From 9ed894d1d5213320a226ca9cab2cee6ff6b060dd Mon Sep 17 00:00:00 2001 From: anupamme Date: Thu, 30 Jul 2026 02:56:20 +0000 Subject: [PATCH 1/2] fix: V-001 security vulnerability Automated security fix generated by OrbisAI Security --- overlays/bootstrap_apt/usr/local/bin/apt-packages-origin | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/overlays/bootstrap_apt/usr/local/bin/apt-packages-origin b/overlays/bootstrap_apt/usr/local/bin/apt-packages-origin index 953dc897..1af71aad 100755 --- a/overlays/bootstrap_apt/usr/local/bin/apt-packages-origin +++ b/overlays/bootstrap_apt/usr/local/bin/apt-packages-origin @@ -52,7 +52,10 @@ def parse_policies(fh): yield pp def main(): - proc = subprocess.Popen(args="apt-cache policy $(dpkg -l | grep ^ii | awk '{print $2}')", shell=True, bufsize=1, stdout=subprocess.PIPE) + dpkg_proc = subprocess.Popen(['dpkg', '-l'], stdout=subprocess.PIPE) + pkgs = [line.split()[1] for line in dpkg_proc.stdout if line.startswith('ii')] + dpkg_proc.wait() + proc = subprocess.Popen(['apt-cache', 'policy'] + pkgs, bufsize=1, stdout=subprocess.PIPE) rows = [] for pp in parse_policies(proc.stdout): From 11cde836d4423491b022f3f45dc1923dfda765aa Mon Sep 17 00:00:00 2001 From: Anupam Mediratta Date: Fri, 31 Jul 2026 07:04:14 +0530 Subject: [PATCH 2/2] fix: resolve bytes/str mismatch and Python 2 syntax in apt-packages-origin Add text=True to both Popen calls so dpkg stdout yields str, fixing the bytes/str incompatibility flagged in PR review. Also update shebang to python3, add returncode check on dpkg subprocess, and fix print statement for Python 3 compatibility. Co-Authored-By: Claude Sonnet 4.6 --- .../bootstrap_apt/usr/local/bin/apt-packages-origin | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/overlays/bootstrap_apt/usr/local/bin/apt-packages-origin b/overlays/bootstrap_apt/usr/local/bin/apt-packages-origin index 1af71aad..050235fe 100755 --- a/overlays/bootstrap_apt/usr/local/bin/apt-packages-origin +++ b/overlays/bootstrap_apt/usr/local/bin/apt-packages-origin @@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/python3 # Author: Liraz Siri # list origin of packages @@ -52,10 +52,13 @@ def parse_policies(fh): yield pp def main(): - dpkg_proc = subprocess.Popen(['dpkg', '-l'], stdout=subprocess.PIPE) + dpkg_proc = subprocess.Popen(['dpkg', '-l'], stdout=subprocess.PIPE, text=True) pkgs = [line.split()[1] for line in dpkg_proc.stdout if line.startswith('ii')] dpkg_proc.wait() - proc = subprocess.Popen(['apt-cache', 'policy'] + pkgs, bufsize=1, stdout=subprocess.PIPE) + if dpkg_proc.returncode != 0: + raise SystemExit('dpkg -l failed with returncode %d' % dpkg_proc.returncode) + # if pkgs is empty, apt-cache policy runs with no args and lists policy for all packages + proc = subprocess.Popen(['apt-cache', 'policy'] + pkgs, bufsize=1, stdout=subprocess.PIPE, text=True) rows = [] for pp in parse_policies(proc.stdout): @@ -75,7 +78,7 @@ def main(): fmt = "%%-%ds %%-%ds %%s" % (maxcols[0], maxcols[1]) for row in rows: - print fmt % tuple(row) + print(fmt % tuple(row)) if __name__ == "__main__": main()