Alien-Build

 view release on metacpan or  search on metacpan

Changes.Alien-Base  view on Meta::CPAN

0.018  Tue May 26, 2015
  - alien_stage_install is now on by default
    (first production release for this to be the case)

0.017  Fri Apr 24, 2015
  - Identical to 0.016_02 release, except alien_stage_install is
    OFF by default (it was turned on for dev release 0.016_01,
    and will be turned back on or after May 25).

0.016_02  Fri Apr 24, 2015
  - Fix bug where ConfigData.pm was not updated after install to blib
    (plicease gh#121)

0.016_01  Tue Apr 22, 2015
  - alien_stage_install is now on by default

0.016  Tue Apr 22, 2015
  - Production release identical to 0.015_03 release

0.015_03  Mon Apr 20, 2015
  - Fixed bug related to absolute URL (polettix++ gh#116)

Changes.Alien-Base  view on Meta::CPAN

	- Initialize temporary directories later
	- Note: released from "experimental" branch

0.001_001  Nov 4, 2012
	- Improved library detection
	- Library files are added to packlist
	- Note: released from "packlist" branch

0.001  Oct 9, 2012
	- First Beta release!
	- Documentation updated
	- Better autogeneration of pkgconfig information (run4flat++)

0.000_022  Oct 8, 2012
	- Major refactoring
		- separate alien_{x}_commands where x = build, test, install
		- removed mac specific code
		- no longer test provisioning (it never worked anyway)
		- directly allow library to install to final share_dir destination
	- Moved Alien::DontPanic and Ford::Prefect to CPAN under Acme:: namespaces

lib/Alien/Build/Manual/Security.pod  view on Meta::CPAN

=over 4

=item C<ALIEN_DOWNLOAD_RULE>

This environment variable configures how L<Alien::Build> will deal
with insecure protocols and files that do not include a cryptographic
signature.

Part of the design of the L<Alien::Build> system is that it typically
tries to download the latest version of a package instead of a fixed
version, so that the L<Alien> doesn't need to be updated when a new
alienized package is released.  This means that we frequently have
to rely on TLS or bundled alienized packages to ensure that the
alienized package is fetched securely.

Recently (as of L<Alien::Build> 2.59) we started supporting cryptographic
signatures defined in L<alienfile>s, but they are not yet very common,
and they only really work when a single alienized package URL is hard
coded into the L<alienfile> instead of the more typical mode of operation
where the latest version is downloaded.

=over 4

=item warn

This mode will warn you if an L<Alien::Build> based L<Alien> attempts
to fetch a alienized package insecurely.  It will also warn you if
a package doesn't have a cryptographic signature.  Neither of these
things wild stop the L<Alien> from being installed.

This is unfortunately currently the default mode of L<Alien::Build>,
for historical reasons.  Once plugins and L<Alien>s are updated to
either use secure fetch (TLS or bundled alienized packages), or
cryptographic signatures, the default will be changed to
C<digest_or_encrypt>.

=item digest_or_encrypt

This mode will require that before an alienized package is extracted
that it is either fetched via a secure protocol (C<http> or C<file>),
or the package matches a cryptographic signature.

lib/Alien/Build/Plugin/Download/Negotiate.pm  view on Meta::CPAN

    {
      Carp::croak "url is a required property unless you use the start_url directive";
    }
  }

  if($self->url =~ /^http.*github.com.*releases$/)
  {
    Alien::Build->log('!! WARNING !! WARNING !!');
    Alien::Build->log('!! WARNING !! It looks like this alien is using the regular download negotiator');
    Alien::Build->log('plugin on a GitHub release page.  This will typically not work due to changes');
    Alien::Build->log('in the way GitHub release page works now.  The Alien should instead be updated');
    Alien::Build->log('to use the Download::GitHub plugin, which uses the GitHub API to find available');
    Alien::Build->log('releases.  See: https://metacpan.org/pod/Alien::Build::Plugin::Download::GitHub');
    Alien::Build->log('!! WARNING !! WARNING !!');
  }

  $meta->add_requires('share' => 'Alien::Build::Plugin::Download::Negotiate' => '0.61')
    if $self->passive;

  $meta->prop->{plugin_download_negotiate_default_url} = $self->url;