module-build-general

[Module-build-general] Signatures not actually valid, it seems

[Ken W. <ke...@ma...>]

Hi,

It has come to my attention that M::B's signatures don't play nice with 
the MANIFEST file.  The signing process will proceed fine if SIGNATURE 
isn't in the MANIFEST, but then the signature isn't valid 
(Module::Signature complains about the missing entry).  If you add 
SIGNATURE to the MANIFEST and don't create the SIGNATURE file first, 
then 'Build dist' won't work because the file is missing.  If you do 
create the SIGNATURE file (using 'touch SIGNATURE' or the like) then 
Module::Signature seems unable to overwrite the file.

Needs to be fixed, of course.

  -Ken

Re: [Module-build-general] Signatures not actually valid, it seems

[Dave R. <au...@ur...>]

On Tue, 2 Sep 2003, Ken Williams wrote:

> It has come to my attention that M::B's signatures don't play nice with
> the MANIFEST file.  The signing process will proceed fine if SIGNATURE
> isn't in the MANIFEST, but then the signature isn't valid
> (Module::Signature complains about the missing entry).  If you add
> SIGNATURE to the MANIFEST and don't create the SIGNATURE file first,
> then 'Build dist' won't work because the file is missing.  If you do
> create the SIGNATURE file (using 'touch SIGNATURE' or the like) then
> Module::Signature seems unable to overwrite the file.
>
> Needs to be fixed, of course.

I think this is why I added a "sign" property.  If this exists the distdir
action will call _sign_dir().  I think with this property set, things
should work fine as long as SIGNATURE is in the MANIFEST.

Maybe we should just remove the "distsign" action entirely, and tell
people to set this property in their Build.PL if they want signed distros.


-dave

/*=======================
House Absolute Consulting
www.houseabsolute.com
=======================*/

Re: [Module-build-general] Signatures not actually valid, it seems

[Ken W. <ke...@ma...>]

On Tuesday, September 2, 2003, at 10:11  AM, Dave Rolsky wrote:

> On Tue, 2 Sep 2003, Ken Williams wrote:
>
>> It has come to my attention that M::B's signatures don't play nice 
>> with
>> the MANIFEST file.  The signing process will proceed fine if SIGNATURE
>> isn't in the MANIFEST, but then the signature isn't valid
>> (Module::Signature complains about the missing entry).  If you add
>> SIGNATURE to the MANIFEST and don't create the SIGNATURE file first,
>> then 'Build dist' won't work because the file is missing.  If you do
>> create the SIGNATURE file (using 'touch SIGNATURE' or the like) then
>> Module::Signature seems unable to overwrite the file.
>>
>> Needs to be fixed, of course.
>
> I think this is why I added a "sign" property.  If this exists the 
> distdir
> action will call _sign_dir().  I think with this property set, things
> should work fine as long as SIGNATURE is in the MANIFEST.

Nope, still doesn't work - try doing this and then verify the signature 
using 'cpansign -v'.  It will complain because the SIGNATURE file is 
out of date (it was necessarily created before distdir & signing, 
because it was in the MANIFEST).

Autrijus says the solution may be to add "overwrite => 1" to 
Module::Signature::sign().  Then at least it works if you do "touch 
SIGNATURE; Build dist".

  -Ken