| Description | somehow you all managed to reintroduce a bug, please see the bottom for the test case.
TL;DR: dpkg is supposed to support process substitution/unnamed pipes.
apt-get download -o Dir::Cache::archives="./" --print-uris dpkg | awk -F\' '{print $2}' | xargs -I '{}' curl '{}' -skL| dpkg-deb -c -
dpkg 1.23.7+kali1
into Kali Rolling on April 7, 2026.
That is exactly the affected release.
Debian finally released:
dpkg 1.23.8
on September 7, 2026, and its changelog explicitly contains:
- dpkg-deb: Do not fail on non-seekable archives. Closes: #1132051
As of the current Kali package tracker data, Kali Rolling is still showing:
Kali Rolling: 1.23.7+kali1
Debian Testing: 1.23.7
This is an automated email from the git hooks/post-receive script.
guillem pushed a commit to branch main
in repository dpkg.
View the commit online:
https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=a658782c1af35da6620b2eb05b90faaf8ab4b10e
commit a658782c1af35da6620b2eb05b90faaf8ab4b10e
Author: Guillem Jover <[email protected]>
AuthorDate: Thu Jun 11 05:19:11 2026 +0200
dpkg-deb: Do not fail on non-seekable archives
We have documented that we support non-seekable archives for some time,
and this was a regression introduced in 1.23.7. Disable the robustness
check if the input is not seekable.
Add regression tests to avoid this happening in the future.
Fixes: commit 7d54287521ac4e1b2061d4a92467c634525436d3
Closes: #1132051
---
lib/dpkg/ar.c | 1 +
lib/dpkg/ar.h | 1 +
src/Makefile.am | 1 +
src/at/deb-streaming.at | 44 ++++++++++++++++++++++++++++++++++++++++++++
src/at/testsuite.at | 1 +
src/deb/extract.c | 3 ++-
6 files changed, 50 insertions(+), 1 deletion(-)
diff --git a/lib/dpkg/ar.c b/lib/dpkg/ar.c
index 273a5ac45..2283f1850 100644
--- a/lib/dpkg/ar.c
+++ b/lib/dpkg/ar.c
@@ -52,6 +52,7 @@ dpkg_ar_fdopen(const char *filename, int fd)
ar->size = st.st_size;
ar->time = st.st_mtime;
ar->fd = fd;
+ ar->is_seekable = lseek(fd, 0, SEEK_CUR) == 0;
return ar;
}
diff --git a/lib/dpkg/ar.h b/lib/dpkg/ar.h
index ccb9d7096..c2e4a96f5 100644
--- a/lib/dpkg/ar.h
+++ b/lib/dpkg/ar.h
@@ -67,6 +67,7 @@ struct dpkg_ar {
intmax_t time;
off_t size;
int fd;
+ bool is_seekable;
};
/**
diff --git a/src/Makefile.am b/src/Makefile.am
index 6d79078be..17264a7aa 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -159,6 +159,7 @@ TESTSUITE_AT += $(srcdir)/at/deb-format.at
TESTSUITE_AT += $(srcdir)/at/deb-fields.at
TESTSUITE_AT += $(srcdir)/at/deb-content.at
TESTSUITE_AT += $(srcdir)/at/deb-split.at
+TESTSUITE_AT += $(srcdir)/at/deb-streaming.at
TESTSUITE_AT += $(srcdir)/at/realpath.at
TESTSUITE_AT += $(srcdir)/at/divert.at
TESTSUITE_AT += $(srcdir)/at/trigger.at
diff --git a/src/at/deb-streaming.at b/src/at/deb-streaming.at
new file mode 100644
index 000000000..cada61abf
--- /dev/null
+++ b/src/at/deb-streaming.at
@@ -0,0 +1,44 @@
+AT_SETUP([dpkg-deb .deb streaming])
+AT_KEYWORDS([dpkg-deb deb streaming])
+
+DPKG_GEN_CONTROL([pkg-streaming])
+AT_CHECK([
+dpkg-deb --root-owner-group -b pkg-streaming
+], [0], [ignore])
+
+AT_CHECK([
+cat pkg-streaming.deb | dpkg-deb --info -
+], [0], [ new Debian package, version 2.0.
+ size 0 bytes: control archive=328 bytes.
+ 171 bytes, 7 lines control
+ Package: pkg-streaming
+ Version: 0.0-1
+ Section: test
+ Priority: extra
+ Maintainer: Dpkg Developers <[email protected]>
+ Architecture: all
+ Description: test package
+])
+
+AT_CHECK([
+cat pkg-streaming.deb | dpkg-deb --show -
+], [0], [pkg-streaming 0.0-1
+])
+
+AT_CHECK([
+cat pkg-streaming.deb | dpkg-deb --field - Package
+], [0], [pkg-streaming
+])
+
+AT_CHECK([
+cat pkg-streaming.deb | dpkg-deb --ctrl-tarfile - | $TAR tf -
+], [0], [./
+./control
+])
+
+AT_CHECK([
+cat pkg-streaming.deb | dpkg-deb --fsys-tarfile - | $TAR tf -
+], [0], [./
+])
+
+AT_CLEANUP
diff --git a/src/at/testsuite.at b/src/at/testsuite.at
index a6705d5b5..52dad05d5 100644
--- a/src/at/testsuite.at
+++ b/src/at/testsuite.at
@@ -6,6 +6,7 @@ AT_BANNER([Binary .deb packages])
m4_include([deb-format.at])
m4_include([deb-content.at])
m4_include([deb-fields.at])
+m4_include([deb-streaming.at])
AT_TESTED([dpkg-split])
AT_BANNER([Split .deb packages])
diff --git a/src/deb/extract.c b/src/deb/extract.c
index f58c4c3f7..1438aa5f6 100644
--- a/src/deb/extract.c
+++ b/src/deb/extract.c
@@ -241,7 +241,8 @@ extracthalf(const char *debar, const char *dir,
if (ar_new_pos < ar_pos)
ohshit(_("archive '%s' contains
an overflowing member '%.*s' size"),
ar->name,
(int)sizeof(arh.ar_name), arh.ar_name);
- if (ar_new_pos > ar->size)
+ if (ar->is_seekable &&
+ ar_new_pos > ar->size)
ohshit(_("archive '%s' is
truncated or corrupt, "
"expected more data
than available (%jd > %jd)"),
ar->name, ar_new_pos,
ar->size);
--
Dpkg.Org's dpkg
https://www.mail-archive.com/debian-dpkg-cvs%40lists.debian.org/msg09784.html
test case:
period@DDQ7HY84 ~/src/AVANAN $ sudo apt-get update
Get:1 https://linux.teamviewer.com/deb stable InRelease [11.9 kB]
Get:2 https://dl.google.com/linux/chrome-stable/deb stable InRelease [2,548 B]
Get:3 https://dl.google.com/linux/chrome-stable/deb stable/main amd64 Packages [1,405 B]
Get:4 https://linux.teamviewer.com/deb stable/main amd64 Packages [9,006 B]
Get:5 https://kali.download/kali kali-rolling InRelease [34.0 kB]
Get:6 https://kali.download/kali kali-rolling/contrib Sources [71.0 kB]
Get:7 https://kali.download/kali kali-rolling/non-free Sources [117 kB]
Get:8 https://kali.download/kali kali-rolling/main Sources [18.3 MB]
Get:9 https://kali.download/kali kali-rolling/non-free-firmware Sources [10.4 kB]
Get:10 https://kali.download/kali kali-rolling/main amd64 Packages [21.6 MB]
Get:11 https://kali.download/kali kali-rolling/main amd64 Contents (deb) [54.1 MB]
Get:12 https://kali.download/kali kali-rolling/contrib amd64 Packages [104 kB]
Get:13 https://kali.download/kali kali-rolling/contrib amd64 Contents (deb) [183 kB]
Get:14 https://kali.download/kali kali-rolling/non-free amd64 Packages [170 kB]
Get:15 https://kali.download/kali kali-rolling/non-free amd64 Contents (deb) [893 kB]
Get:16 https://kali.download/kali kali-rolling/non-free-firmware amd64 Packages [16.0 kB]
Get:17 https://kali.download/kali kali-rolling/non-free-firmware amd64 Contents (deb) [42.3 kB]
Fetched 95.7 MB in 22s (4,261 kB/s)
Reading package lists... Done
N: Ignoring file 'google-chrome.list.gz' in directory '/etc/apt/sources.list.d/' as it has an invalid filename extension
N: Ignoring file 'signal-xenial.list.gz' in directory '/etc/apt/sources.list.d/' as it has an invalid filename extension
period@DDQ7HY84 ~/src/AVANAN $ dpkg --version
Debian 'dpkg' package management program version 1.23.7 (amd64).
This is free software; see the GNU General Public License version 2 or
later for copying conditions. There is NO warranty.
period@DDQ7HY84 ~/src/AVANAN $ dpkg ^C
period@DDQ7HY84 ~/src/AVANAN $ sudo apt install dpkg
dpkg is already the newest version (1.23.7+kali1).
apt-get download -o Dir::Cache::archives="./" --print-uris dpkg | awk -F\' '{print $2}'
https://http.kali.org/kali/pool/main/d/dpkg/dpkg_1.23.7%2bkali1_amd64.deb | xargs curl -I '{}' -skL '{}' | dpkg-deb -c -
period@DDQ7HY84 ~/src/AVANAN $ apt-get download -o Dir::Cache::archives="./" --print-uris dpkg | awk -F\' '{print $2}' | xargs -I '{}' curl '{}' -skL| dpkg-deb -c -
dpkg-deb: error: archive '-' is truncated or corrupt, expected more data than available (1532876 > 0) |
|---|
