Module-Release-VerifyGPGSignature
view release on metacpan or search on metacpan
},
"test" : {
"requires" : {
"Test::More" : "1"
}
}
},
"release_status" : "stable",
"resources" : {
"bugtracker" : {
"web" : "https://github.com/briandfoy/module-release-verifygpgsignature/issues"
},
"homepage" : "https://github.com/briandfoy/module-release-verifygpgsignature",
"repository" : {
"type" : "git",
"url" : "https://github.com/briandfoy/module-release-verifygpgsignature",
"web" : "https://github.com/briandfoy/module-release-verifygpgsignature"
}
},
"version" : "0.002",
"x_serialization_backend" : "JSON::PP version 4.16"
}
version: '1.4'
name: Module-Release-VerifyGPGSignature
no_index:
directory:
- t
- inc
requires:
Carp: '0'
perl: '5.026'
resources:
bugtracker: https://github.com/briandfoy/module-release-verifygpgsignature/issues
homepage: https://github.com/briandfoy/module-release-verifygpgsignature
repository: https://github.com/briandfoy/module-release-verifygpgsignature
version: '0.002'
x_serialization_backend: 'CPAN::Meta::YAML version 0.018'
Makefile.PL view on Meta::CPAN
only needs v5.8. You can play with the data structure with a primitive
Perl.
=cut
use File::Spec::Functions qw(catfile);
my $module = __PACKAGE__;
( my $dist = $module ) =~ s/::/-/g;
my $github = 'https://github.com/briandfoy/module-release-verifygpgsignature';
my $main_file = catfile( 'lib', split /::/, "$module.pm" );
my %WriteMakefile = (
'MIN_PERL_VERSION' => '5.026',
'NAME' => $module,
'ABSTRACT_FROM' => $main_file,
'VERSION_FROM' => $main_file,
'LICENSE' => 'artistic_2',
'AUTHOR' => 'brian d foy <briandfoy@pobox.com>',
=pod
=encoding utf8
=for HTML <a href="https://www.github.com/briandfoy/module-release-verifygpgsignature/actions?query=workflow%3Amacos"><img src="https://www.github.com/briandfoy/module-release-verifygpgsignature/workflows/macos/badge.svg"></a>
=for HTML <a href="https://www.github.com/briandfoy/module-release-verifygpgsignature/actions?query=workflow%3Aubuntu"><img src="https://www.github.com/briandfoy/module-release-verifygpgsignature/workflows/ubuntu/badge.svg"></a>
=for HTML <a href="https://www.github.com/briandfoy/module-release-verifygpgsignature/actions?query=workflow%3Awindows"><img src="https://www.github.com/briandfoy/module-release-verifygpgsignature/workflows/windows/badge.svg"></a>
=for HTML <a href='https://ci.appveyor.com/project/briandfoy/module-release-verifygpgsignature'><img src='https://ci.appveyor.com/api/projects/status/8ieweanxf0iwe9no?svg=true'></a>
=for HTML <a href='https://coveralls.io/github/briandfoy/module-release-verifygpgsignature?branch=master'><img src='https://coveralls.io/repos/github/briandfoy/module-release-verifygpgsignature/badge.svg?branch=master' alt='Coverage Status' /></a>
=for HTML <a href="https://github.com/briandfoy/module-release-verifygpgsignature/blob/master/LICENSE"><img src="https://img.shields.io/cpan/l/Module-Release-VerifyGPGSignature.svg" /></a>
=for HTML <a href="https://metacpan.org/pod/Module::Release::VerifyGPGSignature"><img src="https://img.shields.io/cpan/v/Module-Release-VerifyGPGSignature.svg" /></A>
=head1 The Module::Release::VerifyGPGSignature module
This is the I<README> for the L<Module::Release::VerifyGPGSignature> Perl module.
You're probably looking at this because you don't know where else to
find what you're looking for. Read this once and you might never have
to read one again for any Perl module.
% make install
You probably don't want to do that unless you're fiddling with the
module and only want to run the tests without installing anything.
=head2 Source location
The meta data, such as the source repository and bug tracker, is in
I<Makefile.PL> or the I<META.*> files it creates. You can find that on
those CPAN web interfaces, but you can also look at files directly in
the source repository: L<https://github.com/briandfoy/module-release-verifygpgsignature>
If you find a problem, file a ticket in the L<issue
tracker|https://github.com/briandfoy/module-release-verifygpgsignature/issues>.
There are also backup repositories hosted on other services. These
reflect the state of the main repo and exist only for redundancy:
=over 4
=item * L<https://bitbucket.com/briandfoy/module-release-verifygpgsignature>
=item * L<https://codeberg.org/briandfoy/module-release-verifygpgsignature>
=item * L<https://gitlab.com/briandfoy/module-release-verifygpgsignature>
=back
=head2 GitHub Attestations
This distribution now uses
L<GitHub Attestations|https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/>,
which allow you to verify that the archive file you have was made from
the official repo.
lib/Module/Release/VerifyGPGSignature.pm view on Meta::CPAN
use v5.20;
package Module::Release::VerifyGPGSignature;
use strict;
use experimental qw(signatures);
use warnings;
no warnings;
use Exporter qw(import);
our @EXPORT = qw(check_all_gpg_signatures check_gpg_signature);
our $VERSION = '0.002';
=encoding utf8
=head1 NAME
Module::Release::VerifyGPGSignature - Verify GPG signatures in the distro
=head1 SYNOPSIS
use Module::Release::VerifyGPGSignature;
=head1 DESCRIPTION
Configure in F<.releaserc> as a list of pairs:
gpg_signatures \
file.txt file.txt.gpg \
file2.txt file2.txt.gpg
=over 4
=cut
sub _get_file_pairs ( $self ) {
state $rc = require Getopt::Long;
my $key = _key($self);
my $string = $self->config->$key();
lib/Module/Release/VerifyGPGSignature.pm view on Meta::CPAN
my @pairs;
while( @$args > 1 ) {
push @pairs, [ splice @$args, 0, 2, () ];
}
push @pairs, [ @$args ] if @$args;
\@pairs
}
sub _key ( $self ) { 'gpg_signatures' }
=item * check_all_gpg_signatures
Go through all files and signature files listed in the C<gpg_signatures>
and verify that the signatures match.
=cut
sub check_all_gpg_signatures ( $self ) {
my $pairs = $self->_get_file_pairs;
foreach my $pair ( $pairs->@* ) {
$self->check_gpg_signature( $pair->@* )
}
return 1;
}
=item * check_gpg_signature( FILE, SIGNATURE_FILE )
Checks the PGP signature in SIGNATURE_FILE matches for FILE.
=cut
sub check_gpg_signature ( $self, $file, $signature_file ) {
$self->_print( "Checking GPG signature of <$file>...\n" );
$self->_die( "\nERROR: Could not verify signature of <$file>: file does not exist\n" )
unless -e $file;
$self->_die( "\nERROR: Could not verify signature of <$file> with <$signature_file>: signature file does not exist\n" )
unless -e $signature_file;
my $result = $self->run( qq(gpg --verify "$signature_file" "$file" 2>&1) );
$result =~ s/^/ /mg;
$self->_print( "$result" );
unless( $result =~ /\bGood signature from\b/ ) {
$self->_die( "\nERROR: signature verification failed" );
}
return 1;
}
lib/Module/Release/VerifyGPGSignature.pm view on Meta::CPAN
=head1 TO DO
=head1 SEE ALSO
=head1 SOURCE AVAILABILITY
This source is in Github:
http://github.com/briandfoy/module-release-verifygpgsignature
=head1 AUTHOR
brian d foy, C<< <brian d foy> >>
=head1 COPYRIGHT AND LICENSE
Copyright © 2022, brian d foy, All Rights Reserved.
You may redistribute this under the terms of the Artistic License 2.0.
( run in 0.899 second using v1.01-cache-2.11-cpan-df04353d9ac )