Eli Schwartz authored Jun 13, 2018 and Allan McRae committed Jul 27, 2018

The biggest issue is directly supplying the data within the format
string which can result in misinterpreting formatter sequences if a
printed variable contains an "%" in it. This character is currently
permitted in the pkgver field, though not in the pkgname. Also
pacman/libalpm itself has much looser limitations and this can appear
anywhere at all if a package was created by some other program.

For the package "iambroke-1%s-1-any.pkg.tar.xz", installed in the build
environment, the result is:

  -> Generating .BUILDINFO file...
awk: cmd. line:3: (FILENAME=- FNR=1085) fatal: not enough arguments to satisfy format string
	`-1%s-1'
	   ^ ran out for this one

Followed by a .BUILDINFO which contains an LC_ALL=C sorted list of
$pkgname-${epoch:+$epoch:}$pkgver-$pkgrel-$arch ending in:

installed = iambroke

Which is cut short, then fails to list the succeeding packages. The
package itself successfully builds.

It's also unnecessary to save the outp...