From 7acd3ec64aeff50cd3bd105255226a1fe29fee66 Mon Sep 17 00:00:00 2001
From: Ville Skyttä <ville.skytta@iki.fi>
Date: Dec 26 2015 19:12:19 +0000
Subject: bumpspec: Invoke rpmdev-packager without shell


---

diff --git a/NEWS b/NEWS
index fe2d158..b3513fb 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,7 @@ rpmdevtools x.x (201x-xx-xx)
   - Add placeholders args for %doc in spec templates (#1256815)
   - Add %license to spec templates (#1256815)
   - Use %autosetup for rpm >= 4.11 in -newspec (#1290913)
+  - Don't use shell to invoke -packager in -bumpspec
 
   Ralph Bean:
   - Don't write changelog in -bumpspec if nothing changed
diff --git a/rpmdev-bumpspec b/rpmdev-bumpspec
index 23dfdab..0c6fa0e 100755
--- a/rpmdev-bumpspec
+++ b/rpmdev-bumpspec
@@ -17,6 +17,7 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 
+import os
 import re
 import subprocess
 import sys
@@ -262,8 +263,9 @@ it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.''' % __version__
 
-    userstring = subprocess.Popen("rpmdev-packager 2>/dev/null", shell=True,
-                                  stdout=subprocess.PIPE).communicate()[0]
+    with open(os.devnull, "w") as devnull:
+        userstring = subprocess.Popen("rpmdev-packager", stderr=devnull,
+                                      stdout=subprocess.PIPE).communicate()[0]
     if sys.version_info[0] > 2:
         userstring = userstring.decode(errors='replace')
     userstring = userstring.strip() or None