Bug#1008773: ftpsync: Using commands with parameters as hooks breaks ftpsync on bullseye/debian 11

[Raphaël Hertzog]

Package: ftpsync
Version: 20180513+nmu1
Severity: important
User: de...@kali.org
Usertags: origin-kali
X-Debbugs-Cc: her...@debian.org
Control: affects -1 mirrors

In Kali we have started to switch some mirrors to Debian 11 and ftpsync
started to fail with errors like this:

Apr 01 06:19:32 poseidon ftpsync-kali[191329]: Mirrorsync start
Apr 01 06:19:32 poseidon ftpsync-kali[191329]: We got pushed from 192.99.45.140
/home/archvsync/bin/ftpsync: line 276: local: `--regex=^.*\.hook1$': not a valid identifier
/home/archvsync/bin/ftpsync: line 276: local: `--arg=kali': not a valid identifier
/home/archvsync/bin/ftpsync: line 276: local: `/home/archvsync/hooks': not a valid identifier
Apr 01 06:19:32 poseidon ftpsync-kali[191329]: Mirrorsync done with errors

Our ftpsync.conf contains entries like this:

## Configure hooks
HOOK1="run-parts --regex=^.*\\.hook1\$ --arg=kali /home/archvsync/hooks"
HOOK2="run-parts --regex=^.*\\.hook2\$ --arg=kali /home/archvsync/hooks"
HOOK3="run-parts --regex=^.*\\.hook3\$ --arg=kali /home/archvsync/hooks"
HOOK4="run-parts --regex=^.*\\.hook4\$ --arg=kali /home/archvsync/hooks"
HOOK5="run-parts --regex=^.*\\.hook5\$ --arg=kali /home/archvsync/hooks"

From a quick glance, it looks like the bash version in bullseye doesn't
like some construct. Here's a minimal reproducer:

$ cat ~/tmp/test.sh
#!/bin/bash

set -e
set -u
set -E

hook () {
ARGS='HOOK[@]'
local "${!ARGS}"
echo "HOOKSCR='$HOOKSCR'"
}

HOOK1="run-parts --regex=^.*\\.hook1\$ --arg=kali /home/archvsync/hooks"

HOOK=(
HOOKNR=1
HOOKSCR=${HOOK1}
)
hook $HOOK

In buster it works fine:
$ bash ~/tmp/test.sh
HOOKSCR='run-parts --regex=^.*\.hook1$ --arg=kali /home/archvsync/hooks'
$ echo $?

0

In bullseye it fails:
$ bash ~/tmp/test.sh
/home/rhertzog/tmp/test.sh: line 9: local: `--regex=^.*\.hook1$': not a valid identifier
/home/rhertzog/tmp/test.sh: line 9: local: `--arg=kali': not a valid identifier
/home/rhertzog/tmp/test.sh: line 9: local: `/home/archvsync/hooks': not a valid identifier
$ echo $?
1

It seems that you can quote the variable assignation for HOOKSCR and it
works again:
HOOK=(
HOOKNR=1
HOOKSCR="${HOOK1}"
)

$ bash ~/tmp/test.sh
HOOKSCR='run-parts --regex=^.*\.hook1$ --arg=kali /home/archvsync/hooks'

-- System Information:
Debian Release: bookworm/sid
APT prefers stable-security
APT policy: (500, 'stable-security'), (500, 'oldoldstable'), (500, 'unstable'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.16.0-5-amd64 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages ftpsync depends on:
ii postfix [mail-transport-agent] 3.6.4-1+b1
ii rsync 3.2.3-8

Versions of packages ftpsync recommends:
ii curl 7.82.0-2

ftpsync suggests no packages.

-- no debconf information

[Raphael Hertzog]

Control: tags -1 + patch

I have prepared a merge request with a fix for this issue:
https://salsa.debian.org/mirror-team/archvsync/-/merge_requests/4

(Note that there's another outstanding merge request there that you might
want to merge too)

I'm attaching the patch as well.
--
⢀⣴⠾⠻⢶⣦⠀ Raphaël Hertzog <her...@debian.org>
⣾⠁⢠⠒⠀⣿⡁
⢿⡄⠘⠷⠚⠋ The Debian Handbook: https://debian-handbook.info/get/
⠈⠳⣄⠀⠀⠀⠀ Debian Long Term Support: https://deb.li/LTS