App-MechaCPAN

 view release on metacpan or  search on metacpan

Changes  view on Meta::CPAN

  - Switch to using only tar for inflating archives, removing shell pipes
  - Clean up the logic around the cpanfile parsing, mainly around conflicts
  - Start doing SHA256 checks on perl and module installations
  - Add support for CHECKSUM checks on modules with the --verify option
  - Update the versoin of Try::Tiny in tests for new perl versions (GH#25)
  - Other small bugfixes

0.30  2023-08-22 22:29:58 EDT
  - Document the new prebuilt binary feature
  - Make the binary download feature not the default for the time being
  - Improve the binary download process not to throw an error when not found
  - Move --build-reusable to a global option --build-reusable-perl

0.29  2023-04-18 23:32:58 EDT
  - Add support to install from a cpanfile without using Deploy
  - Add feature to download prebuilt binries for popular linux distros
  - Improve SSL handling
  - Fix bug where install couldn't handle modules with names starting with git
  - Fix bug where install couldn't handle modules starting with git
  - Fix bug that prevented reusable perls from being threaded

lib/App/MechaCPAN.pm  view on Meta::CPAN

  die "CHECKSUMS URL must end with CHECKSUMS, not '$url'"
    unless $url =~ m{CHECKSUMS\z}xmsi;

  # Even if verification is optional, not downloading the CHECKSUMS is fatal
  my $checksums = '';
  fetch_file( $url, \$checksums );
  $checksums = App::MechaCPAN::_verify_checksums_body($checksums);

  # If $CHKSIGS is true, we must verify that CHECKSUMS has a valid signature
  # If $CHKSIGS is undef, we will verify that CHECKSUMS has a valid signature
  #   if possible, but won't throw errors if can't.
  # In both cases, the CHECKSUMS is used to validate the checksums of the
  #   downloaded file
  # If $CHKSIGS is otherwise false, we already did an early return above
  my $verify_fn = _resolve_verifier();

  if ( !defined $verify_fn )
  {
    die "Could not find verification program and verification was required"
      if $CHKSIGS;
    logmsg "CHECKSUMS signature not checked: PGP verifier not found";

t/09_checksums.t  view on Meta::CPAN

    local $body     = clearsign($basic_dd);
    local $verifier = undef;

    {
      $verifier_searched = 0;
      local $@;
      my $ok    = eval { App::MechaCPAN::get_cpan_checksums($url); 1 };
      my $error = $@;

      is( $ok,                1,  'get_cpan_checksums did completely run' );
      is( $error,             '', 'get_cpan_checksums did not throw an error' );
      is( $verifier_searched, 1,  'verifier search was called once' );
    }
  }

  # $CHKSIGS=1 + no verifier available — fatal
  {
    local $App::MechaCPAN::CHKSIGS = 1;
    local $body                    = clearsign($basic_dd);
    local $verifier                = undef;

t/09_checksums.t  view on Meta::CPAN

    };

    {
      $verifier_searched = 0;
      local $@;
      my $ok    = eval { App::MechaCPAN::get_cpan_checksums( $url, 'NoDeps-1.0.tar.gz' ); };
      my $error = $@;

      isnt( $ok, undef, 'get_cpan_checksums with known module did completely run' );
      is( ref $ok,            'HASH', 'get_cpan_checksums returns a hashref' );
      is( $error,             '',     'get_cpan_checksums did not throw an error' );
      is( $verifier_searched, 1,      'verifier search was called once' );
    }
    {
      $verifier_searched = 0;
      local $@;
      my $ok    = eval { App::MechaCPAN::get_cpan_checksums( $url, 'NoDeps-X.0.tar.gz' ); };
      my $error = $@;

      is( $ok,                undef, 'get_cpan_checksums with unknown module did completely run' );
      is( $error,             '',    'get_cpan_checksums did not throw an error' );
      is( $verifier_searched, 1,     'verifier search was called once' );
    }
  }

  # $CHKSIGS=1 + missing module = fatal
  {
    local $App::MechaCPAN::CHKSIGS = 1;
    local $body                    = clearsign($basic_dd);
    local $verifier                = sub
    {

t/09_checksums.t  view on Meta::CPAN

    };

    {
      $verifier_searched = 0;
      local $@;
      my $ok    = eval { App::MechaCPAN::get_cpan_checksums( $url, 'NoDeps-1.0.tar.gz' ); };
      my $error = $@;

      isnt( $ok, undef, 'get_cpan_checksums with known module did completely run' );
      is( ref $ok,            'HASH', 'get_cpan_checksums returns a hashref' );
      is( $error,             '',     'get_cpan_checksums did not throw an error' );
      is( $verifier_searched, 1,      'verifier search was called once' );
    }
    {
      $verifier_searched = 0;
      local $@;
      my $ok    = eval { App::MechaCPAN::get_cpan_checksums( $url, 'NoDeps-X.0.tar.gz' ); };
      my $error = $@;

      is( $ok,                undef, 'get_cpan_checksums with unknown module did completely run' );
      isnt( $error,           '', 'get_cpan_checksums throw an error' );
      is( $verifier_searched, 1, 'verifier search was called once' );
    }
  }
}

done_testing;