Dry-run mode writes to /etc/apt/sources.list on the legacy Debian/Ubuntu source-list path #396

Summary

chsrc set -dry writes to /etc/apt/sources.list on Debian/Ubuntu when the file does not exist. Dry-run mode is not fully honored on this code path.

Problem

ensure_debian_or_ubuntu_old_sourcelist() in src/recipe/os/APT/common.h generates a source-list template and writes it with a raw fopen/fwrite, without checking in_dry_run_mode():

src/recipe/os/APT/common.h:116-118

  FILE *f = fopen (OS_Apt_SourceList, "w");
  fwrite (makeup, strlen (makeup), 1, f);
  fclose (f);

This bypasses chsrc_overwrite_file() (src/framework/OS.c:836), which is where the dry-run guard normally lives.

Call sites:

• src/recipe/os/APT/Debian.c:127
• src/recipe/os/APT/Debian.c:145 (re-invoked after CDROM source removal)
• src/recipe/os/APT/Ubuntu.c:127

Trigger

The function is reached only on the old-format (non-DEB822) path. os_debian_setsrc() returns early when a DEB822 file exists (src/recipe/os/APT/Debian.c:117-122), so the bug does not trigger on a stock Debian 12 / Ubuntu 24.04 installation.

It triggers when:

• the system still uses the legacy /etc/apt/sources.list (pre-Debian-12 / pre-Ubuntu-24.04 layout), and the file is absent, or
• a minimal container image ships neither debian.sources nor sources.list

Reproduction

On a Debian-family system where /etc/apt/sources.list does not exist:

sudo chsrc set -dry debian

Expected: prints the command it would run, writes nothing.

Actual: /etc/apt/sources.list is created on disk.

Verify:

ls -l /etc/apt/sources.list    # file now exists, despite -dry

Why this matters

Dry-run mode is the recommended way to preview a change on a system you care about — and it is the only isolation mechanism available to non-root users. This path silently writes to a system-wide config file, which is exactly what -dry is supposed to prevent.

It is most surprising inside containers and chroots, where an isolated -dry run is the normal way to test a configuration change before applying it.

Suggested fix

Route the write through chsrc_overwrite_file() (or add an explicit in_dry_run_mode() check before the fopen), so the guard applies consistently:

  if (in_dry_run_mode ())
    return false;

  FILE *f = fopen (OS_Apt_SourceList, "w");
  ...

Note that this function returns bool (whether the file existed). Under -dry it should keep returning false so the caller continues down the existing path without acting on a file that was never written.

Related

• The DEB822 path (os_debian_setsrc_for_deb822, src/recipe/os/APT/Debian.c:83) goes through chsrc_run(), which does honor -dry. The inconsistency between the two branches is what makes this easy to miss.
• Reference: upstream issue 功能请求：增加初始无软件源系统换源功能 #185 introduced this function for systems with no existing source list, but did not account for dry-run mode.

Environment

• chsrc: v0.2.7.2 (0bcc4c2)
• Reproduced by code inspection; the logic path is unconditional once the old-format branch is taken