view release on metacpan or  search on metacpan

README  view on Meta::CPAN

    When --verify is given, a verification of the CPAN CHECKSUMS file
    during module install is required. Note that packages from BackPAN
    <https://backpan.perl.org/> will not verify when --verify is given.
    This process includes three steps after downloading the CHECKSUMS file
    from CPAN for the module.

    1. Confirm the shape of CHECKSUMS

      CHECKSUMS files contain all the files and the file checksums for a
      CPAN author's uploads. This file is compared against a rigid
      definition to ensure that it does not appear to be doing anything
      malicious.

    2. Confirm the signature of CHECKSUMS

      Once the CHECKSUMS structure has been examined, the embedded
      signature is verified. The CHECKSUMS file is signed using the PAUSE
      Batch Signing Key (2E66 557A B97C 19C7 91AF 8E20 328D A867 450F 89EC,
      accessible at https://www.cpan.org/modules/04pause.html). This
      signature is checked with an external PGP signature verification

lib/App/MechaCPAN.pm  view on Meta::CPAN

A log is normally outputted into the C<local/logs> directory. This option will prevent a log from being created.

=head2 --verify

When C<--verify> is given, a verification of the CPAN C<CHECKSUMS> file during module install is required. Note that packages from L<BackPAN|https://backpan.perl.org/> will not verify when C<--verify> is given. This process includes three steps after...

=over

=item 1. Confirm the shape of CHECKSUMS

C<CHECKSUMS> files contain all the files and the file checksums for a CPAN author's uploads. This file is compared against a rigid definition to ensure that it does not appear to be doing anything malicious.

=item 2. Confirm the signature of CHECKSUMS

Once the C<CHECKSUMS> structure has been examined, the embedded signature is verified. The C<CHECKSUMS> file is signed using the PAUSE Batch Signing Key (C<2E66 557A B97C 19C7 91AF  8E20 328D A867 450F 89EC>, accessible at L<https://www.cpan.org/modu...

=item 3. Compare the sha256 of the downloaded module to CHECKSUMS

Once the CHECKSUMS file has been checked, the size, CPAN author path, and the C<sha256> value of the downloaded module archive are compared against the values from the CHECKSUMS file. These values must match.

=back

test_dists/build-ShadyTars.pl  view on Meta::CPAN

use File::Spec;

my $basedir = dirname( File::Spec->rel2abs(__FILE__) );
my $pwd     = File::Spec->catfile( $basedir, 'ShadyTars' );
chdir $pwd;

# Make sure the attributes are consistent
my %attrs = (
  mtime => 0,
  uid   => 0,
  gid   => 0,
  uname => '',
  gname => '',
);

sub gen_tar
{
  my ( $name, @contents ) = @_;

  my $path = File::Spec->catfile( $pwd, $name );
  my $tar  = Archive::Tar->new;