Bug #54023 for CPAN: "o conf check_sigs 1" with Module::Signature/Crypt::OpenPGP (no gpg) environment sprays errors

Wed Jan 27 02:54:46 2010 csjewell [...] cpan.org - Ticket created

Subject:

"o conf check_sigs 1" with Module::Signature/Crypt::OpenPGP (no gpg) environment sprays errors

This is CPAN 1.94_54, Strawberry Perl January 2010 Beta 2. (reports version as 5.10.1.1_beta_2) [Strawberry Perl includes Module::Signature (0.61), with Crypt::OpenPGP (1.04) and its prerequisites.] Some of these look like they could be errors from other modules, but there's at least one error that specifies CPAN::Distribution, so I'm reporting it here, and any downstream errors can be passed on. I'd like to be able to flip the check_sigs bit for April 2010 and for Professional (which may come out sooner than that), since we now have an otherwise-functioning crypto toolchain. Here's the output: C:\Documents and Settings\Administrator>cpan cpan shell -- CPAN exploration and modules installation (v1.9454) Enter 'h' for help. Show quoted text

cpan> o conf check_sigs 1

check_sigs [1] commit: wrote 'C:\strawberry\perl\lib/CPAN/Config.pm' Show quoted text

cpan> install Template::Tiny

Fetching with LWP: http://cpan.strawberryperl.com/authors/01mailrc.txt.gz Fetching with LWP: http://cpan.strawberryperl.com/modules/02packages.details.txt.gz Fetching with LWP: http://cpan.strawberryperl.com/modules/03modlist.data.gz Creating database file ... Gathering information from index files ... Populating database tables ... Done! Running install for module 'Template::Tiny' Running make for A/AD/ADAMK/Template-Tiny-0.10.tar.gz Fetching with LWP: http://cpan.strawberryperl.com/authors/id/A/AD/ADAMK/Template-Tiny-0.10.tar.gz Fetching with LWP: http://cpan.strawberryperl.com/authors/id/A/AD/ADAMK/CHECKSUMS 'gpg' is not recognized as an internal or external command, operable program or batch file. Bareword found where operator expected at (eval 121) line 1, near "qw/GMP/Pari" Bareword found where operator expected at (eval 122) line 1, near "qw/GMP/Pari" Bareword found where operator expected at (eval 123) line 1, near "qw/GMP/Pari" Bareword found where operator expected at (eval 124) line 1, near "qw/GMP/Pari" Use of uninitialized value $rv in numeric eq (==) at C:\strawberry\perl\lib/CPAN /Distribution.pm line 1345. Signature for C:\strawberry\cpan\sources\authors\id\A\AD\ADAMK\CHECKSUMS ok Checksum for C:\strawberry\cpan\sources\authors\id\A\AD\ADAMK\Template-Tiny-0.10 .tar.gz ok Scanning cache C:\strawberry\cpan\build for sizes DONE Package came without SIGNATURE CPAN.pm: Going to build A/AD/ADAMK/Template-Tiny-0.10.tar.gz Checking if your kit is complete... Looks good Writing Makefile for Template::Tiny cp lib/Template/Tiny.pm blib\lib\Template\Tiny.pm ADAMK/Template-Tiny-0.10.tar.gz C:\strawberry\c\bin\dmake.EXE -- OK Running make test C:\strawberry\perl\bin\perl.exe "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib\lib', 'blib\arch')" t/*.t t/01_compile.t .. ok t/02_trivial.t .. ok t/03_samples.t .. ok t/04_compat.t ... skipped: Template Toolkit is not installed t/97_meta.t ..... skipped: Author tests not required for installation t/98_pod.t ...... skipped: Author tests not required for installation t/99_pmv.t ...... skipped: Author tests not required for installation All tests successful. Files=7, Tests=56, 0 wallclock secs ( 0.06 usr + 0.03 sys = 0.09 CPU) Result: PASS ADAMK/Template-Tiny-0.10.tar.gz C:\strawberry\c\bin\dmake.EXE test -- OK Running make install Prepending C:\strawberry\cpan\build\Template-Tiny-0.10-_65kNT/blib/arch C:\straw berry\cpan\build\Template-Tiny-0.10-_65kNT/blib/lib to PERL5LIB for 'install' Installing C:\strawberry\perl\site\lib\Template\Tiny.pm Appending installation info to C:\strawberry\perl\lib/perllocal.pod ADAMK/Template-Tiny-0.10.tar.gz C:\strawberry\c\bin\dmake.EXE install UNINST=1 -- OK Show quoted text

cpan>....

Wed Jan 27 03:28:48 2010 andreas.koenig.7os6VVqR [...] franz.ak.mind.de - Correspondence added

Subject:	Re: [rt.cpan.org #54023] "o conf check_sigs 1" with Module::Signature/Crypt::OpenPGP (no gpg) environment sprays errors
Date:	Wed, 27 Jan 2010 09:27:51 +0100
To:	bug-CPAN [...] rt.cpan.org
From:	andreas.koenig.7os6VVqR [...] franz.ak.mind.de (Andreas J. Koenig)

Show quoted text

>>>>> On Wed, 27 Jan 2010 02:54:48 -0500, "Curtis Jewell via RT" <bug-CPAN@rt.cpan.org> said:

Show quoted text

> Fetching with LWP: > http://cpan.strawberryperl.com/authors/id/A/AD/ADAMK/CHECKSUMS > 'gpg' is not recognized as an internal or external command, > operable program or batch file.

What does 'o conf gpg' report? I'd say if you do not have gpg in your path it must be contain "gpg". If you want to test perl-crypto alone it should be empty. Show quoted text

> Bareword found where operator expected at (eval 121) line 1, near > "qw/GMP/Pari" > Bareword found where operator expected at (eval 122) line 1, near > "qw/GMP/Pari" > Bareword found where operator expected at (eval 123) line 1, near > "qw/GMP/Pari" > Bareword found where operator expected at (eval 124) line 1, near > "qw/GMP/Pari" > Use of uninitialized value $rv in numeric eq (==) at > C:\strawberry\perl\lib/CPAN > /Distribution.pm line 1345.

I cannot reproduce on my machine but I see the code does not check for definedness or $@. The code responsible read like my $rv = eval { Module::Signature::_verify($chk_file) }; if ($rv == Module::Signature::SIGNATURE_OK()) { Since I don't know why $rv is undef I'd think one should check for $@ and definedness and insert some code that does the right thing in both cases. Will look into it asap but most probably not before the weekend. You would do me a great favor if you could check what $@ contains for you. -- andreas

Wed Jan 27 03:28:50 2010 The RT System itself - Status changed from 'new' to 'open'

Wed Jan 27 03:40:59 2010 andreas.koenig.7os6VVqR [...] franz.ak.mind.de - Correspondence added

CC:	undisclosed-recipients:;
Subject:	Re: [rt.cpan.org #54023] "o conf check_sigs 1" with Module::Signature/Crypt::OpenPGP (no gpg) environment sprays errors
Date:	Wed, 27 Jan 2010 09:27:42 +0100
To:	bug-CPAN [...] rt.cpan.org
From:	andreas.koenig.7os6VVqR [...] franz.ak.mind.de (Andreas J. Koenig)

Show quoted text

>>>>> On Wed, 27 Jan 2010 02:54:48 -0500, "Curtis Jewell via RT" <bug-CPAN@rt.cpan.org> said:

Show quoted text

> Fetching with LWP: > http://cpan.strawberryperl.com/authors/id/A/AD/ADAMK/CHECKSUMS > 'gpg' is not recognized as an internal or external command, > operable program or batch file.

What does 'o conf gpg' report? I'd say if you do not have gpg in your path it must be contain "gpg". If you want to test perl-crypto alone it should be empty. Show quoted text

> Bareword found where operator expected at (eval 121) line 1, near > "qw/GMP/Pari" > Bareword found where operator expected at (eval 122) line 1, near > "qw/GMP/Pari" > Bareword found where operator expected at (eval 123) line 1, near > "qw/GMP/Pari" > Bareword found where operator expected at (eval 124) line 1, near > "qw/GMP/Pari" > Use of uninitialized value $rv in numeric eq (==) at > C:\strawberry\perl\lib/CPAN > /Distribution.pm line 1345.

I cannot reproduce on my machine but I see the code does not check for definedness or $@. The code responsible read like my $rv = eval { Module::Signature::_verify($chk_file) }; if ($rv == Module::Signature::SIGNATURE_OK()) { Since I don't know why $rv is undef I'd think one should check for $@ and definedness and insert some code that does the right thing in both cases. Will look into it asap but most probably not before the weekend. You would do me a great favor if you could check what $@ contains for you. -- andreas

Wed Jan 27 12:04:53 2010 csjewell [...] cpan.org - Correspondence added

On Wed Jan 27 03:28:48 2010, andreas.koenig.7os6VVqR@franz.ak.mind.de wrote: Show quoted text

> >>>>> On Wed, 27 Jan 2010 02:54:48 -0500, "Curtis Jewell via RT" <bug-

> CPAN@rt.cpan.org> said: >

> > Fetching with LWP: > > http://cpan.strawberryperl.com/authors/id/A/AD/ADAMK/CHECKSUMS > > 'gpg' is not recognized as an internal or external command, > > operable program or batch file.

> > What does 'o conf gpg' report? I'd say if you do not have gpg in your > path it must be contain "gpg". If you want to test perl-crypto alone > it > should be empty.

It is empty - [], and I think you can safely blame Module::Signature for this one, as I see it in 00-signature.t files as well. (Adam Kennedy sent a patch to Audrey that fixes this particular bug in RT#17769, so I'm going to attempt to add a dependency on that ticket to this one) Show quoted text

> > Bareword found where operator expected at (eval 121) line 1, near > > "qw/GMP/Pari" > > Bareword found where operator expected at (eval 122) line 1, near > > "qw/GMP/Pari" > > Bareword found where operator expected at (eval 123) line 1, near > > "qw/GMP/Pari" > > Bareword found where operator expected at (eval 124) line 1, near > > "qw/GMP/Pari" > > Use of uninitialized value $rv in numeric eq (==) at > > C:\strawberry\perl\lib/CPAN > > /Distribution.pm line 1345.

> > I cannot reproduce on my machine but I see the code does not check for > definedness or $@. The code responsible read like > > my $rv = eval { Module::Signature::_verify($chk_file) }; > if ($rv == Module::Signature::SIGNATURE_OK()) { > > Since I don't know why $rv is undef I'd think one should check for $@ > and definedness and insert some code that does the right thing in both > cases. > > Will look into it asap but most probably not before the weekend. You > would do me a great favor if you could check what $@ contains for you.

I'll try and see what I can do once the January builds are over - which will probably be later today or tomorrow. As I thought I said (I think I reported this at o-dark-30), we may be passing some fixes to Audrey, or even farther down the perl-crypto toolchain - I wasn't sure if some of them were fixes you had to make, as well.

Wed Jan 27 12:24:37 2010 csjewell [...] cpan.org - Correspondence added

(no such luck - you have to add dependencies, I can't do it) At any rate, I just forked Audrey's github repository and put in a fix for the one bug, and will check how much else that needs changed before requesting a pull from her.

Thu Jan 28 01:16:26 2010 ANDK [...] cpan.org - Dependency on ticket #17769 added

Fri Feb 17 11:19:15 2017 ANDK [...] cpan.org - Correspondence added

Since I have not heard anything back, this was supposedly fixed in Module::Signature. Resolving ticket here. If there is doubt, please reopen or open a new ticket. Thanks for the report!

Fri Feb 17 11:19:31 2017 ANDK [...] cpan.org - Status changed from 'open' to 'resolved'