From 3118ec19d59f3e60f2c1b35d09d5e2e722b2de15 Mon Sep 17 00:00:00 2001
From: Drew Leske <drew@leske.net>
Date: Fri, 1 May 2026 09:28:22 -0700
Subject: [PATCH] fix: tolerate empty overrides packager clause (#1080)

* fix: Warn on empty `overrides.PACKAGER` stanza

Previously, if an overrides stanza contained an empty packager clause,
the user would get a segfault. This is now detected and a warning
issued.

Fixes #1079.

* test: Parse a test file with empty overrides

Tests that an empty overrides.packager clause is handled without
failure.

See: #1079

* update: Ignore empty overrides instead of warn
---
 nfpm.go                         |  3 +++
 nfpm_test.go                    |  2 ++
 testdata/overrides-missing.yaml | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 37 insertions(+)
 create mode 100644 testdata/overrides-missing.yaml

diff --git a/nfpm.go b/nfpm.go
index 1cbc2a5..b20ece0 100644
--- a/nfpm.go
+++ b/nfpm.go
@@ -211,6 +211,9 @@ func (c *Config) expandEnvVars() {
 	c.Platform = os.Expand(c.Platform, c.envMappingFunc)
 	c.Arch = os.Expand(c.Arch, c.envMappingFunc)
 	for or := range c.Overrides {
+		if c.Overrides[or] == nil {
+			continue
+		}
 		c.Overrides[or].Conflicts = c.expandEnvVarsStringSlice(c.Overrides[or].Conflicts)
 		c.Overrides[or].Depends = c.expandEnvVarsStringSlice(c.Overrides[or].Depends)
 		c.Overrides[or].Replaces = c.expandEnvVarsStringSlice(c.Overrides[or].Replaces)
diff --git a/nfpm_test.go b/nfpm_test.go
index b519b01..50c7adc 100644
--- a/nfpm_test.go
+++ b/nfpm_test.go
@@ -324,6 +324,8 @@ func TestParseFile(t *testing.T) {
 	require.Equal(t, "my/rpm/key/file", config.RPM.Signature.KeyFile)
 	require.Equal(t, "hard/coded/file", config.Deb.Signature.KeyFile)
 	require.Empty(t, config.APK.Signature.KeyFile)
+	_, err = parseAndValidate("./testdata/overrides-missing.yaml")
+	require.NoError(t, err)
 }
 
 func TestParseEnhancedFile(t *testing.T) {
diff --git a/testdata/overrides-missing.yaml b/testdata/overrides-missing.yaml
new file mode 100644
index 0000000..ceaaf41
--- /dev/null
+++ b/testdata/overrides-missing.yaml
@@ -0,0 +1,32 @@
+# Configuration file used to test that missing overrides don't cause a
+# segmentation fault.  See `overrides.deb` below.
+name: "foo"
+arch: "amd64"
+mtime: 2023-01-02
+version: "v1.2.3"
+contents:
+  - src: ./testdata/whatever.conf
+    dst: /etc/foo/whatever.conf
+    type: config
+  - src: ./testdata/whatever.conf
+    dst: /deb/path.conf
+    type: config
+    packager: deb
+  - src: ./testdata/whatever.conf
+    dst: /rpm/path.conf
+    type: config
+    packager: rpm
+  - src: ./testdata/whatever.conf
+    dst: /apk/path.conf
+    type: config
+    packager: apk
+rpm:
+  group: foo
+overrides:
+  deb:
+  rpm:
+    depends:
+      - rpm_depend
+  apk:
+    depends:
+      - apk_depend