Bug #86087 for XML-SAX-Expat: broken archive file XML-SAX-Expat-0.50.tar.gz

Wed Jun 12 07:24:02 2013 mprokop [...] sipwise.com - Ticket created

Subject:	broken archive file XML-SAX-Expat-0.50.tar.gz
Date:	Wed, 12 Jun 2013 13:23:36 +0200
To:	bug-XML-SAX-Expat [...] rt.cpan.org
From:	Michael Prokop <mprokop [...] sipwise.com>

Hi, the archive file of the latest XML-SAX-Expat release seems to be broken WRT permissions: | % tar axvf ~/.cpanm/work/1371034381.26703/XML-SAX-Expat-0.50.tar.gz | ./ | ./XML-SAX-Expat-0.50/ | ./XML-SAX-Expat-0.50/Expat.pm | ./XML-SAX-Expat-0.50/MANIFEST | ./XML-SAX-Expat-0.50/Changes | ./XML-SAX-Expat-0.50/Makefile.PL | ./XML-SAX-Expat-0.50/META.json | ./XML-SAX-Expat-0.50/t/ | ./XML-SAX-Expat-0.50/t/00basic.t | ./XML-SAX-Expat-0.50/t/99podcov.t | ./XML-SAX-Expat-0.50/t/98podsyn.t | ./XML-SAX-Expat-0.50/META.yml | ./XML-SAX-Expat-0.50/eg/ | ./XML-SAX-Expat-0.50/eg/counter.pl | ./XML-SAX-Expat-0.50/README | tar: .: Cannot utime: Operation not permitted | tar: .: Cannot change mode to rwxr-xr-t: Operation not permitted | tar: Exiting with failure status due to previous errors This causes exit code != 0 during module installation and therefore tools like carton fail to deploy XML-SAX-Expat: | /usr/bin/carton --verbose install | Installing modules using cpanfile | Successfully installed XML-NamespaceSupport-1.11 | Successfully installed XML-SAX-Base-1.08 | Successfully installed XML-SAX-0.99 | ! Failed to fetch distribution XML-SAX-Expat-0.50 | ! Bailing out the installation for XML-Simple-2.20. Retry with --prompt or --force. | [...] Would be great if you could provide a fixed archive file. Thanks! regards, -mika-

Download signature.asc
application/pgp-signature 197b

Message body not shown because it is not plain text.

Wed Jun 12 09:09:50 2013 derhoermi [...] gmx.net - Correspondence added

CC:	mprokop [...] sipwise.com
Subject:	Re: [rt.cpan.org #86087] broken archive file XML-SAX-Expat-0.50.tar.gz
Date:	Wed, 12 Jun 2013 15:09:34 +0200
To:	bug-XML-SAX-Expat [...] rt.cpan.org
From:	Bjoern Hoehrmann <derhoermi [...] gmx.net>

* Michael Prokop via RT wrote: Show quoted text

The file I uploaded had this: % tar tvaf XML-SAX-Expat-0.50.tar.gz drw-rw-rw- bjoern/none 0 2013-05-23 14:40 XML-SAX-Expat-0.50/ -rw-rw-rw- bjoern/none 2705 2013-05-23 14:27 XML-SAX-Expat-0.50/Changes drw-rw-rw- bjoern/none 0 2013-05-23 14:40 XML-SAX-Expat-0.50/eg/ -rw-rw-rw- bjoern/none 424 2008-06-30 10:32 XML-SAX-Expat-0.50/eg/counter.pl -rw-rw-rw- bjoern/none 19653 2013-05-23 14:28 XML-SAX-Expat-0.50/Expat.pm -rw-rw-rw- bjoern/none 1505 2013-05-23 14:16 XML-SAX-Expat-0.50/Makefile.PL -rw-rw-rw- bjoern/none 276 2013-05-23 14:40 XML-SAX-Expat-0.50/MANIFEST -rw-rw-rw- bjoern/none 1140 2013-05-23 14:40 XML-SAX-Expat-0.50/META.json -rw-rw-rw- bjoern/none 628 2013-05-23 14:40 XML-SAX-Expat-0.50/META.yml -rw-rw-rw- bjoern/none 61 2013-05-23 14:18 XML-SAX-Expat-0.50/README drw-rw-rw- bjoern/none 0 2013-05-23 14:40 XML-SAX-Expat-0.50/t/ -rw-rw-rw- bjoern/none 157 2001-10-15 14:55 XML-SAX-Expat-0.50/t/00basic.t -rw-rw-rw- bjoern/none 222 2008-06-29 23:09 XML-SAX-Expat-0.50/t/98podsyn.t -rw-rw-rw- bjoern/none 284 2008-06-30 10:25 XML-SAX-Expat-0.50/t/99podcov.t The `Makefile.PL` actually generates it thus. The PAUSE/CPAN system then repackaged the distribution, giving for the file that is online now % tar tvaf XML-SAX-Expat-0.50.tar.gz drwxr-xr-x root/root 0 2013-05-23 14:47 ./ drwxr--r-- 1000/513 0 2013-05-23 14:40 ./XML-SAX-Expat-0.50/ -rw-r--r-- 1000/513 19653 2013-05-23 14:28 ./XML-SAX-Expat-0.50/Expat.pm -rw-r--r-- 1000/513 276 2013-05-23 14:40 ./XML-SAX-Expat-0.50/MANIFEST -rw-r--r-- 1000/513 2705 2013-05-23 14:27 ./XML-SAX-Expat-0.50/Changes -rw-r--r-- 1000/513 1505 2013-05-23 14:16 ./XML-SAX-Expat-0.50/Makefile.PL -rw-r--r-- 1000/513 1140 2013-05-23 14:40 ./XML-SAX-Expat-0.50/META.json drwxr--r-- 1000/513 0 2013-05-23 14:40 ./XML-SAX-Expat-0.50/t/ -rw-r--r-- 1000/513 157 2001-10-15 14:55 ./XML-SAX-Expat-0.50/t/00basic.t -rw-r--r-- 1000/513 284 2008-06-30 10:25 ./XML-SAX-Expat-0.50/t/99podcov.t -rw-r--r-- 1000/513 222 2008-06-29 23:09 ./XML-SAX-Expat-0.50/t/98podsyn.t -rw-r--r-- 1000/513 628 2013-05-23 14:40 ./XML-SAX-Expat-0.50/META.yml drwxr--r-- 1000/513 0 2013-05-23 14:40 ./XML-SAX-Expat-0.50/eg/ -rw-r--r-- 1000/513 424 2008-06-30 10:32 ./XML-SAX-Expat-0.50/eg/counter.pl -rw-r--r-- 1000/513 61 2013-05-23 14:18 ./XML-SAX-Expat-0.50/README And it rather seems that you have a directory ownership problem. Given http://www.cpantesters.org/distro/X/XML-SAX-Expat.html#XML-SAX-Expat-0.50 I do not really see what problem I could address here. -- Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de 25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

Wed Jun 12 09:09:51 2013 The RT System itself - Status changed from 'new' to 'open'

Wed Jun 12 10:55:51 2013 mprokop [...] sipwise.com - Correspondence added

CC:	bug-XML-SAX-Expat [...] rt.cpan.org
Subject:	Re: [rt.cpan.org #86087] broken archive file XML-SAX-Expat-0.50.tar.gz
Date:	Wed, 12 Jun 2013 16:55:33 +0200
To:	Bjoern Hoehrmann <derhoermi [...] gmx.net>
From:	Michael Prokop <mprokop [...] sipwise.com>

Hi! * Bjoern Hoehrmann [Wed Jun 12, 2013 at 03:09:34PM +0200]: Show quoted text

> * Michael Prokop via RT wrote:

Show quoted text

> >the archive file of the latest XML-SAX-Expat release seems to be > >broken WRT permissions:

[...] Show quoted text

> The file I uploaded had this:

Show quoted text

> % tar tvaf XML-SAX-Expat-0.50.tar.gz > drw-rw-rw- bjoern/none 0 2013-05-23 14:40 XML-SAX-Expat-0.50/ > -rw-rw-rw- bjoern/none 2705 2013-05-23 14:27 XML-SAX-Expat-0.50/Changes > drw-rw-rw- bjoern/none 0 2013-05-23 14:40 XML-SAX-Expat-0.50/eg/ > -rw-rw-rw- bjoern/none 424 2008-06-30 10:32 XML-SAX-Expat-0.50/eg/counter.pl > -rw-rw-rw- bjoern/none 19653 2013-05-23 14:28 XML-SAX-Expat-0.50/Expat.pm > -rw-rw-rw- bjoern/none 1505 2013-05-23 14:16 XML-SAX-Expat-0.50/Makefile.PL > -rw-rw-rw- bjoern/none 276 2013-05-23 14:40 XML-SAX-Expat-0.50/MANIFEST > -rw-rw-rw- bjoern/none 1140 2013-05-23 14:40 XML-SAX-Expat-0.50/META.json > -rw-rw-rw- bjoern/none 628 2013-05-23 14:40 XML-SAX-Expat-0.50/META.yml > -rw-rw-rw- bjoern/none 61 2013-05-23 14:18 XML-SAX-Expat-0.50/README > drw-rw-rw- bjoern/none 0 2013-05-23 14:40 XML-SAX-Expat-0.50/t/ > -rw-rw-rw- bjoern/none 157 2001-10-15 14:55 XML-SAX-Expat-0.50/t/00basic.t > -rw-rw-rw- bjoern/none 222 2008-06-29 23:09 XML-SAX-Expat-0.50/t/98podsyn.t > -rw-rw-rw- bjoern/none 284 2008-06-30 10:25 XML-SAX-Expat-0.50/t/99podcov.t

Show quoted text

> The `Makefile.PL` actually generates it thus. The PAUSE/CPAN system then > repackaged the distribution, giving for the file that is online now

Show quoted text

> % tar tvaf XML-SAX-Expat-0.50.tar.gz > drwxr-xr-x root/root 0 2013-05-23 14:47 ./ > drwxr--r-- 1000/513 0 2013-05-23 14:40 ./XML-SAX-Expat-0.50/ > -rw-r--r-- 1000/513 19653 2013-05-23 14:28 ./XML-SAX-Expat-0.50/Expat.pm

[...] Show quoted text

> And it rather seems that you have a directory ownership problem. Given > http://www.cpantesters.org/distro/X/XML-SAX-Expat.html#XML-SAX-Expat-0.50 > I do not really see what problem I could address here.

World-writable files are considered a security risk, see e.g. the discussion at http://www.nntp.perl.org/group/perl.qa/2008/09/msg11568.html AFAIK the archive is supposed to rewrite such files already (https://github.com/andk/pause/commit/96f56ec053c03a653a36a765e89c1277636ea168) but this seems to be buggy or there seems to be a side-effect which doesn't seem to work as intended so your archive file ends up with the problem I'm running into. The fix would be to upload a new release *without* world writables. (Credits to Lars Dieckow for pointing me to the resources mentioned above.) regards, -mika-

Download signature.asc
application/pgp-signature 197b

Message body not shown because it is not plain text.

Wed Jun 12 11:25:57 2013 derhoermi [...] gmx.net - Correspondence added

CC:	bug-XML-SAX-Expat [...] rt.cpan.org
Subject:	Re: [rt.cpan.org #86087] broken archive file XML-SAX-Expat-0.50.tar.gz
Date:	Wed, 12 Jun 2013 17:25:42 +0200
To:	Michael Prokop <mprokop [...] sipwise.com>
From:	Bjoern Hoehrmann <derhoermi [...] gmx.net>

* Michael Prokop wrote: Show quoted text

>* Bjoern Hoehrmann [Wed Jun 12, 2013 at 03:09:34PM +0200]:

>> The `Makefile.PL` actually generates it thus. The PAUSE/CPAN system then >> repackaged the distribution, giving for the file that is online now

>

>> % tar tvaf XML-SAX-Expat-0.50.tar.gz >> drwxr-xr-x root/root 0 2013-05-23 14:47 ./ >> drwxr--r-- 1000/513 0 2013-05-23 14:40 ./XML-SAX-Expat-0.50/ >> -rw-r--r-- 1000/513 19653 2013-05-23 14:28 ./XML-SAX-Expat-0.50/Expat.pm

>[...]

>> And it rather seems that you have a directory ownership problem. Given >> http://www.cpantesters.org/distro/X/XML-SAX-Expat.html#XML-SAX-Expat-0.50 >> I do not really see what problem I could address here.

> >World-writable files are considered a security risk, see e.g. >the discussion at http://www.nntp.perl.org/group/perl.qa/2008/09/msg11568.html > >AFAIK the archive is supposed to rewrite such files already >(https://github.com/andk/pause/commit/96f56ec053c03a653a36a765e89c1277636ea168) >but this seems to be buggy or there seems to be a side-effect which >doesn't seem to work as intended so your archive file ends up with >the problem I'm running into. > >The fix would be to upload a new release *without* world writables.

As far as I can tell, the rewriting of the archive works fine, as above, the archive actually on CPAN does not have world-writable files in it. Looking at your error message again, | % tar axvf ~/.cpanm/work/1371034381.26703/XML-SAX-Expat-0.50.tar.gz | ./ | ./XML-SAX-Expat-0.50/ | ./XML-SAX-Expat-0.50/Expat.pm | ./XML-SAX-Expat-0.50/MANIFEST | ./XML-SAX-Expat-0.50/Changes | ./XML-SAX-Expat-0.50/Makefile.PL | ./XML-SAX-Expat-0.50/META.json | ./XML-SAX-Expat-0.50/t/ | ./XML-SAX-Expat-0.50/t/00basic.t | ./XML-SAX-Expat-0.50/t/99podcov.t | ./XML-SAX-Expat-0.50/t/98podsyn.t | ./XML-SAX-Expat-0.50/META.yml | ./XML-SAX-Expat-0.50/eg/ | ./XML-SAX-Expat-0.50/eg/counter.pl | ./XML-SAX-Expat-0.50/README | tar: .: Cannot utime: Operation not permitted | tar: .: Cannot change mode to rwxr-xr-t: Operation not permitted | tar: Exiting with failure status due to previous errors I would suspect that you are unpacking this in a directory that you do not own. And the problem is probably caused by PAUSE including the '.' in the archive (there is an empty directory with the name `.` in the archive and it is unpacked above and then tar fails to utime and chmod it). -- Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de 25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

Wed Jun 12 11:35:21 2013 mprokop [...] sipwise.com - Correspondence added

CC:	bug-XML-SAX-Expat [...] rt.cpan.org
Subject:	Re: [rt.cpan.org #86087] broken archive file XML-SAX-Expat-0.50.tar.gz
Date:	Wed, 12 Jun 2013 17:35:00 +0200
To:	Bjoern Hoehrmann <derhoermi [...] gmx.net>
From:	Michael Prokop <mprokop [...] sipwise.com>

Hi! * Bjoern Hoehrmann [Wed Jun 12, 2013 at 05:25:42PM +0200]: Show quoted text

> As far as I can tell, the rewriting of the archive works fine, as above, > the archive actually on CPAN does not have world-writable files in it.

Oh, right Show quoted text

> Looking at your error message again,

Show quoted text

Show quoted text

> I would suspect that you are unpacking this in a directory that you do > not own. And the problem is probably caused by PAUSE including the '.' > in the archive (there is an empty directory with the name `.` in the > archive and it is unpacked above and then tar fails to utime and chmod > it).

Excellent catch, that's it - thanks! \o/ What's the proper way to get rid of this '.' behaviour in the archive? AFAICT other modules don't ship the '.' in their archives, and since it breaks stuff in a non-obvious way it would be great if it could be resolved for everyone. regards, -mika-

Download signature.asc
application/pgp-signature 197b

Message body not shown because it is not plain text.

Wed Jun 12 11:44:39 2013 derhoermi [...] gmx.net - Correspondence added

CC:	bug-XML-SAX-Expat [...] rt.cpan.org
Subject:	Re: [rt.cpan.org #86087] broken archive file XML-SAX-Expat-0.50.tar.gz
Date:	Wed, 12 Jun 2013 17:44:25 +0200
To:	Michael Prokop <mprokop [...] sipwise.com>
From:	Bjoern Hoehrmann <derhoermi [...] gmx.net>

* Michael Prokop wrote: Show quoted text

>* Bjoern Hoehrmann [Wed Jun 12, 2013 at 05:25:42PM +0200]:

>> I would suspect that you are unpacking this in a directory that you do >> not own. And the problem is probably caused by PAUSE including the '.' >> in the archive (there is an empty directory with the name `.` in the >> archive and it is unpacked above and then tar fails to utime and chmod >> it).

> >Excellent catch, that's it - thanks! \o/ > >What's the proper way to get rid of this '.' behaviour in the >archive? AFAICT other modules don't ship the '.' in their archives, >and since it breaks stuff in a non-obvious way it would be great if >it could be resolved for everyone.

Most likely the `_rewrite_tarball` function in the code you linked has the wrong arguments for `tar` when re-creating the archive, ideally it would be fixed there. I will look into changing my `Makefile.PL` scripts so PAUSE does not rewrite them. -- Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de 25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

Wed Jun 12 12:44:24 2013 mprokop [...] sipwise.com - Correspondence added

CC:	bug-XML-SAX-Expat [...] rt.cpan.org
Subject:	Re: [rt.cpan.org #86087] broken archive file XML-SAX-Expat-0.50.tar.gz
Date:	Wed, 12 Jun 2013 18:44:02 +0200
To:	Bjoern Hoehrmann <derhoermi [...] gmx.net>
From:	Michael Prokop <mprokop [...] sipwise.com>

* Bjoern Hoehrmann [Wed Jun 12, 2013 at 05:44:25PM +0200]: Show quoted text

> * Michael Prokop wrote:

Show quoted text

> >What's the proper way to get rid of this '.' behaviour in the > >archive? AFAICT other modules don't ship the '.' in their archives, > >and since it breaks stuff in a non-obvious way it would be great if > >it could be resolved for everyone.

Show quoted text

> Most likely the `_rewrite_tarball` function in the code you linked has > the wrong arguments for `tar` when re-creating the archive, ideally it > would be fixed there. I will look into changing my `Makefile.PL` scripts > so PAUSE does not rewrite them.

Lars threw http://blogs.perl.org/users/chorny/2011/07/how-to-get-rid-of-withoutworldwriteables.html into my direction, I'm herby forwarding it to you. In the meanwhile I noticed that the problem I'm experiencing with carton only occures with cpanminus version 1.5015, when upgrading it to version 1.6918 installation of XML-SAX-Expat 0.50 works again. (Anyway, would be great to have the archive issue fixed for everyone, including the ones using cpanminus versions older than 1.6918. :)) Thanks! regards, -mika-

Download signature.asc
application/pgp-signature 197b

Message body not shown because it is not plain text.

Fri Jun 14 12:42:51 2013 derhoermi [...] gmx.net - Correspondence added

Subject:	Re: [rt.cpan.org #86087] broken archive file XML-SAX-Expat-0.50.tar.gz
Date:	Fri, 14 Jun 2013 18:42:34 +0200
To:	bug-XML-SAX-Expat [...] rt.cpan.org
From:	Bjoern Hoehrmann <derhoermi [...] gmx.net>

* Michael Prokop via RT wrote: Show quoted text

>(Anyway, would be great to have the archive issue fixed for >everyone, including the ones using cpanminus versions older than >1.6918. :))

I was going to file an issue for this but it seems to be known already, <https://github.com/andk/pause/issues/26>. -- Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de 25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

Mon Jun 17 04:22:30 2013 mprokop [...] sipwise.com - Correspondence added

Subject:	Re: [rt.cpan.org #86087] broken archive file XML-SAX-Expat-0.50.tar.gz
Date:	Mon, 17 Jun 2013 10:22:01 +0200
To:	Bjoern Hoehrmann via RT <bug-XML-SAX-Expat [...] rt.cpan.org>
From:	Michael Prokop <mprokop [...] sipwise.com>

* Bjoern Hoehrmann via RT [Fri Jun 14, 2013 at 12:42:52PM -0400]: Show quoted text

> * Michael Prokop via RT wrote:

Show quoted text

> >(Anyway, would be great to have the archive issue fixed for > >everyone, including the ones using cpanminus versions older than > >1.6918. :))

Show quoted text

> I was going to file an issue for this but it seems to be known already, > <https://github.com/andk/pause/issues/26>.

Thanks! regards, -mika-

Download signature.asc
application/pgp-signature 197b

Message body not shown because it is not plain text.

Tue Jan 07 01:48:07 2014 hachi [...] cpan.org - Correspondence added

Hey, I'm pretty sure you just need to reupload your release (with a bumped version number) XML::Simple depends on this module, and it's really annoying that cpanm won't install it consistently. :) Thanks --hachi On Mon Jun 17 04:22:30 2013, mprokop@sipwise.com wrote: Show quoted text

> * Bjoern Hoehrmann via RT [Fri Jun 14, 2013 at 12:42:52PM -0400]:

> > * Michael Prokop via RT wrote:

>

> > >(Anyway, would be great to have the archive issue fixed for > > >everyone, including the ones using cpanminus versions older than > > >1.6918. :))

>

> > I was going to file an issue for this but it seems to be known already, > > <https://github.com/andk/pause/issues/26>.

> > Thanks! > > regards, > -mika-

Tue Jan 07 01:48:08 2014 hachi [...] cpan.org - Fixed in 0.50 added

Mon Jan 20 21:00:53 2014 derhoermi [...] gmx.net - Correspondence added

Subject:	Re: [rt.cpan.org #86087] broken archive file XML-SAX-Expat-0.50.tar.gz
Date:	Tue, 21 Jan 2014 03:00:41 +0100
To:	bug-XML-SAX-Expat [...] rt.cpan.org
From:	Bjoern Hoehrmann <derhoermi [...] gmx.net>

* Jonathan Steinert via RT wrote: Show quoted text

>I'm pretty sure you just need to reupload your release (with a bumped version number) > >XML::Simple depends on this module, and it's really annoying that cpanm won't install it consistently. :)

I have uploaded a new version with a bumped version number. It will take a few hours to become available, but you could then give it a try. -- Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de 25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

Mon Jan 27 05:38:48 2014 mprokop [...] sipwise.com - Correspondence added

Subject:	Re: [rt.cpan.org #86087] broken archive file XML-SAX-Expat-0.50.tar.gz
Date:	Mon, 27 Jan 2014 11:38:28 +0100
To:	Bjoern Hoehrmann via RT <bug-XML-SAX-Expat [...] rt.cpan.org>
From:	Michael Prokop <mprokop [...] sipwise.com>

* Bjoern Hoehrmann via RT [Mon Jan 20, 2014 at 09:00:53PM -0500]: Show quoted text

> * Jonathan Steinert via RT wrote:

Show quoted text

> >I'm pretty sure you just need to reupload your release (with a bumped version number) > >XML::Simple depends on this module, and it's really annoying that cpanm won't install it consistently. :)

Show quoted text

> I have uploaded a new version with a bumped version number. It will take > a few hours to become available, but you could then give it a try.

Works for me, thanks! regards, -mika-

Download signature.asc
application/pgp-signature 197b

Message body not shown because it is not plain text.