From b300a720db12c5cfa9bca019aebccbef1044f034 Mon Sep 17 00:00:00 2001 From: archipelago Date: Mon, 31 Aug 2026 10:44:15 -0400 Subject: [PATCH] fix(host): query package allowlist without literal quotes --- core/archipelago/src/host_fixups.rs | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/core/archipelago/src/host_fixups.rs b/core/archipelago/src/host_fixups.rs index 17a54ed3..ae6f5d66 100644 --- a/core/archipelago/src/host_fixups.rs +++ b/core/archipelago/src/host_fixups.rs @@ -131,11 +131,10 @@ async fn run_host_fixups() -> Result<()> { /// install without `apt-get update` first; only if that fails (fresh suite, /// stale index), update once and retry. Both under timeout, both non-fatal. async fn ensure_packages() -> Result { - let wanted = HOST_PACKAGES - .iter() - .map(|p| format!("'{p}'")) - .collect::>() - .join(" "); + // Package names are a fixed internal allowlist. Do not embed shell quote + // characters in WANTED: quotes produced by variable expansion are data, + // so dpkg-query would look for a package literally named 'kdump-tools'. + let wanted = HOST_PACKAGES.join(" "); let script = format!( r#" set -u