community/pass depends on coreutils tr
The pass
utility utilises tr
's support for character classes, namely [:graph:]
, to generate passwords. Unfortunately Busybox's tr
implementation only supports [:upper:]
and [:lower:]
character classes at time of writing this, so on Busybox systems pass
unwittingly uses the literal characters in "[:graph:]". Of course, this isn't the intended outcome and generally leads to weak passwords, and it defies how pass
normally operates on systems with a POSIX-compliant tr
implementation.
Three possible fixes:
- Add
coreutils
dependency to thepass
package; - Patch
pass
so that it includes the character set that[:graph:]
would normally expand to (probably assumingLC_CTYPE=C
); - Ideally, this would be fixed upstream with Busybox. I have filed a bug on Busybox tracker to cover this issue.