From 55db1fb17fcc1eca9fc9c3e7a41036df24654776 Mon Sep 17 00:00:00 2001 From: Sam James Date: Fri, 10 Jul 2026 17:22:30 +0100 Subject: [PATCH] sec-keys.eclass: avoid heredoc in global scope A heredoc may cause the use of a temporary file with < EAPI 9 and even then still with >= EAPI 9 if the input is large. This becomes a problem if sandboxing is applied to metadata generation. Closes: https://bugs.gentoo.org/978941 Signed-off-by: Sam James --- eclass/sec-keys.eclass | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/eclass/sec-keys.eclass b/eclass/sec-keys.eclass index ca1b4de572412..b53b7143bea65 100644 --- a/eclass/sec-keys.eclass +++ b/eclass/sec-keys.eclass @@ -68,7 +68,7 @@ _sec_keys_set_globals() { for key in "${SEC_KEYS_VALIDPGPKEYS[@]}"; do fingerprint=${key%%:*} name=${key#${fingerprint}:}; name=${name%%:*} - IFS=, read -r -a locations <<<"${key##*:}" + mapfile -td ',' locations < <(printf %s "${key##*:}") [[ ${locations[@]} ]] || die "${ECLASS}: ${name}: PGP key remote is mandatory" for loc in "${locations[@]}"; do case ${loc} in