Merge ~iconstantin/ubuntu-security-tools:master into ubuntu-security-tools:master

[Ian Constantin]

Added surrounding quotes when echoing $rmadout (in package-tools/check-source-package) to preserve new lines for following grep operations.

~rodrigo-zaiden found `umt check` incorrectly failing for an update, with the root cause traced to UST/package-tools/check-source-package which is called by umt.

At one point in the script, variable rmadout may be set via:

     rmadout=$(/usr/bin/apt-cache madison $package)

In several potential operations later, rmadout is parsed via grep to produce a value for rmadoutrel (and at times intermediately for tmp). The issue is that when echoing $rmadout and piping to grep, if $rmadout is not surrounded by quotes, new lines are not preserved resulting in incorrect output.

e.g.

     $ package=cpanminus
     $ /usr/bin/apt-cache madison $package

Results to the following:

     cpanminus | 1.7044-2 | http://us.archive.ubuntu.com/ubuntu hirsute/universe amd64 Packages
     cpanminus | 1.7044-2 | http://us.archive.ubuntu.com/ubuntu hirsute/universe i386 Packages
     cpanminus | 1.7044-2 | http://archive.ubuntu.com/ubuntu impish/universe Sources
     cpanminus | 1.7001-1 | http://archive.ubuntu.com/ubuntu trusty/universe Sources
     cpanminus | 1.7040-1 | http://archive.ubuntu.com/ubuntu xenial/universe Sources
     cpanminus | 1.7043-1 | http://archive.ubuntu.com/ubuntu bionic/universe Sources
     cpanminus | 1.7044-1 | http://archive.ubuntu.com/ubuntu focal/universe Sources
     cpanminus | 1.7044-2 | http://archive.ubuntu.com/ubuntu groovy/universe Sources
     cpanminus | 1.7044-2 | http://archive.ubuntu.com/ubuntu hirsute/universe Sources
     cpanminus | 1.7044-2 | http://deb.debian.org/debian unstable/main Sources
     cpanminus | 1.7044-2 | http://deb.debian.org/debian testing/main Sources
     cpanminus | 1.7044-1 | http://deb.debian.org/debian buster/main Sources
     cpanminus | 1.7042-2 | http://deb.debian.org/debian stretch/main Sources
     cpanminus | 1.7014-1 | http://archive.debian.org/debian jessie/main Sources

If we instead assign the output to rmadout:

     rmadout=$(/usr/bin/apt-cache madison $package)

And echo $rmadout without quotes:

     $ echo $rmadout

We get:

cpanminus | 1.7044-2 | http://us.archive.ubuntu.com/ubuntu hirsute/universe amd64 Packages cpanminus | 1.7044-2 | http://us.archive.ubuntu.com/ubuntu hirsute/universe i386 Packages cpanminus | 1.7044-2 | http://archive.ubuntu.com/ubuntu impish/universe Sources cpanminus | 1.7001-1 | http://archive.ubuntu.com/ubuntu trusty/universe Sources cpanminus | 1.7040-1 | http://archive.ubuntu.com/ubuntu xenial/universe Sources cpanminus | 1.7043-1 | http://archive.ubuntu.com/ubuntu bionic/universe Sources cpanminus | 1.7044-1 | http://archive.ubuntu.com/ubuntu focal/universe Sources cpanminus | 1.7044-2 | http://archive.ubuntu.com/ubuntu groovy/universe Sources cpanminus | 1.7044-2 | http://archive.ubuntu.com/ubuntu hirsute/universe Sources cpanminus | 1.7044-2 | http://deb.debian.org/debian unstable/main Sources cpanminus | 1.7044-2 | http://deb.debian.org/debian testing/main Sources cpanminus | 1.7044-1 | http://deb.debian.org/debian buster/main Sources cpanminus | 1.7042-2 | http://deb.debian.org/debian stretch/main Sources cpanminus | 1.7014-1 | http://archive.debian.org/debian jessie/main Sources

Versus, if we use quotes:

     $ echo "$rmadout"

We get the desired output in which new lines are preserved:

 cpanminus | 1.7044-2 | http://us.archive.ubuntu.com/ubuntu hirsute/universe amd64 Packages
 cpanminus | 1.7044-2 | http://us.archive.ubuntu.com/ubuntu hirsute/universe i386 Packages
 cpanminus | 1.7044-2 | http://archive.ubuntu.com/ubuntu impish/universe Sources
 cpanminus | 1.7001-1 | http://archive.ubuntu.com/ubuntu trusty/universe Sources
 cpanminus | 1.7040-1 | http://archive.ubuntu.com/ubuntu xenial/universe Sources
 cpanminus | 1.7043-1 | http://archive.ubuntu.com/ubuntu bionic/universe Sources
 cpanminus | 1.7044-1 | http://archive.ubuntu.com/ubuntu focal/universe Sources
 cpanminus | 1.7044-2 | http://archive.ubuntu.com/ubuntu groovy/universe Sources
 cpanminus | 1.7044-2 | http://archive.ubuntu.com/ubuntu hirsute/universe Sources
 cpanminus | 1.7044-2 | http://deb.debian.org/debian unstable/main Sources
 cpanminus | 1.7044-2 | http://deb.debian.org/debian testing/main Sources
 cpanminus | 1.7044-1 | http://deb.debian.org/debian buster/main Sources
 cpanminus | 1.7042-2 | http://deb.debian.org/debian stretch/main Sources
 cpanminus | 1.7014-1 | http://archive.debian.org/debian jessie/main Sources

Which is important for the following grep operations to work correctly.

[Alex Murray (alexmurray)]

LGTM! Thanks.

review: Approve

[Alex Murray (alexmurray)]

I have merged this and pushed it to master.

diff --git a/package-tools/check-source-package b/package-tools/check-source-package
index 3892a96..82d5f1b 100755
--- a/package-tools/check-source-package
+++ b/package-tools/check-source-package
@@ -1520,19 +1520,19 @@ else
     if [ "$pkg_dist" == "precise" ] || [ "$pkg_dist" == "trusty" ] || [ "$pkg_dist" == "xenial" ]; then
         # TODO: fix this through lp api, but for now this workaround fix the precise issue
         rmadout=$(/usr/bin/apt-cache madison $package)
-        tmp=$(echo $rmadout | grep "ubuntu-esm" | grep "$pkg_dist" || true)
+        tmp=$(echo "$rmadout" | grep "ubuntu-esm" | grep "$pkg_dist" || true)
         # if the pkg is not in -esm yet, try to get the prev-ppa
         if [ -z "$tmp" ]; then
-            tmp=$(echo $rmadout | grep "$pkg_dist" || true)
+            tmp=$(echo "$rmadout" | grep "$pkg_dist" || true)
         fi
         rmadoutrel=$tmp
     elif [ "$force_rmadison" != "yes" ] && [ -x "$UQT/security-tools/lpmad" ]; then
         rmadout=$($UQT/security-tools/lpmad "$package" || true)
-        rmadoutrel=$(echo $rmadout | grep "$pkg_dist" | grep "^$package" | grep -v " | ${pkg_dist}-backports" || true)
+        rmadoutrel=$(echo "$rmadout" | grep "$pkg_dist" | grep "^$package" | grep -v " | ${pkg_dist}-backports" || true)
     else
         rmadout=$(rmadison "$package")
         # it's ok if the package doesn't exist yet
-        rmadoutrel=$(echo $rmadout | grep -E " ${pkg_dist}(-[a-z]+)?(/[a-z]+)? ") || true
+        rmadoutrel=$(echo "$rmadout" | grep -E " ${pkg_dist}(-[a-z]+)?(/[a-z]+)? ") || true
     fi
 fi
 if [ -z "$rmadoutrel" ]; then