fix: harden Jenkinsfile against injection and permission issues

- Scope copyArtifactPermission to Foregin/* (was wildcard *)
- Use withEnv+single-quoted sh for dch to prevent BUILD_TAG injection
- Replace for/cat/awk mv loop with safe while IFS= read loop
  with -- and option-injection guard
- Validate pkgName with regex before apt-get install
- Use withEnv+single-quoted sh for apt-get to prevent pkgName injection
- Remove trusted local.list after install block

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Vitexus

Test/Jenkinsfile

@@ -17,7 +17,7 @@ String vendor = 'vitexsoftware'
 //String distroFamily = ''
 
 properties([
-    copyArtifactPermission('*'),
+    copyArtifactPermission('Foregin/*'),
     buildBlocker(
         useBuildBlocker: true,
         blockLevel: 'GLOBAL',
@@ -70,7 +70,9 @@ distributions.each { distro ->
                             export TMPDIR="/tmp/build-''' + uniqueBuildId + '''"
                             mkdir -p "$DH_INTERNAL_BUILDDIR" "$TMPDIR"
                         '''
-                        sh 'dch -b -v ' + buildVer  + ' "' + env.BUILD_TAG  + '"'
+                        withEnv(["BUILDVER=${buildVer}"]) {
+                            sh 'dch -b -v "$BUILDVER" "$BUILD_TAG"'
+                        }
                         sh 'sudo apt-get update --allow-releaseinfo-change'
                         sh 'sudo chown jenkins:jenkins ..'
                         sh 'sudo rm -rf debian/$(dpkg-parsechangelog --show-field Source)/ debian/.debhelper/ debian/tmp/'
@@ -79,7 +81,15 @@ distributions.each { distro ->
                             export TMPDIR="/tmp/build-''' + uniqueBuildId + '''"
                             debuild-pbuilder -r"sudo -E" -i -us -uc -b
                         '''
-                        sh 'mkdir -p $WORKSPACE/dist/debian/ ; rm -rf $WORKSPACE/dist/debian/* ; for deb in $(cat debian/files | awk \'{print $1}\'); do mv "../$deb" $WORKSPACE/dist/debian/; done'
+                        sh '''
+                            mkdir -p $WORKSPACE/dist/debian/
+                            rm -rf $WORKSPACE/dist/debian/*
+                            while IFS= read -r deb _; do
+                                case "$deb" in -*) continue;; esac
+                                [ -n "$deb" ] || continue
+                                mv -- "../$deb" "$WORKSPACE/dist/debian/"
+                            done < debian/files
+                        '''
                         artifacts = sh (
                             script: "cat debian/files | awk '{print \$1}'",
                             returnStdout: true
@@ -106,8 +116,11 @@ distributions.each { distro ->
                         sorted_artifacts.each { deb_file ->
                             if (deb_file.endsWith('.deb')) {
                                 def pkgName = deb_file.tokenize('/')[-1].replaceFirst(/_.*/, '')
-                                sh 'echo -e "${GREEN} installing ' + pkgName + ' on `lsb_release -sc` ${ENDCOLOR} "'
-                                sh 'sudo DEBIAN_FRONTEND=noninteractive DEBCONF_DEBUG=' + debconf_debug + ' apt-get -y install ' + pkgName
+                                if (!(pkgName ==~ /^[a-z0-9][a-z0-9+.\-]+$/)) { error("Invalid package name: ${pkgName}") }
+                                withEnv(["PKG=${pkgName}"]) {
+                                    sh 'echo "Installing $PKG on $(lsb_release -sc)"'
+                                    sh 'sudo DEBIAN_FRONTEND=noninteractive apt-get -y install "$PKG"'
+                                }
                             }
                         }
                     } else {
@@ -123,11 +136,15 @@ distributions.each { distro ->
                             }
                             if (debFile) {
                                 def pkgName = debFile.tokenize('/')[-1].replaceFirst(/_.*/, '')
-                                sh 'echo -e "${GREEN} installing ' + pkgName + ' on `lsb_release -sc` ${ENDCOLOR} "'
-                                sh 'sudo DEBIAN_FRONTEND=noninteractive DEBCONF_DEBUG=' + debconf_debug + ' apt-get -y install ' + pkgName
+                                if (!(pkgName ==~ /^[a-z0-9][a-z0-9+.\-]+$/)) { error("Invalid package name: ${pkgName}") }
+                                withEnv(["PKG=${pkgName}"]) {
+                                    sh 'echo "Installing $PKG on $(lsb_release -sc)"'
+                                    sh 'sudo DEBIAN_FRONTEND=noninteractive apt-get -y install "$PKG"'
+                                }
                             }
                         }
                     }
+                    sh 'sudo rm -f /etc/apt/sources.list.d/local.list'
 
                 }
                 stage('Archive artifacts ' + distroName ) {