[tex-live] tlmgr still has problems handling spaces in texlive's path

[Philipp Stephani]

Am 05.06.2011 um 17:00 schrieb Artemio Gonzalez Lopez:

> Hi everybody,
> 
> As I explained in a previous thread, for reasons that are too long to explain here my TeXLive distribution's path is at /Volumes/Macintosh HD/usr/local/texlive/, and the space in the path made it impossible to use tlmgr with the 2010 distribution. The current tlmgr handles spaces better, since "sudo tlmgr update --all" works, correctly telling me that I need to execute "sudo tlmgr update --self". However, the latter command miserably fails:
> 
> mbp:~ artemio$ sudo tlmgr update --self
> tlmgr: package repository http://ftp.ctex.org/mirrors/texlive/tlpretest
> tlmgr: saving backups to /Volumes/Macintosh HD/usr/local/texlive/2011/tlpkg/backups
> [1/1, ??:??/??:??] update: texlive.infra [292k] (22642 -> 22724) ... sh: /Volumes/Macintosh: No such file or directory
> _install_package: Unpacking /Volumes/Macintosh HD/usr/local/texlive/2011/temp/texlive.infra.tar.xz failed, please retry.
> 
> Installation of new version of texlive.infra did fail, trying to unwind.
> sh: /Volumes/Macintosh: No such file or directory
> _install_package: Unpacking /Volumes/Macintosh HD/usr/local/texlive/2011/temp/texlive.infra.r22642.tar.xz failed, please retry.
> Restoring of old package did NOT succeed.
> Most likely repair: run tlmgr install texlive.infra and hope.
> done
> 
> I realize that my setup is highly unusual, but still, if this is simply an overlook perhaps it would be worth fixing it at this point.

This seems to be caused again by calling the shell (TLPDB.pm, line 1359):

      system("$xzdec < $xzfile_quote > $tarfile_quote");

I think tlmgr should *never* call the shell (i.e. never use the system function without a list argument), it will always result in quoting problems and give rise to "shell injections." There aren't that many instances of such calls any more:
- TLPDB.pm lines 303 & 1359
- TLUtils.pm lines 1471, 1891, 2158, 2216, 2251, 2274, 3331