Fix legacy Makefile install and command validation

- Fix install commands to handle Makefiles that don't respect DESTDIR

- Add fallback to PREFIX for legacy packages like bzip2

- Remove \n and \t from suspicious characters (valid in shell)

- Allow multi-line shell commands for complex install logic

cmd/install.go

@@ -1023,10 +1023,18 @@ func autoRecipeFromDebian(src *debian.SourceInfo) *recipe.Recipe {
 	}
 
 	// Use inline install commands instead of external script to avoid hardcoded paths
+	// For legacy Makefiles that don't respect DESTDIR, we need to use PREFIX={{pkgdir}}/usr
 	installCommands := []string{
 		"if [ -f build/cmake_install.cmake ]; then DESTDIR={{pkgdir}} cmake --install build; " +
 			"elif [ -f build/meson-private/coredata.dat ]; then DESTDIR={{pkgdir}} meson install -C build; " +
-			"elif [ -f Makefile ] || [ -f makefile ] || [ -f GNUmakefile ]; then make DESTDIR={{pkgdir}} PREFIX=/usr install; " +
+			"elif [ -f Makefile ] || [ -f makefile ] || [ -f GNUmakefile ]; then " +
+			"  # Try DESTDIR first, fall back to PREFIX for legacy Makefiles\n" +
+			"  if make -n DESTDIR={{pkgdir}} PREFIX=/usr install 2>/dev/null | grep -q 'mkdir.*{{pkgdir}}'; then\n" +
+			"    make DESTDIR={{pkgdir}} PREFIX=/usr install;\n" +
+			"  else\n" +
+			"    # Legacy Makefile - use PREFIX directly\n" +
+			"    make PREFIX={{pkgdir}}/usr install;\n" +
+			"  fi; " +
 			"else mkdir -p {{pkgdir}}/usr/bin {{pkgdir}}/usr/lib {{pkgdir}}/usr/include; fi",
 	}
 

pkg/builder/builder.go

@@ -682,7 +682,8 @@ func (b *Builder) validateCommand(command string) error {
 	}
 
 	// Check for suspicious characters that might indicate injection
-	suspiciousChars := []string{"\x00", "\r", "\n", "\t"}
+	// Note: \n (newline) and \t (tab) are valid in shell scripts for multi-line commands
+	suspiciousChars := []string{"\x00", "\r"}
 	for _, char := range suspiciousChars {
 		if strings.Contains(command, char) {
 			return fmt.Errorf("command contains suspicious character: %q", char)