[Module-build-general] distsign & sign option

[Dave R. <au...@ur...>]

At the end of this message is a patch that implements a distsign action
for Module::Build.  This uses Module::Signature to sign the distribution.
Additionally, it adds a new property, 'sign', which can be set for a
distribution.  If true, the distsign action is called whenever dist is
called.

There are tests as well, but is should be noted that there are two
potential problems with the test:

1. If you have Module::Signature, but no keys in your keyring, the tests
will probably fail.

2. If you do have keys, you'll be prompted for a passphrase.  I'm not sure
if this is really desirable behavior for tests run during a module
install.

Anyway, disabling the tests for non-maintainers would be easy enough.


-dave

/*=======================
House Absolute Consulting
www.houseabsolute.com
=======================*/


Only in .: SIGNATURE
diff -ru ../Module-Build/lib/Module/Build/Base.pm ./lib/Module/Build/Base.pm
--- ../Module-Build/lib/Module/Build/Base.pm	2003-01-21 00:38:18.000000000 -0600
+++ ./lib/Module/Build/Base.pm	2003-02-08 18:08:23.000000000 -0600
@@ -777,6 +777,7 @@
 sub ACTION_dist {
   my ($self) = @_;

+  $self->depends_on('distsign') if $self->{properties}{sign};
   $self->depends_on('distdir');

   my $dist_dir = $self->dist_dir;
@@ -825,6 +826,18 @@
   warn "*** Did you forget to add $metafile to the MANIFEST?\n" unless exists $dist_files->{$metafile};
 }

+sub ACTION_distsign {
+  my ($self) = @_;
+
+  eval { require Module::Signature };
+  if ($@) {
+    warn "*** The distsign action requires that Module::Signature be installed in order to work.\n";
+    return;
+  }
+
+  Module::Signature::sign();
+}
+
 sub ACTION_disttest {
   my ($self) = @_;

diff -ru ../Module-Build/lib/Module/Build.pm ./lib/Module/Build.pm
--- ../Module-Build/lib/Module/Build.pm	2003-01-21 00:38:18.000000000 -0600
+++ ./lib/Module/Build.pm	2003-02-08 18:09:51.000000000 -0600
@@ -381,6 +381,12 @@
 something useful with it.  It can potentially bring lots of security,
 packaging, and convenience improvements.

+=item sign
+
+A boolean flag indicating whether a distribution should always be
+signed.  If this is true, then running the "dist" action will run the
+"distsign" action before "dist".  The default value is 0.
+
 =back

 =item create_build_script()
@@ -765,6 +771,11 @@
 tarball of the files listed in F<MANIFEST> and compress the tarball using
 GZIP compression.

+=item distsign
+
+Uses Module::Signature to create a SIGNATURE file for your
+distribution.
+
 =item distcheck

 Reports which files are in the build directory but not in the
diff -ru ../Module-Build/t/runthrough.t ./t/runthrough.t
--- ../Module-Build/t/runthrough.t	2002-12-30 19:05:12.000000000 -0600
+++ ./t/runthrough.t	2003-02-08 18:03:58.000000000 -0600
@@ -4,6 +4,7 @@
 use File::Spec;
 use File::Path;
 my $HAVE_YAML = eval {require YAML; 1};
+my $HAVE_MS = eval {require Module::Signature; 1};

 ok(1);
 require File::Spec->catfile('t', 'common.pl');
@@ -62,6 +63,15 @@
   skip "skip YAML.pm is not installed", 1 for 1..6;
 }

+if ($HAVE_MS) {
+  eval {$build->dispatch('distsign')};
+  ok $@, '';
+
+  ok -e File::Spec->catdir('Sample-0.01', 'SIGNATURE');
+} else {
+  skip "skip Module::Signature is not installed", 1 for 1..2;
+}
+
 eval {$build->dispatch('realclean')};
 ok $@, '';