Re: [Module-build-general] signature verification and some bug fixes

[Ken W. <ke...@ma...>]

On Friday, June 20, 2003, at 11:46  PM, Dave Rolsky wrote:
>
> 2. Make the distsign action depend on distdir unless $self->dist_dir
> already exists.  Otherwise the sequence of "perl Build.PL", "./Build
> distsign" fails, which is almost certainly a bug.

I've applied this fix in a modified form, by increasing the method 
granularity.  There's now a _sign_dir($dir) method that will do the 
signing, and it's invoked by both ACTION_distdir() and 
ACTION_distsign().  Still a little clunky, but at least it'll work 
correctly in more cases.

>
> 3. Adds a verify action which verifies a signature.

Why does this patch (excerpt below) verify in $self->dist_dir?  Seems 
like we'd want to verify in the main directory, $self->base_dir.


  -Ken


>
> +sub ACTION_verify {
> +  my ($self) = @_;
> +
> +  $self->_load_module_signature('verify') or return;
> +
> +  # We protect the verify with an eval{} to make sure we get back to
> +  # the right directory after a signature failure.
> +
> +  chdir $self->dist_dir or die "Can't chdir() to " . $self->dist_dir 
> . ": $!";
> +  my $ok = eval {Module::Signature::verify() == 
> Module::Signature::SIGNATURE_OK()};
> +  my @err = $@ ? ($@) : ();
> +  chdir $self->base_dir or push @err, "Can't chdir() back to " . 
> $self->base_dir . ": $!";
> +  die join "\n", @err if @err;
> +
> +  print "Signature is", ($ok ? "" : " not"), " valid\n";
> +}
> +