Intrepid has asked for the wisdom of the Perl Monks concerning the following question:

Hello Monks. Been a long time. Something like 10 years.

I'm working on a machine that has both Strawberry Perl and Cygwin Perl installed. In Strawberry I am using cpan (CPAN.pm) to install / update CPAN modules. That's working well.

The problem is when using cpanp (CPANPLUS) to install / update CygwinPerl. For most modules the process works correctly, but some modules cannot be installed. These are modules that are signed with PGP/GPG. I get error output like the following:

Installing CPAN (2.37) gpg: Fatal: can't create directory '/cygdrive/c/Users/somia/AppData/Lo +cal/.cpanp/.cpanplus/5.40.0/Installing CPAN (2.37) gpg: Fatal: can't create directory '/cygdrive/c/Users/somia/AppData/Lo +cal/.cpanp/.cpanplus/5.40.0/build/psZPVjvSp4/CPAN-2.37/C:/Users/somia +/.gnupg': No such file or directory ==> BAD/TAMPERED signature detected! <== [ERROR] Signature check failed for module 'CPAN' -- Not trusting this +module, aborting install

Carefully notice the path that ends in build/psZPVjvSp4/CPAN-2.37/C:/Users/somia/.gnupg. That's obviously impossible. I don't know which module is doing this but it is a bug. So is the message that a bad / tampered signature is detected; that's not what's happening. Also, note that the fact that I am using cpanp is incidental and not causal. The same results take place when I attempt to install manually.

Please also note that I realize as a long-time Cygwin user, that Cygwin setup has dozens or more packaged CPAN modules available. I just prefer using cpanp. This problem is like a piece of meat stuck in my teeth that I keep worrying at ;-)

I appreciate the attention of the monks to this.

EDIT

I've found the culprit, and it isn't Perl - just as Rob suspected. It's GPG. That's in Cygwin's /usr/bin (ikegami) and here's output from gpg --help:

$ gpg --help gpg (GnuPG) 2.4.5-unknown libgcrypt 1.11.0-unknown Copyright (C) 2024 g10 Code GmbH License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: /cygdrive/c/Users/somia/C:/Users/somia/.gnupg

Color me astonished. That's something that you'd think would have shown up in Cygwin list discussions. I will take this new question over there. I will do what Danny did and configure cpanp to not check signatures. Thanks all for the interest.

Examine what is said, not who speaks.
Love the truth but pardon error.
Silence betokens consent.
In the absence of evidence, opinion is indistinguishable from prejudice.

Replies are listed 'Best First'.
Re: GPG-Signed modules fail to install using cpanp under CygwinPerl
by Danny (Chaplain) on Sep 29, 2024 at 21:52 UTC
    Can you give an example (or several) of modules with this issue so others can check?
      The perl -V output might also be handy - though my suspicion is that the issue has little, if anything, to do with perl itself.
      I've struck no such problems with my own builds of perl-5.40.0 on Cygwin.

      Cheers,
      Rob

        Rob asked for the output of perl -v.

        $ perl -v This is perl 5, version 40, subversion 0 (v5.40.0) built for x86_64-cy +gwin-threads-multi (with 3 registered patches, see perl -V for more detail)

        I am going to show output of perl -V also (which may be what Rob meant anyhow).

        Summary of my perl5 (revision 5 version 40 subversion 0) configuration +: Platform: osname=cygwin osvers=3.5.3-1.x86_64 archname=x86_64-cygwin-threads-multi uname='cygwin_nt-10.0-22631 walter 3.5.3-1.x86_64 2024-04-03 17:25 + utc x86_64 cygwin ' config_args='-des -Dprefix=/usr -Dmksymlinks -Darchname=x86_64-cyg +win-threads -Dlibperl=cygperl5_40.dll -Dcc=gcc -Dld=g++ -Accflags=-gg +db -O2 -pipe -Wall -Werror=format-security -D_FORTIFY_SOURCE=3 -fstac +k-protector-strong --param=ssp-buffer-size=4 -ffile-prefix-map=/mnt/s +hare/cygpkgs/perl/perl.x86_64/build=/usr/src/debug/perl-5.40.0-1 -ffi +le-prefix-map=/mnt/share/cygpkgs/perl/perl.x86_64/src/perl-5.40.0=/us +r/src/debug/perl-5.40.0-1 -fwrapv' hint=recommended useposix=true d_sigaction=define useithreads=define usemultiplicity=define use64bitint=define use64bitall=define uselongdouble=undef usemymalloc=n default_inc_excludes_dot=define Compiler: cc='gcc' ccflags ='-U__STRICT_ANSI__ -D_GNU_SOURCE -ggdb -O2 -pipe -Wall -W +error=format-security -D_FORTIFY_SOURCE=3 -fstack-protector-strong -- +param=ssp-buffer-size=4 -ffile-prefix-map=/mnt/share/cygpkgs/perl/per +l.x86_64/build=/usr/src/debug/perl-5.40.0-1 -ffile-prefix-map=/mnt/sh +are/cygpkgs/perl/perl.x86_64/src/perl-5.40.0=/usr/src/debug/perl-5.40 +.0-1 -fwrapv -fno-strict-aliasing' optimize='-O3' cppflags='-U__STRICT_ANSI__ -D_GNU_SOURCE -ggdb -O2 -pipe -Wall -W +error=format-security -D_FORTIFY_SOURCE=3 -fstack-protector-strong -- +param=ssp-buffer-size=4 -ffile-prefix-map=/mnt/share/cygpkgs/perl/per +l.x86_64/build=/usr/src/debug/perl-5.40.0-1 -ffile-prefix-map=/mnt/sh +are/cygpkgs/perl/perl.x86_64/src/perl-5.40.0=/usr/src/debug/perl-5.40 +.0-1 -fwrapv -fno-strict-aliasing' ccversion='' gccversion='12.4.0' gccosandvers='' intsize=4 longsize=8 ptrsize=8 doublesize=8 byteorder=12345678 doublekind=3 d_longlong=define longlongsize=8 d_longdbl=define longdblsize=16 longdblkind=3 ivtype='long' ivsize=8 nvtype='double' nvsize=8 Off_t='off_t' lseeksize=8 alignbytes=8 prototype=define Linker and Libraries: ld='g++' ldflags =' -Wl,--enable-auto-import -Wl,--export-all-symbols -Wl,- +-enable-auto-image-base -fstack-protector-strong' libpth=/usr/lib libs=-lpthread -lgdbm -ldb -ldl -lcrypt -lgdbm_compat perllibs=-lpthread -ldl -lcrypt libc=/usr/lib/libcygwin.a so=dll useshrplib=true libperl=cygperl5_40.dll gnulibc_version='' Dynamic Linking: dlsrc=dl_dlopen.xs dlext=dll d_dlsymun=undef ccdlflags=' ' cccdlflags=' ' lddlflags=' --shared -Wl,--enable-auto-import -Wl,--export-all-sy +mbols -Wl,--enable-auto-image-base -fstack-protector-strong' Characteristics of this binary (from libperl): Compile-time options: HAS_LONG_DOUBLE HAS_STRTOLD HAS_TIMES MULTIPLICITY PERLIO_LAYERS PERL_COPY_ON_WRITE PERL_DONT_CREATE_GVSV PERL_HASH_FUNC_SIPHASH13 PERL_HASH_USE_SBOX32 PERL_OP_PARENT PERL_PRESERVE_IVUV PERL_USE_SAFE_PUTENV USE_64_BIT_ALL USE_64_BIT_INT USE_ITHREADS USE_LARGE_FILES USE_LOCALE USE_LOCALE_COLLATE USE_LOCALE_CTYPE USE_LOCALE_NUMERIC USE_LOCALE_TIME USE_PERLIO USE_PERL_ATOF USE_REENTRANT_API USE_THREAD_SAFE_LOCALE Locally applied patches: Cygwin: README Cygwin: modify hints Cygwin: Win32 correct UTF8 handling for tests Built under cygwin Compiled at Aug 17 2024 18:10:01 %ENV: PERL5_CPANPLUS_HOME="C:/Users/somia/AppData/Local/.cpanp" @INC: /usr/local/lib/perl5/site_perl/5.40/x86_64-cygwin-threads /usr/local/share/perl5/site_perl/5.40 /usr/lib/perl5/vendor_perl/5.40/x86_64-cygwin-threads /usr/share/perl5/vendor_perl/5.40 /usr/lib/perl5/5.40/x86_64-cygwin-threads /usr/share/perl5/5.40

        Thanks for your interest in my dilemma Rob. Cheers.

        - Intrepid

Re: GPG-Signed modules fail to install using cpanp under CygwinPerl
by ikegami (Patriarch) on Oct 01, 2024 at 01:44 UTC

    How did you install gpg? Is it a Windows install or a Cygwin install? Does it have a config file you can examine?

      My gpg "/usr/bin/gpg" is from the cygwin gnupg2 package. I see some example config files and a gpgconf man page. Below is a list of files in that package. From the error I got it seems it expected me to have a public gpg key for key 7EFCE8AC421EE20A from hkp://keyserver.ubuntu.com:11371. Apparently, cpanp only does gpg checks if it detects that you have gpg installed. Thus, if you don't care about that you can just disable it by setting signature 0.
      /usr/bin/dirmngr-client.exe /usr/bin/dirmngr.exe /usr/bin/gpg-agent.exe /usr/bin/gpg-card.exe /usr/bin/gpg-connect-agent.exe /usr/bin/gpg-wks-client.exe /usr/bin/gpg-wks-server.exe /usr/bin/gpg2.exe /usr/bin/gpgconf.exe /usr/bin/gpgparsemail.exe /usr/bin/gpgscm.exe /usr/bin/gpgsm.exe /usr/bin/gpgsplit.exe /usr/bin/gpgtar.exe /usr/bin/gpgv2.exe /usr/bin/kbxutil.exe /usr/bin/watchgnupg.exe /usr/libexec/dirmngr_ldap.exe /usr/libexec/gpg-auth.exe /usr/libexec/gpg-check-pattern.exe /usr/libexec/gpg-pair-tool.exe /usr/libexec/gpg-preset-passphrase.exe /usr/libexec/gpg-protect-tool.exe /usr/libexec/gpg-wks-client /usr/libexec/keyboxd.exe /usr/libexec/scdaemon.exe /usr/sbin/addgnupghome /usr/sbin/applygnupgdefaults /usr/share/doc/gnupg2/AUTHORS /usr/share/doc/gnupg2/ChangeLog /usr/share/doc/gnupg2/COPYING /usr/share/doc/gnupg2/COPYING.LGPL21 /usr/share/doc/gnupg2/COPYING.LGPL3 /usr/share/doc/gnupg2/DCO /usr/share/doc/gnupg2/DETAILS /usr/share/doc/gnupg2/examples/common.conf /usr/share/doc/gnupg2/examples/gpgconf.conf /usr/share/doc/gnupg2/examples/gpgconf.rnames /usr/share/doc/gnupg2/examples/pwpattern.list /usr/share/doc/gnupg2/examples/qualified.txt /usr/share/doc/gnupg2/examples/README /usr/share/doc/gnupg2/examples/scd-event /usr/share/doc/gnupg2/examples/trustlist.txt /usr/share/doc/gnupg2/FAQ /usr/share/doc/gnupg2/HACKING /usr/share/doc/gnupg2/KEYSERVER /usr/share/doc/gnupg2/NEWS /usr/share/doc/gnupg2/OpenPGP /usr/share/doc/gnupg2/README /usr/share/doc/gnupg2/THANKS /usr/share/doc/gnupg2/TODO /usr/share/doc/gnupg2/TRANSLATE /usr/share/gnupg/distsigkey.gpg /usr/share/gnupg/help.be.txt /usr/share/gnupg/help.ca.txt /usr/share/gnupg/help.cs.txt /usr/share/gnupg/help.da.txt /usr/share/gnupg/help.de.txt /usr/share/gnupg/help.el.txt /usr/share/gnupg/help.eo.txt /usr/share/gnupg/help.es.txt /usr/share/gnupg/help.et.txt /usr/share/gnupg/help.fi.txt /usr/share/gnupg/help.fr.txt /usr/share/gnupg/help.gl.txt /usr/share/gnupg/help.hu.txt /usr/share/gnupg/help.id.txt /usr/share/gnupg/help.it.txt /usr/share/gnupg/help.ja.txt /usr/share/gnupg/help.nb.txt /usr/share/gnupg/help.pl.txt /usr/share/gnupg/help.pt.txt /usr/share/gnupg/help.pt_BR.txt /usr/share/gnupg/help.ro.txt /usr/share/gnupg/help.ru.txt /usr/share/gnupg/help.sk.txt /usr/share/gnupg/help.sv.txt /usr/share/gnupg/help.tr.txt /usr/share/gnupg/help.txt /usr/share/gnupg/help.zh_CN.txt /usr/share/gnupg/help.zh_TW.txt /usr/share/gnupg/sks-keyservers.netCA.pem /usr/share/info/gnupg.info-1.gz /usr/share/info/gnupg.info-2.gz /usr/share/info/gnupg.info-3.gz /usr/share/info/gnupg.info.gz /usr/share/locale/ca/LC_MESSAGES/gnupg2.mo /usr/share/locale/cs/LC_MESSAGES/gnupg2.mo /usr/share/locale/da/LC_MESSAGES/gnupg2.mo /usr/share/locale/de/LC_MESSAGES/gnupg2.mo /usr/share/locale/el/LC_MESSAGES/gnupg2.mo /usr/share/locale/en@boldquot/LC_MESSAGES/gnupg2.mo /usr/share/locale/en@quot/LC_MESSAGES/gnupg2.mo /usr/share/locale/eo/LC_MESSAGES/gnupg2.mo /usr/share/locale/es/LC_MESSAGES/gnupg2.mo /usr/share/locale/et/LC_MESSAGES/gnupg2.mo /usr/share/locale/fi/LC_MESSAGES/gnupg2.mo /usr/share/locale/fr/LC_MESSAGES/gnupg2.mo /usr/share/locale/gl/LC_MESSAGES/gnupg2.mo /usr/share/locale/hu/LC_MESSAGES/gnupg2.mo /usr/share/locale/id/LC_MESSAGES/gnupg2.mo /usr/share/locale/it/LC_MESSAGES/gnupg2.mo /usr/share/locale/ja/LC_MESSAGES/gnupg2.mo /usr/share/locale/nb/LC_MESSAGES/gnupg2.mo /usr/share/locale/pl/LC_MESSAGES/gnupg2.mo /usr/share/locale/pt/LC_MESSAGES/gnupg2.mo /usr/share/locale/ro/LC_MESSAGES/gnupg2.mo /usr/share/locale/ru/LC_MESSAGES/gnupg2.mo /usr/share/locale/sk/LC_MESSAGES/gnupg2.mo /usr/share/locale/sv/LC_MESSAGES/gnupg2.mo /usr/share/locale/tr/LC_MESSAGES/gnupg2.mo /usr/share/locale/uk/LC_MESSAGES/gnupg2.mo /usr/share/locale/zh_CN/LC_MESSAGES/gnupg2.mo /usr/share/locale/zh_TW/LC_MESSAGES/gnupg2.mo /usr/share/man/man1/dirmngr-client.1.gz /usr/share/man/man1/gpg-agent.1.gz /usr/share/man/man1/gpg-card.1.gz /usr/share/man/man1/gpg-check-pattern.1.gz /usr/share/man/man1/gpg-connect-agent.1.gz /usr/share/man/man1/gpg-preset-passphrase.1.gz /usr/share/man/man1/gpg-wks-client.1.gz /usr/share/man/man1/gpg-wks-server.1.gz /usr/share/man/man1/gpg2.1.gz /usr/share/man/man1/gpgconf.1.gz /usr/share/man/man1/gpgparsemail.1.gz /usr/share/man/man1/gpgsm.1.gz /usr/share/man/man1/gpgtar.1.gz /usr/share/man/man1/gpgv2.1.gz /usr/share/man/man1/scdaemon.1.gz /usr/share/man/man1/watchgnupg.1.gz /usr/share/man/man7/gnupg.7.gz /usr/share/man/man8/addgnupghome.8.gz /usr/share/man/man8/applygnupgdefaults.8.gz /usr/share/man/man8/dirmngr.8.gz /usr/bin/gpg /usr/bin/gpgv
Re: GPG-Signed modules fail to install using cpanp under CygwinPerl
by Danny (Chaplain) on Sep 30, 2024 at 20:49 UTC
    FWIW, I got the same error trying to install CPAN with cpanp.
    export PERL5_CPANPLUS_HOME=/home/me cpanp -i CPAN [MSG] No '/home/me/.cpanplus/custom-sources' dir, skipping custom sour +ces [MSG] No '/home/me/.cpanplus/custom-sources' dir, skipping custom sour +ces [MSG] No '/home/me/.cpanplus/custom-sources' dir, skipping custom sour +ces Installing CPAN (2.37) gpg: Signature made Fri Aug 30 13:11:50 2024 EDT gpg: using RSA key C40BA553F730173DA63AA20F7EFCE8AC421E +E20A gpg: requesting key 7EFCE8AC421EE20A from hkp://keyserver.ubuntu.com:1 +1371 gpg: Can't check signature: No public key ==> BAD/TAMPERED signature detected! <== [ERROR] Signature check failed for module 'CPAN' -- Not trusting this +module, aborting install
    but, turning off signatures worked.
    cpanp CPAN Terminal> s conf signature 0 CPAN Terminal> i CPAN Installing CPAN (2.37) ... All tests successful. Files=32, Tests=627, 217 wallclock secs ( 0.11 usr 0.14 sys + 23.52 c +usr 85.69 csys = 109.46 CPU) Result: PASS *** Install log written to: /home/me/.cpanplus/install-logs/CPAN-2.37-1727728783.log Module 'CPAN' installed successfully No errors installing all modules
    cpan CPAN and cpanm CPAN both worked without issue.

      I just thought I'd add what I have found so far.

      The GnuPG manpage describes homedir and an environmental var one can set:

      --homedir directory Set the name of the home directory to directory If this option is not +used it defaults to "~/.gnupg". It does not make sense to use this in + a options file. This also overrides the environment variable "GNUPGH +OME".

      I tried setting GNUPGHOME to C:/Users/somia/.gnupg (which already exists; something along the line created that dir) ...but as stated above, it is overridden when some Perl code (in Module::Signature?) calls gpg. So keeping signature-checking off as Danny and others say, is the smart move until someone fixes this strange behavior. ;-/

        For my own build of perl-5.40.0 on Cygwin, upgrading CPAN from 2.36 to 2.37 worked fine:
        $ cpanp i CPAN Installing CPAN (2.37) Running [/cygdrive/c/cygperl-5.40.0-d/bin/perl -MCPANPLUS::Internals:: +Utils::Autoflush C:/Users/Owner/AppData/Roaming/.cpanplus/5.40.0/buil +d/GoTwSCMIxI/CPAN-2.37/Makefile.PL]... Checking if your kit is complete... Looks good Generating a Unix-style Makefile Writing Makefile for CPAN Writing MYMETA.yml and MYMETA.json Running [/usr/bin/make test]... PERL_DL_NONLAZY=1 "/cygdrive/c/cygperl-5.40.0-d/bin/perl.exe" "-MExtUt +ils::Command::MM" "-MTest::Harness" "-e" "undef *Test::Harness::Switc +hes; test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/00signature.t ............... skipped: External program 'gpg' not fo +und t/01loadme.t .................. ok t/02nox.t ..................... ok t/03pkgs.t .................... ok t/04clean_load.t .............. ok t/10version.t ................. ok t/11mirroredby.t .............. ok t/12cpan.t .................... ok t/13tarzip.t .................. ok t/14forkbomb.t ................ skipped: test only run when called wit +h --doit t/30shell.t ................... skipped: no Expect, maybe try env CPAN +_RUN_SHELL_TEST_WITHOUT_EXPECT=1 t/31sessions.t ................ skipped: Yaml module [YAML] not instal +led t/32pushyhttps.t .............. skipped: running MinimumVersion test o +nly run when AUTHOR_TEST set t/41distribution.t ............ skipped: No yaml module installed t/42distroprefs.t ............. skipped: YAML required t/43distroprefspref.t ......... ok t/44cpanmeta.t ................ ok t/50pod.t ..................... skipped: Test::Pod 1.00 required for t +esting POD t/51pod.t ..................... ok t/52podcover.t ................ skipped: Test::Pod::Coverage 0.18 requ +ired for testing pod coverage t/60credentials.t ............. ok t/70_critic.t ................. skipped: Test::Perl::Critic only run w +hen AUTHOR_TEST set t/71_minimumversion.t ......... skipped: running MinimumVersion test o +nly run when AUTHOR_TEST set t/97-compile.t ................ ok t/97-cpanpm_output_hook.t ..... ok t/97-expand_filenames.t ....... ok t/97-install_hack.t ........... ok t/97-mock.t ................... ok t/97-process_options.t ........ ok t/97-process_setup_options.t .. ok t/97-return_values.t .......... ok # will run '/cygdrive/c/cygperl-5.40.0-d/bin/perl -Mblib blib/script/c +pan -y 2>&1' # will run '/cygdrive/c/cygperl-5.40.0-d/bin/perl -Mblib blib/script/c +pan -h 2>&1' t/97-run.t .................... ok All tests successful. Files=32, Tests=476, 30 wallclock secs ( 0.00 usr 0.00 sys + 7.07 cu +sr 9.36 csys = 16.43 CPU) Result: PASS *** Install log written to: C:/Users/Owner/AppData/Roaming/.cpanplus/install-logs/CPAN-2.37-1727 +840241.log Module 'CPAN' installed successfully No errors installing all modules
        The log begins with:
        [MSG] [Wed Oct 2 13:36:37 2024] Trying to get 'http://www.cpan.org/au +thors/id/A/AN/ANDK/CPAN-2.37.tar.gz' [MSG] [Wed Oct 2 13:36:41 2024] Trying to get 'http://www.cpan.org/au +thors/id/A/AN/ANDK/CHECKSUMS' [MSG] [Wed Oct 2 13:36:42 2024] Checksum matches for 'CPAN-2.37.tar.g +z' [MSG] [Wed Oct 2 13:36:42 2024] Extracting 'CPAN-2.37.tar.gz'
        followed by a list of all of the files that were extracted by the tarball - and then proceeds to display essentially the same as was sent to the bash terminal (but, additionally, with a listing of all files that were actually installed.)

        No sign of any gpg stuff going on.
        Maybe I need to use the system perl to encounter the "gpg" issue.

        My cygwin installation is a few years old (perl-5.32.1, gcc-11.3.0) and the "cpan" utility won't even work properly with it.
        That suits me fine, as I really don't want to mess with that perl installation.
        However, I did a manual build of CPAN-2.37 using that perl and all went well - even the "make install" step. (I figured I could probably get with the "make install" without doing any damage.)

        FWIW, the Configure args that I use to build perl on Cygwin are:
        $ perl -V:config_args config_args='-des -Dusethreads -Dusemultiplicity -Dprefix=/cygdrive/c/ +cygperl-5.40.0-d -Dlibpth=/lib/gcc/x86_64-pc-cygwin/11';
        which is significantly different to the Configure args used to build Cygwin's system perl.

        Someone who cares about this issue might like to provide a bug report to Cygwin ... if that's where the bug is.
        I personally think that anyone who wants to install modules into a system perl by running cpan/cpanp/cpanm bears the responsibility of "picking up the pieces".

        Cheers,
        Rob
        keeping signature-checking off as Danny and others say, is the smart move until someone fixes this strange behavior. ;-/

        🤦‍♂️; 💩🔥 -- for the general state, not for your decision (in order to have working software) as much.

Re: GPG-Signed modules fail to install using cpanp under CygwinPerl
by Danny (Chaplain) on Sep 30, 2024 at 15:23 UTC
    I don't know if it has anything to do with file permissions, but it is writing to C://Users/somia. My .cpan(s) are in my cygwin $HOME.