• Bug#1101057: sopv-gpgv: Non-robust option parsing?

    From Guillem Jover@21:1/5 to All on Sat Mar 22 17:40:01 2025
    Package: sopv-gpgv
    Version: 0.1.4-1
    Severity: normal

    Hi!

    While playing with sopv-gpgv, I noticed the following unexpected behavior:
    When calling:

    ,---
    $ k=/usr/share/keyrings/debian-archive-keyring.gpg
    $ echo foo | sopv-gpgv inline-verify --verification-a foo $k
    Traceback (most recent call last):
    File "/usr/bin/sopv-gpgv", line 620, in <module>
    main()
    ~~~~^^
    File "/usr/bin/sopv-gpgv", line 609, in main
    args = sopv.parser.parse_args(sys.argv[1:])
    File "/usr/lib/python3.13/argparse.py", line 1903, in parse_args
    args, argv = self.parse_known_args(args, namespace)
    ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
    File "/usr/lib/python3.13/argparse.py", line 1913, in parse_known_args
    return self._parse_known_args2(args, namespace, intermixed=False)
    ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    File "/usr/lib/python3.13/argparse.py", line 1942, in _parse_known_args2
    namespace, args = self._parse_known_args(args, namespace, intermixed)
    ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    File "/usr/lib/python3.13/argparse.py", line 2174, in _parse_known_args
    positionals_end_index = consume_positionals(start_index)
    File "/usr/lib/python3.13/argparse.py", line 2149, in consume_positionals
    take_action(action, args)
    ~~~~~~~~~~~^^^^^^^^^^^^^^
    File "/usr/lib/python3.13/argparse.py", line 2018, in take_action
    action(self, namespace, argument_values, option_string)
    ~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    File "/usr/lib/python3.13/argparse.py", line 1269, in __call__
    subnamespace, arg_strings = subparser.parse_known_args(arg_strings, None)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
    File "/usr/lib/python3.13/argparse.py", line 1913, in parse_known_args
    return self._parse_known_args2(args, namespace, intermixed=False)
    ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    File "/usr/lib/python3.13/argparse.py", line 1942, in _parse_known_args2
    namespace, args = self._parse_known_args(args, namespace, intermixed)
    ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    File "/usr/lib/python3.13/argparse.py", line 2197, in _parse_known_args
    stop_index = consume_positionals(start_index)
    File "/usr/lib/python3.13/argparse.py", line 2149, in consume_positionals
    take_action(action, args)
    ~~~~~~~~~~~^^^^^^^^^^^^^^
    File "/usr/lib/python3.13/argparse.py", line 2003, in take_action
    argument_values = self._get_values(action, argument_strings)
    File "/usr/lib/python3.13/argparse.py", line 2540, in _get_values
    value = [self._get_value(action, v) for v in arg_strings]
    ~~~~~~~~~~~~~~~^^^^^^^^^^^
    File "/usr/lib/python3.13/argparse.py", line 2555, in _get_value
    result = type_func(arg_string)
    File "/usr/bin/sopv-gpgv", line 217, in __init__
    _rawfile = open(name, "rb")
    FileNotFoundError: [Errno 2] No such file or directory: 'foo'
    `---

    We get a traceback instead of a proper error, which should actually be
    about --verifications-a not being a valid option I guess.

    Thanks,
    Guillem

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)