Phillip Wood <phillip.wood@xxxxxxxxxxxx> writes: >> The only consumer of a faulty author script written by the sequencer >> is read_env_script() in sequencer.c which doesn't worry about >> checking that quotes are paired. > > That's not quite true anymore, recently another consumer > read_author_ident() was added which uses sq_dequote() instead of > custom code. Looking more closely at write_author_script() the quoting > of single quotes is buggy they are escaped as \\' instead of \'. That's embarrassing re-invention (instead of reuse) with additional bug X-<. It seems that all of that blame to d87d48b2 ("sequencer: learn about the special "fake root commit" handling", 2018-05-04). We should fix both broken writer and readers that compensate for breakage in the writer, I guess. Sigh...