>Number:         32128
>Category:       pkg
>Synopsis:       pkg_add may match incorrectly if dewey wildcard is followed by suffix
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 20 01:17:00 +0000 2005
>Originator:     Chapman Flack
>Release:        2.0
>Organization:
>Environment:
NetBSD lundestad.anastigmatix.net 2.0 NetBSD 2.0 (lundestad) #11: Sat Mar  5 14:01:49 EST 2005  xxx@xxx:/usr/src/sys/arch/i386/compile/lundestad i386
>Description:
pkg_add given a package name with only a dewey wildcard (say php<5)
works as expected, but given a dewey wildcard plus a suffix
(say php<5.tgz) does it can misbehave and match a package that does
not satisfy the dewey condition.

The C code in pkgtools/pkg_install/files/lib/str.c and ftpio.c
is clearly intended to correctly handle the combination of a dewey
condition and a suffix. The function strip_txz is provided in str.c
to isolate the suffix, and findmatchingname explicitly uses it to
set the suffix aside temporarily, then match the dewey condition and
the wildcard separately:

	/* chop any possible suffix off of 'pattern' and
	 * store it in pat_sfx
	 */
	strip_txz(tmp_pattern, pat_sfx, pattern);
	
	while ((dp = readdir(dirp)) != (struct dirent *) NULL) {
		char    tmp_file[MaxPathSize];
		
		if (strcmp(dp->d_name, ".") == 0 ||
		    strcmp(dp->d_name, "..") == 0)
			continue;

		/* chop any possible suffix off of 'tmp_file' and
		 * store it in file_sfx
		 */
		strip_txz(tmp_file, file_sfx, dp->d_name);
		
		/* we need to match pattern and suffix separately, in case
		 * each is a different pattern class (e.g. dewey and
		 * character class (.t[bg]z)) */
		if (pmatch(tmp_pattern, tmp_file)
		    && (pat_sfx[0] == '\0' || pmatch(pat_sfx, file_sfx))) {
			if (match) {
				match(dp->d_name, data);
				/* return value ignored for now */
			}
			found = 1;
		}
	}


For ftp urls, the analogous code is around line 724 of ftpio.c.

Although clearly intended to handle the combination of a dewey
condition followed by a suffix, the code is failing somewhere.

If this proved very difficult to fix, it could be turned into a doc
bug and package wildcards could be documented as not supporting a
following suffix. But as the code appears to be mostly there and was
intended to work, it is probably worth fixing.
>How-To-Repeat:
PKG_PATH=ftp://ftp.netbsd.org/pub/NetBSD/packages/2.0/i386/All \
pkg_add 'php<5'

correctly installs php-4.4.1nb2, but

PKG_PATH=ftp://ftp.netbsd.org/pub/NetBSD/packages/2.0/i386/All \
pkg_add 'php<5.tgz'

installs php-5.0.5 (contrary to the dewey wildcard).
>Fix: