feat: add various system and theme icons, configuration files, and support assets

2026-10-03 08:14:42 -07:00
1 parent 848dac4264
commit 54baea79f4
@@ -0,0 +1,2 @@
+# postinst creates the /usr/share/icons/default/index.theme symlink
+package-contains-empty-directory [usr/share/icons/default/]
@@ -0,0 +1,2 @@
+# intentionally statically-enabled
+dbus: systemd-service-file-missing-install-key [usr/lib/systemd/system/dbus.service]
@@ -0,0 +1,4 @@
+# yes we do want to ship these
+package-contains-empty-directory [usr/share/dbus-1/services/]
+# we're careful to say D-Bus for the protocol and dbus for the implementation
+capitalization-error-in-description dbus D-Bus
@@ -0,0 +1,4 @@
+# yes we do want to ship these
+package-contains-empty-directory [usr/share/dbus-1/system-services/]
+# we're careful to say D-Bus for the protocol and dbus for the implementation
+capitalization-error-in-description dbus D-Bus
@@ -0,0 +1,2 @@
+# false positive: we only say dbus when talking about an executable
+dbus-user-session: capitalization-error-in-description dbus D-Bus
@@ -0,0 +1,3 @@
+# The empty directories are expected here as this package creates the
+# directories structure for the icons themes
+hicolor-icon-theme: package-contains-empty-directory
@@ -0,0 +1,2 @@
+# False positive, checked at compile time.
+libacl1: hardening-no-fortify-functions [*]
@@ -0,0 +1 @@
+libblkid1: missing-depends-on-sensible-utils sensible-pager [usr/lib/*/libblkid.so.1.1.0]
@@ -0,0 +1 @@
+libbrotli1: package-name-doesnt-match-sonames libbrotlicommon1 libbrotlidec1 libbrotlienc1
@@ -0,0 +1,13 @@
+# ld.so must be executable, otherwise the system will not work
+shared-library-is-executable 0755 [*/ld*.so.*]
+
+# It is normal that the ELF dynamic linker does not need any other 
+# library
+shared-library-lacks-prerequisites */ld*.so.*
+
+# dependency on debconf is not needed, as glibc has a fallback to tty 
+missing-debconf-dependency-for-preinst
+
+# The call to systemctl in postinst is not about restarting services,
+# but restarting systemd.
+maintainer-script-calls-systemctl
@@ -0,0 +1,2 @@
+# Only uses functions from libcairo, libglib, libgobject
+library-not-linked-against-libc [usr/lib/*/libcairo-gobject.so.2.*]
@@ -0,0 +1,2 @@
+# ls -l produces "root root" as user and group names
+spelling-error-in-readme-debian root root (duplicate word) root [usr/share/doc/libcap2-bin/README.Debian]
@@ -0,0 +1,3 @@
+# See reasoning at #843932 ('dev-pkg-without-shlib-symlink' was renamed
+# to 'lacks-unversioned-link-to-shared-library')
+lacks-unversioned-link-to-shared-library example: usr/lib/x86_64-linux-gnu/libcryptsetup.so [lib/x86_64-linux-gnu/libcryptsetup.so.12.*]
@@ -0,0 +1 @@
+libcups2t64: package-name-doesnt-match-sonames libcups2
@@ -0,0 +1,2 @@
+libcurl3t64-gnutls: package-name-doesnt-match-sonames libcurl-gnutls4
+libcurl3t64-gnutls: package-name-doesnt-match-sonames libcurl3-gnutls
@@ -0,0 +1,3 @@
+# historical reasons
+libdb5.3t64: package-name-doesnt-match-sonames libdb-5.3
+libdb5.3t64: package-name-doesnt-match-sonames libdb5.3
@@ -0,0 +1 @@
+libfdisk1: missing-depends-on-sensible-utils sensible-pager [usr/lib/*/libfdisk.so.1.1.0]
@@ -0,0 +1 @@
+libgcc-s1: package-name-doesnt-match-sonames
@@ -0,0 +1,4 @@
+# This does exist, but it's in gobject-introspection, which
+# libgirepository-1.0-dev depends on, as part of a workaround for
+# https://github.com/mesonbuild/meson/issues/12680
+libgirepository-1.0-1: lacks-unversioned-link-to-shared-library example: usr/lib/*/libgirepository-1.0.so [usr/lib/*/libgirepository-1.0.so.1.*]
@@ -0,0 +1,7 @@
+# GObject uses GLib functions instead of using libc directly
+libglib2.0-0t64: hardening-no-fortify-functions [usr/lib/*/libgobject-2.0.so.*]
+# It's a deliberate choice of bundling them together
+libglib2.0-0t64: package-name-doesnt-match-sonames libgio-2.0-0 libglib-2.0-0 libgmodule-2.0-0 libgobject-2.0-0 libgthread-2.0-0
+# These empty directories are deliberate.
+libglib2.0-0t64: package-contains-empty-directory [usr/lib/*/gio/modules/]
+libglib2.0-0t64: package-contains-empty-directory [usr/share/glib-2.0/schemas/]
@@ -0,0 +1,2 @@
+# GLib programs normally use GLib functions instead of using libc directly
+libglib2.0-bin: hardening-no-fortify-functions [usr/bin/gio]
@@ -0,0 +1 @@
+libgnutls30t64: package-name-doesnt-match-sonames libgnutls30
@@ -0,0 +1 @@
+libgssapi-krb5-2: symbols-file-contains-debian-revision
@@ -0,0 +1 @@
+libhogweed6t64: package-name-doesnt-match-sonames libhogweed6
@@ -0,0 +1,5 @@
+# libicu74 installs multiple shared libraries, none of which is
+# actually called libicu.so.74, but all of which are libicu*.so.74 .
+libicu74: package-name-doesnt-match-sonames libicudata74 libicui18n74 libicuio74 libicutest74 libicutu74 libicuuc74
+# contains data only
+libicu74: shared-library-lacks-prerequisites [usr/lib/*/libicudata.so.*.?]
@@ -0,0 +1,2 @@
+# false positive: libidn2 is supposed to contain libidn2
+libidn2-0: embedded-library *
@@ -0,0 +1,3 @@
+# yes, we specifically want linkers to depends on the standard libjpeg name
+libjpeg-turbo8: symbols-declares-dependency-on-other-package libjpeg8 #MINVER#
+libjpeg-turbo8: package-name-doesnt-match-sonames
@@ -0,0 +1 @@
+libkrb5-3: package-contains-empty-directory */plugins/libkrb5/
@@ -0,0 +1 @@
+libkrb5support0: symbols-declares-dependency-on-other-package libkrb5support0 (= ${binary:Version}) (libkrb5support.so.0) [symbols]
@@ -0,0 +1 @@
+libmount1: missing-depends-on-sensible-utils sensible-pager [usr/lib/*/libmount.so.1.1.0]
@@ -0,0 +1 @@
+libnettle8t64: package-name-doesnt-match-sonames libnettle8
@@ -0,0 +1,13 @@
+# These are false positives because they don't use any functions that need
+# fortifying.  Since we know we have hardening turned on globally, suppress
+# them.  If we ever see this warning again for *other* modules, then we know
+# there's a real problem.
+libpam-modules: hardening-no-fortify-functions *usr/lib/*/security/pam_echo.so*
+libpam-modules: hardening-no-fortify-functions *usr/lib/*/security/pam_filter.so*
+libpam-modules: hardening-no-fortify-functions *usr/lib/*/security/pam_group.so*
+libpam-modules: hardening-no-fortify-functions *usr/lib/*/security/pam_localuser.so*
+libpam-modules: hardening-no-fortify-functions *usr/lib/*/security/pam_shells.so*
+libpam-modules: hardening-no-fortify-functions *usr/lib/*/security/pam_wheel.so*
+# pam_deny.so does not use any symbol from libc.
+libpam-modules: shared-lib-without-dependency-information *usr/lib/*/security/pam_deny.so*
+libpam-modules: spare-manual-page [*]
@@ -0,0 +1,4 @@
+# yes, we know it's sgid, that's the whole point...
+libpam-modules-bin: setgid-binary *usr/sbin/unix_chkpwd* 2755 root/shadow
+libpam-modules-bin: setgid-binary *usr/sbin/pam_extrausers_chkpwd* 2755 root/shadow
+libpam-modules-bin: elevated-privileges 2755 root/shadow [usr/sbin/unix_chkpwd]
@@ -0,0 +1,13 @@
+# deliberate.
+libpam-runtime: no-debconf-config
+# this warning is just plain crack, there's no reason that using debconf
+# outside of a maintainer script implies an error.
+libpam-runtime: debconf-is-not-a-registry [*usr/sbin/pam-auth-update*:*]
+# false positive, we have to load the debconf templates from here
+libpam-runtime: uses-dpkg-database-directly [usr/sbin/pam-auth-update]
+# and lintian also says these templates are unused, which is false
+libpam-runtime: unused-debconf-template libpam-runtime/conflicts [*:*]
+libpam-runtime: unused-debconf-template libpam-runtime/no_profiles_chosen [*:*]
+libpam-runtime: unused-debconf-template libpam-runtime/override [*:*]
+libpam-runtime: unused-debconf-template libpam-runtime/profiles [*:*]
+libpam-runtime: unused-debconf-template libpam-runtime/title [*:*]
@@ -0,0 +1,2 @@
+# Lintian is really bad at associating manpages
+libpam-systemd: spare-manual-page
@@ -0,0 +1,11 @@
+# obvious multilib package false-positive; also the package name hasn't
+# changed since the glibc transition, go us!
+libpam0g: package-name-doesnt-match-sonames libpam-misc0 libpam0 libpamc0
+# yes, these are deliberately asked in the postinst because the checking
+# for daemons to be restarted needs to be done in the postinst and not 
+# before
+libpam0g: no-debconf-config
+libpam0g: postinst-uses-db-input
+# Yes, we want to use systemctl; if the service is running we do need
+# to restart it. We have already asked the admin.
+libpam0g: maintainer-script-calls-systemctl
@@ -0,0 +1,2 @@
+libpixman-1-0: symbols-declares-dependency-on-other-package libpixman-1-0-private
+
@@ -0,0 +1 @@
+libpng16-16t64: package-name-doesnt-match-sonames libpng16-16
@@ -0,0 +1 @@
+libpsl5t64: package-name-doesnt-match-sonames libpsl5
@@ -0,0 +1,12 @@
+# intentional
+libpython3.12-minimal binary: python3-script-but-no-python3-dep
+
+# no, it's not unusual
+libpython3.12-minimal binary: unusual-interpreter
+
+# lintian omission, multiarch string is encoded in the filename
+libpython3.12-minimal binary: arch-dependent-file-not-in-arch-specific-directory
+
+# yes, some extensions don't have references to any external lib
+libpython3.12-minimal binary: shared-lib-without-dependency-information
+libpython3.12-minimal binary: library-not-linked-against-libc
@@ -0,0 +1,22 @@
+# idlelib images
+libpython3.12-stdlib binary: image-file-in-usr-lib
+
+# license file referred by the standard library
+libpython3.12-stdlib binary: extra-license-file
+
+# template files
+libpython3.12-stdlib binary: interpreter-not-absolute usr/lib/python3.12/venv/scripts/posix/pydoc #!__VENV_PYTHON__
+libpython3.12-stdlib binary: unusual-interpreter usr/lib/python3.12/venv/scripts/posix/pydoc #!__VENV_PYTHON__
+
+# the split is the reason for that
+libpython3.12-stdlib binary: python3-script-but-no-python3-dep
+
+# no, it's not unusual
+libpython3.12-stdlib binary: unusual-interpreter
+
+# lintian omission, multiarch string is encoded in the filename
+libpython3.12-stdlib binary: arch-dependent-file-not-in-arch-specific-directory
+
+# yes, some extensions don't have references to any external lib
+libpython3.12-stdlib binary: shared-lib-without-dependency-information
+libpython3.12-stdlib binary: library-not-linked-against-libc
@@ -0,0 +1,4 @@
+# String manipulation is done in Rust
+librsvg2-2: hardening-no-fortify-functions [usr/lib/*/librsvg-2.so.2.*]
+# We are not going to change this unless/until the SONAME breaks
+librsvg2-2: package-name-doesnt-match-sonames librsvg-2-2
@@ -0,0 +1,3 @@
+# This shared object genuinely doesn't use any libc ABIs directly,
+# only via GLib
+library-not-linked-against-libc [usr/lib/*/gdk-pixbuf-2.0/*/loaders/libpixbufloader-svg.so]
@@ -0,0 +1 @@
+libsmartcols1: missing-depends-on-sensible-utils sensible-pager [usr/lib/*/libsmartcols.so.1.1.0]
@@ -0,0 +1,2 @@
+# We use libssh-4 name to avoid name clash with libssh2 package.
+libssh-4: package-name-doesnt-match-sonames libssh4
@@ -0,0 +1 @@
+libssl3t64: package-name-doesnt-match-sonames libssl3
@@ -0,0 +1,2 @@
+# Intentional: value of config got in a release by mistake, needs to be kept
+libsystemd-shared: spelling-error-in-binary anually annually [usr/lib/*/systemd/libsystemd-shared-*.so]
@@ -0,0 +1 @@
+libxml2: package-name-doesnt-match-sonames
@@ -0,0 +1,2 @@
+mount: elevated-privileges 4755 root/root [usr/bin/mount]
+mount: elevated-privileges 4755 root/root [usr/bin/umount]
@@ -0,0 +1,3 @@
+# Policy §10.9 wants 755 but since private keys could be stored there
+# we want this only accessed by root
+non-standard-dir-perm etc/ssl/private/ 0700 != 0755
@@ -0,0 +1,3 @@
+procps: package-name-doesnt-match-sonames
+procps: manpage-has-errors-from-man 
+
@@ -0,0 +1,2 @@
+# this is the only package that can depend on it
+python3 binary: depends-on-python-minimal
@@ -0,0 +1,14 @@
+# yes, we have to
+python3.12 binary: depends-on-python-minimal
+
+python3.12 binary: desktop-command-not-in-package
+python3.12 binary: menu-command-not-in-package
+python3.12 binary: unusual-interpreter
+python3.12 binary: python3-script-but-no-python3-dep
+
+# no, not useless
+python3.12 binary: manpage-has-useless-whatis-entry
+
+python3.12 binary: command-with-path-in-maintainer-script
+
+python3.12 binary: python3-script-but-no-python3-dep [usr/bin/pygettext3.12]
@@ -0,0 +1,5 @@
+python3.12-minimal binary: command-with-path-in-maintainer-script
+python3.12-minimal binary: unknown-field
+
+# pyexpat.c contains expat error messages that lintian mis-attributes to embedding
+python3.12-minimal binary: embedded-library
@@ -0,0 +1 @@
+readline-common: manpage-section-mismatch
@@ -0,0 +1,7 @@
+systemd: maintainer-script-calls-systemctl
+# Our units without [Install] are either event driven or statically enabled
+systemd: systemd-service-file-missing-install-key
+# Lintian is really bad at associating manpages
+systemd: spare-manual-page
+# netlink keyword
+systemd: spelling-error-in-binary iif if [usr/lib/systemd/systemd-networkd]
@@ -0,0 +1,13 @@
+# Variable tzdata/Zones/$AREA used
+unused-debconf-template tzdata/Zones/Africa *
+unused-debconf-template tzdata/Zones/America *
+unused-debconf-template tzdata/Zones/Antarctica *
+unused-debconf-template tzdata/Zones/Arctic *
+unused-debconf-template tzdata/Zones/Asia *
+unused-debconf-template tzdata/Zones/Atlantic *
+unused-debconf-template tzdata/Zones/Australia *
+unused-debconf-template tzdata/Zones/Etc *
+unused-debconf-template tzdata/Zones/Europe *
+unused-debconf-template tzdata/Zones/Legacy *
+unused-debconf-template tzdata/Zones/Indian *
+unused-debconf-template tzdata/Zones/Pacific *
@@ -0,0 +1,2 @@
+# Yes, su really needs to be suid ofcourse...
+util-linux: elevated-privileges 4755 root/root [usr/bin/su]
				`@@ -0,0 +1 @@`
				`libblkid1: missing-depends-on-sensible-utils sensible-pager [usr/lib/*/libblkid.so.1.1.0]`
				`@@ -0,0 +1 @@`
				`libbrotli1: package-name-doesnt-match-sonames libbrotlicommon1 libbrotlidec1 libbrotlienc1`
				`@@ -0,0 +1 @@`
				`libcups2t64: package-name-doesnt-match-sonames libcups2`
				`@@ -0,0 +1 @@`
				`libfdisk1: missing-depends-on-sensible-utils sensible-pager [usr/lib/*/libfdisk.so.1.1.0]`
				`@@ -0,0 +1 @@`
				`libgcc-s1: package-name-doesnt-match-sonames`
				`@@ -0,0 +1 @@`
				`libgnutls30t64: package-name-doesnt-match-sonames libgnutls30`
				`@@ -0,0 +1 @@`
				`libgssapi-krb5-2: symbols-file-contains-debian-revision`
				`@@ -0,0 +1 @@`
				`libhogweed6t64: package-name-doesnt-match-sonames libhogweed6`
				`@@ -0,0 +1 @@`
				`libkrb5-3: package-contains-empty-directory */plugins/libkrb5/`
				`@@ -0,0 +1 @@`
				`libkrb5support0: symbols-declares-dependency-on-other-package libkrb5support0 (= ${binary:Version}) (libkrb5support.so.0) [symbols]`