in reply to Re^3: Meaning of XS object version
in thread Meaning of XS object version
Though you seem determined to see this one through, I just want to strongly agree with cavac's response and add a further cautionary quote from Fletch:
If you're doing anything serious with Perl you DO NOT want to use the OS' perl as that way lies much pain. Doing so couples you tightly to the OS' upgrade schedule for both the language and (if you're using its package manager for them) CPAN modules.
Many of us have learnt the hard way not to meddle with the system Perl on Unix systems. Much less pain to roll your own that you can control and freely experiment with, without risking breaking the system Perl, and without the risk of OS upgrades to the system Perl breaking your production systems. The same basic arguments apply to Python and other scripting languages.
|
---|
Replies are listed 'Best First'. | |
---|---|
Re^5: Meaning of XS object version
by regalbraith (Novice) on Jul 19, 2023 at 13:44 UTC | |
Sadly I am coming to the same conclusion. As a development team we managed our own Perl on AIX/Unix. Upon our move to Red Hat GNU/Linux we looked forward to handing off that responsibility to the package manager (rpm via yum/dnf). After all our monthly patch cycles would pick up security items without us having to monitor and manage these on our own. If the struggle continues without resolution I'll cycle back to give that consideration. However, that would be non-trivial undertaking as I would not only need to install all the required modules but I also need to interface with the system installed httpd (Apache) that is hosting Bugzilla. I say "sadly" because I see see a lot of advantages in package management. But it only works if the OS vendor and sys-admin team avoid regressive steps. | [reply] |
by bliako (Abbot) on Jul 20, 2023 at 13:10 UTC | |
I think the question you should be asking is: How do I manage my non-OS perl installation (via perlbrew for example) with as little manual intervention as possible, as if I was updating it via my package manager?Edit: Sorry I missed this:
CPAN may not be the best for security reviews of modules. bw, bliako | [reply] [d/l] [select] |
by eyepopslikeamosquito (Archbishop) on Jul 23, 2023 at 00:48 UTC | |
> on our move to Red Hat GNU/Linux we looked forward to handing off that responsibility to the package manager (rpm via yum/dnf) Good catch! The OP has been a bit vague about their Security Requirements. Package Manager and CPAN Security Package Manager and CPAN Security seems to be a difficult topic. Some references:
Example: build perl v5.38 securely from source on Ubuntu An example build and install of the latest perl v5.38.0 from source on my Ubuntu Linux VM using cpanm follows. Do all steps below as non-root as a further precaution against accidentally mangling your system perl.
Next install cpanm using the cpan command:
to install the cpanm executable to the perl's bin path (e.g. ~/perl5/perlbrew/bin/cpanm). In my example, that would be: $HOME/localperl/bin/cpanm (note: I switched from $HOME/localperl/bin to $HOME/my/p5380/bin after this node was written to conveniently have multiple versions of perl simultaneously installed to my $HOME directory). (Update: while using the cpan command (as above) seems best, see Building Perl and CPAN Modules Securely from Source for alternative ways to install cpanm) Then install Module::Signature from CPAN using the cpanm command:
With that done, an example installing the CPAN Roman module more securely via cpanm's --verify option:
Note that cpanm's --verify option verifies the integrity of distribution files retrieved from CPAN using CHECKSUMS file, and SIGNATURES file (if found in the distribution). To uninstall Roman:
After installation, ensure your local perl is ahead of system perl in your path by updating your .profile adding at the end:
Update: see also Re^2: THREE new perl releases [Updated releases!] - build perl v5.38.2 from source Building Perl from Source References
Package Manager References
See Also
Updated: Added "Example: build perl v5.38 securely from source on Ubuntu" section (thanks hippo for motivating me :). Added sha256sum check of perl-5.38.0.tar.gz. Added more references. Added Package Manager References section. | [reply] [d/l] [select] |
by eyepopslikeamosquito (Archbishop) on Jul 20, 2023 at 12:22 UTC | |
> As a development team we managed our own Perl on AIX/Unix. Upon our move to Red Hat GNU/Linux... Can you give us more background about your development team? Knowing that helps us provide more appropriate advice. | [reply] |