in reply to RFC: auditing cpan installs

I always configure CPAN in such a way it will ask me whether to install dependencies.

Replies are listed 'Best First'.
Re^2: RFC: auditing cpan installs
by SilasTheMonk (Chaplain) on Apr 30, 2009 at 20:10 UTC
    Okay I have just finished installing Titanium. I have had to restore from backup twice (or maybe it was more and I cannot count high enough). My hands are feeling warn out. And I have come to some conclusions.
    1. The current version of the CPAN module is better than the one the box came with. It has a "failed" command which helps you keep track of what needs to be done.
    2. It must be the case that a lot of modules do not state their dependencies correctly.
    3. In particular the compression modules should check for the underlying C libraries and bail out quickly if they are not there.
    4. What I really wanted was a way of typing one command (install Titanium) and getting a list of all perl modules installed. I want it to stop as soon as it hits an error but to only scream when there is a serious issue. I believe CPAN can do this, but I was too fed up to play with it anymore.
    5. I am not aware of any security mailing list for all these modules.
    6. Somebody did once organize an automated CPAN to Debian online converter but it seemed to have died last year.

      If you want to see what pre-requisites a module has, use the CPANdeps website. Or download and install CPAN::FindDependencies and use the cpandeps script that it installs. Both allow you to fine-tune the results to match your version of perl.

      There is, unfortunately, no way of declaring non-perl dependencies, such as those on external C libraries or external binaries, such that CPAN.pm can just Do The Right Thing. If you think about it, it's a Hard Problem, as different platforms have very different ways of installing such things. But I can assure you, it is a problem that people are aware of. If you have any good ideas about how to solve it, one of the module-authors or perl-qa mailing lists are probably the best places to discuss them.