On Mon, Nov 27, 2017 at 9:13 AM, Henning Schild
[off-list ref] wrote:

The debian packages coming out of "make *deb-pkg" lack some critical
information in the control-files e.g. the "Depends:" field. If one
tries to install a fresh system with such a "linux-image" debootstrap or
multistrap might try to install the kernel before its deps and the
package hooks will fail.

Has that shown up in practice?  The builddeb script goes back some years now...

+       eval 'create_package "$kernel_headers_packagename" \
+               "$kernel_headers_dir"' "$KDEB_OPTS_IMAGE_HEADERS"

eval in a shell script with arbitrary input can lead to shenanigans like

make bindeb-pkg KDEB_OPTS_IMAGE_HEADERS="; echo All your base"

and other potentially nastier things.  Probably not an issue for a
typical kernel developer sitting in front of his or her laptop, but if
I ran a big automated unattended build farm I might prefer a non-eval
alternative.

-- 
Jim