08:25:28 +0000 |
+================================================================================+

Package: qemu
Version: 1:10.0.0+ds-2ubuntu1~questingppa4
Source Version: 1:10.0.0+ds-2ubuntu1~questingppa4
Distribution: questing-amd64
Machine Architecture: amd64
Host Architecture: amd64
Build Architecture: amd64
Build Type: binary

I: 01launchpad-chroot: [questing-amd64] Processing config
I: 01launchpad-chroot: [questing-amd64] Doesn't exist.
I: NOTICE: Log filtering will replace 'var/run/schroot/mount/questing-amd64-6a1d7c4a-d4ae-42cf-aeda-658446f36322' with '<<CHROOT>>'
Possible unintended interpolation of @canonical in string at -e line 50.
Global symbol "@canonical" requires explicit package name (did you forget to declare "my @canonical"?) at -e line 50.
Execution of -e aborted due to compilation errors.
Keeping session: questing-amd64-6a1d7c4a-d4ae-42cf-aeda-658446f36322
E: Error locking chroot session: skipping qemu

Testing from proposed

$ apt policy libsbuild-perl
libsbuild-perl:
  Installed: 0.85.10ubuntu0.1
  Candidate: 0.85.10ubuntu0.1
  Version table:
     0.85.10ubuntu0.2 100
        100 http://de.archive.ubuntu.com/ubuntu noble-proposed/main amd64 Packages
 *** 0.85.10ubuntu0.1 500
        500 http://de.archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     0.85.7 500
        500 http://de.archive.ubuntu.com/ubuntu noble/main amd64 Packages

Installing from proposed

lappi 10:28:37 ~/work/qemu sudo apt install libsbuild-...

[Christian Ehrhardt (paelzer)]

@Carlos - do you have a chance to verify plucky and once accepted oracular?