in reply to Re: Any reason to have documentation-only *.pm file instead of *.pod for CPAN distro?
in thread Any reason to have documentation-only *.pm file instead of *.pod for CPAN distro?

Oh, interesting, thanks. Actually, one of the counter-examples where I found *.pod but expected to see *.pm while doing research myself, was MCE::Core. So, then, yes, I tried just now:

>cpanm --test-only MCE::Core
! Finding MCE::Core on cpanmetadb failed.
! Finding MCE::Core () on mirror http://www.cpan.org failed.
! Couldn't find module or a distribution MCE::Core

[download]

So... someone evil can hijack the namespace?

  • Comment on Re^2: Any reason to have documentation-only *.pm file instead of *.pod for CPAN distro?
  • Select or Download Code

Replies are listed 'Best First'.
Re^3: Any reason to have documentation-only *.pm file instead of *.pod for CPAN distro?
by marioroy (Prior) on Jan 02, 2025 at 22:43 UTC

    Thank you, Anonymous Monk. The Core directory exists in MCE since the first release. I created MCE 1.901 adding the missing pm file.

    module : MCE::Core
version: 1.901
in file: lib/MCE/Core.pm
status : indexed

    [download]
[reply]
[d/l]
Re^3: Any reason to have documentation-only *.pm file instead of *.pod for CPAN distro?
by LanX (Saint) on Jan 02, 2025 at 16:40 UTC
[reply]
[d/l]

      The existence of a directory doesn't matter at all to how things are indexed. And subdirectories (or sub-packages) don't imply any relationship between namespaces. Claiming the package MCE::Core::Worker doesn't give you permissions on MCE::Core.

      Until the latest release, there was no MCE::Core package, only a .pod file. So it was not indexed, and had no permissions attached to it. It would have been possible for a bad actor to claim that namespace and upload any tarball they wanted for it.

      It is possible to control this through data in a META.json file, but usually that data is automatically generated. And it can still be confusing for a dist to claim it provides a module that doesn't actually exist because it's only a .pod file.

[reply]

        I'm new to POD and pod/pm interaction and precedence, please forgive my silly questions. I've just created Acme::AAA "distribution" tarball where I also included Cwd.pod to "hijack" a core module documentation. Then cpanm'd this tarball, checked with perldoc Cwd, and it printed "evil" content of my POD, not documentation extracted from Cwd.pm. Apart from, apparently, nothing prevents a "bad actor" to lure people to install something similar, but if uploaded to CPAN, what the https://metacpan.org/pod/Cwd would display then "globally"?

        While we are at it, looks like perldoc link in SEE ALSO section of perlpod and elsewhere is broken in effect, it shows some obsolete Spanish translation.

[reply]
[d/l]
[select]

In Section Seekers of Perl Wisdom