[Bug 907464] New: cpanm bundle lots of library and is not listed on fesco page

[Red Hat Bugzilla]

Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=907464

            Bug ID: 907464
           Summary: cpanm bundle lots of library and is not listed on
                    fesco page
           Product: Fedora
           Version: 18
         Component: perl-App-cpanminus
          Severity: unspecified
          Priority: unspecified
          Reporter: misc(a)zarb.org
            Blocks: 504493 (DuplicSysLibsTracker)

According to the comment in the spec, and the source of cpanm, there is lots of
perl modules bundle into the main software. While the way cpanm work kinda
mandate it, I think there should be some tracking for it, only for security
update reasons.

I would suggest to contact fesco and see what to do ( ie, either unbundle, or
get a bundle exception, and list the module on the appropriate page, with
appropriate provides bundled(foo) tags )

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=ZNgmNZvNOV&a=cc_unsubscribe

[Bug 907464] cpanm bundle lots of library and is not listed on fesco page

[Red Hat Bugzilla]

Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=907464

Marcela Mašláňová <mmaslano(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |NOTABUG
        Last Closed|                            |2013-02-04 10:14:52

--- Comment #1 from Marcela Mašláňová <mmaslano(a)redhat.com&gt; ---
Did you look in to the tarball? It is not bundled like copied the module, but
the "function" is copied into the main code. cpanm does it to have a minimal
dependency chain, which is a must for this kind of a tool.

Also the bundling exception is given by FPC not FESCo. If you still believe it
should be acked by FPC, then please feel free to reopen.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=Bs5893ARqm&a=cc_unsubscribe

[Bug 907464] cpanm bundle lots of library and is not listed on fesco page

[Red Hat Bugzilla]

Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=907464

Michael Scherer <misc(a)zarb.org&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|CLOSED                      |ASSIGNED
         Resolution|NOTABUG                     |---
           Keywords|                            |Reopened

--- Comment #2 from Michael Scherer <misc(a)zarb.org&gt; ---
Yes, I have read the source code, and I am aware of the reason on why cpanm do
it ( hence the "While the way cpanm work kinda mandate it" part in my first
comment ).

But as I said, I think this should be tracked somewhere. I have seen how the
code is bundled and I know this would be quite hard to unbundle, but I am not
FPC, so in the end, it is up to them to decide, not to me, hence the request to
see with them. If I was the one to decide, I would grant a exception, provided
we can find what is bundled, so if any security issue arise, we can quickly see
this should be fixed in cpanm too.

For example there is a bundle of JSON::PP or HTTP::Tiny, and I picking these 2
because they are either consuming untrusted input or network stuff, so could in
theory be problematic. 

And in all case, the packaging guidelines are quite clear on what to do if
there if there is a bundle :
https://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries#Requirement...

This include adding a link to the ticket for the exception. And while the
ticket look like bureaucracy ( since I think the exception would be granted ),
I think only FPC can edit the wiki page with bundled exceptions list, and that
would be used as a reference source, and so must be up to date.

The fact that only part of the code is copied doesn't make it less a
problematic copy from a tracking point of view.

So yes, i think something should be done, and the current process and
documentation requires some group to do it, and that's FPC as you correctly
said.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=tq7AaveoRE&a=cc_unsubscribe

[Bug 907464] cpanm bundle lots of library and is not listed on fesco page

[Red Hat Bugzilla]

Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=907464

--- Comment #3 from Marcela Mašláňová <mmaslano(a)redhat.com&gt; ---
Filed as:
https://fedorahosted.org/fpc/ticket/250

I wonder if the wiki is checked by security team for possible CVEs.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=iGrdhouJrJ&a=cc_unsubscribe

[Bug 907464] cpanm bundle lots of library and is not listed on fesco page

[Red Hat Bugzilla]

Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=907464

Petr Pisar <ppisar(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |952282
                 CC|                            |fweimer(a)redhat.com

--- Comment #4 from Petr Pisar <ppisar(a)redhat.com&gt; ---
*** Bug 952281 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=J1tQm02ehn&a=cc_unsubscribe

[Bug 907464] cpanm bundle lots of library and is not listed on fesco page

[Red Hat Bugzilla]

Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=907464

--- Comment #5 from Florian Weimer <fweimer(a)redhat.com&gt; ---
As of upstream version 1.6108, the situation is even worse because the bundled
sources are now obfuscated.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=JulVAFU778&a=cc_unsubscribe

[Bug 907464] cpanm bundle lots of library and is not listed on fesco page

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=907464

Petr Pisar <ppisar(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ppisar(a)redhat.com
           Assignee|mmaslano(a)redhat.com         |ppisar(a)redhat.com



--- Comment #6 from Petr Pisar <ppisar(a)redhat.com&gt; ---
I have unbundled version 1.6927, but it requires these unpackaged modules:

perl(Module::CPANfile)
perl(version::vpp)

I guess core-only version::vpp is useless. Standard perl(version) should be
enough.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=2cQQnTdrUc&a=cc_unsubscribe

[Bug 907464] cpanm bundle lots of library and is not listed on fesco page

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=907464

Petr Pisar <ppisar(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |929254



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=G5DcYQ8DUY&a=cc_unsubscribe

[Bug 907464] cpanm bundle lots of library and is not listed on fesco page

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=907464



--- Comment #7 from Marcela Mašláňová <mmaslano(a)redhat.com&gt; ---
I agree, standard perl(version) should be enough, when I was looking on this
package.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=ync6meuWmX&a=cc_unsubscribe

[Bug 907464] cpanm bundle lots of library and is not listed on fesco page

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=907464

Fedora Admin XMLRPC Client <fedora-admin-xmlrpc(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|ppisar(a)redhat.com           |jplesnik(a)redhat.com



--- Comment #8 from Fedora Admin XMLRPC Client <fedora-admin-xmlrpc(a)redhat.com&gt; ---
This package has changed ownership in the Fedora Package Database.  Reassigning
to the new owner of this component.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=q5vP3dPyRr&a=cc_unsubscribe

[Bug 907464] cpanm bundle lots of library and is not listed on fesco page

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=907464

Petr Pisar <ppisar(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|jplesnik(a)redhat.com         |ppisar(a)redhat.com



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=9GM4xnPaBd&a=cc_unsubscribe

[Bug 907464] cpanm bundle lots of library and is not listed on fesco page

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=907464

Bug 907464 depends on bug 929254, which changed state.

Bug 929254 Summary: Review Request: perl-Module-CPANfile - Parse cpanfile
https://bugzilla.redhat.com/show_bug.cgi?id=929254

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |CLOSED
         Resolution|---                         |RAWHIDE



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=xpor6xkaO6&a=cc_unsubscribe

[Bug 907464] cpanm bundle lots of library and is not listed on fesco page

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=907464

Petr Pisar <ppisar(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |CLOSED
   Fixed In Version|                            |perl-App-cpanminus-1.6927-3
                   |                            |.fc21
         Resolution|---                         |RAWHIDE
        Last Closed|2013-02-04 10:14:52         |2013-09-11 04:35:23



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=w5Q5XhaBag&a=cc_unsubscribe

[Bug 907464] cpanm bundle lots of library and is not listed on fesco page

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=907464

Petr Pisar <ppisar(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://bugzilla.redhat.com
                   |                            |/show_bug.cgi?id=1045378



-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=PDydX3jVtF&a=cc_unsubscribe