view release on metacpan or  search on metacpan

README  view on Meta::CPAN

    attempted, but will not produce an error if the external verification
    program could not be found, or the file is from backpan and has no
    corrisponding CHECKSUMS entry. An error is still raised if any other
    parts of the process finds a problem.

    If MetaCPAN <https://metacpan.org> was used to find a module, the
    search will include the SHA256 of the package, which will be checked
    against the downloaded archive. This check cannot be disabled
    currently.

    The verification programs that can be used are: gpgv
    <https://www.gnupg.org/>, sqv <https://sequoia-pgp.org/>, gpg, sq, and
    rnp <https://www.rnpgp.org/>.

 --directory=<path>

    Changes to a specified directory before any processing is done. This
    allows you to specify what directory you want local/ to be in. If this
    isn't provided, the current working directory is used instead.

 --build-reusable-perl

lib/App/MechaCPAN.pm  view on Meta::CPAN

    open my $keyring_fh, '>', $cache_path;
    print $keyring_fh $keyring;

    $keyring_path = $cache_path;
  }

  return $keyring_path;
}

#gpgv, sqv, gpg, sq, and rnp
my @verifier = (
  sub
  {
    return
      if !eval { run(qw/gpgv --version/); 1 };

    return sub
    {
      my ( $file, $keyring ) = @_;
      run_qvf( "gpgv", "--keyring", "$keyring", "$file" );
    };
  },
  sub
  {
    my $out = eval { run(qw/sqv --version/) };
    return
      if !defined $out;
    my ($major) = $out =~ m/(\d+)\.\d+(?:\.\d+)?/;
    return
      if !defined $major || $major < 1;

    return sub
    {
      my ( $file, $keyring ) = @_;
      run_qvf( "sqv", "--keyring", "$keyring", "$file" );
    };
  },
  sub
  {
    return
      if !eval { run(qw/gpg --version/); 1 };

    return sub
    {
      my ( $file, $keyring ) = @_;
      run_qvf( "gpg", "--no-default-keyring", "--keyring", "$keyring",
        "--verify", "$file" );
    };
  },
  sub
  {
    my $out = eval { run(qw/sq --version/) };
    return
      if !defined $out;
    my ($major) = $out =~ m/(\d+)\.\d+(?:\.\d+)?/;
    return

lib/App/MechaCPAN.pm  view on Meta::CPAN

Once the CHECKSUMS file has been checked, the size, CPAN author path, and the C<sha256> value of the downloaded module archive are compared against the values from the CHECKSUMS file. These values must match.

=back

You can also disable C<CHECKSUMS> verification completely with C<--no-verify>. That will prevent all of these steps from running at all.

When neither option is provided then the signature checking step is attempted, but will not produce an error if the external verification program could not be found, or the file is from backpan and has no corrisponding C<CHECKSUMS> entry. An error is...

If L<MetaCPAN|https://metacpan.org> was used to find a module, the search will include the SHA256 of the package, which will be checked against the downloaded archive. This check cannot be disabled currently.

The verification programs that can be used are: L<gpgv|https://www.gnupg.org/>, L<sqv|https://sequoia-pgp.org/>, L<gpg|https://www.gnupg.org/>, L<sq|https://sequoia-pgp.org/>, and L<rnp|https://www.rnpgp.org/>.

=head2 --directory=<path>

Changes to a specified directory before any processing is done. This allows you to specify what directory you want C<local/> to be in. If this isn't provided, the current working directory is used instead.

=head2 --build-reusable-perl

Giving this options will override the mode of operation and generate a reusable, relocatable L<perl> archive. This accepts the same parameters as the L<Perl|App::MechaCPAN::Perl> command (i.e. L</devel> and L</threads>) to generate the binary. Note t...

Once you have a reusable binary archive, L<App::MechaCPAN::Perl> can use that archive as a source file and install the binaries into the local directory. This can be handy if you are building a lot of identical systems and only want to build L<perl> ...