#cpan — Public Fediverse posts

I've uploaded a prototype module for generating and parsing metadata about software #AI and automation policies, based on ideas from the #Perl Toolchain Summit in April.

The idea is to have machine-readavle information about how code is generated, what kind of automated contributions are handled are allowed, and what kind of automation the maintainers of a project use.

There's a draft spec at https://github.com/CPAN-Security/cpan-metadata-v3/blob/main/automation-policy.md but it's already out-of-sync with the Perl code.

Ideas and feedback would be appreciated.

https://metacpan.org/release/RRWO/Dist-AutomationPolicy-v0.1.0

#CPAN

I've uploaded a prototype module for generating and parsing metadata about software #AI and automation policies, based on ideas from the #Perl Toolchain Summit in April.

The idea is to have machine-readavle information about how code is generated, what kind of automated contributions are handled are allowed, and what kind of automation the maintainers of a project use.

There's a draft spec at https://github.com/CPAN-Security/cpan-metadata-v3/blob/main/automation-policy.md but it's already out-of-sync with the Perl code.

Ideas and feedback would be appreciated.

https://metacpan.org/release/RRWO/Dist-AutomationPolicy-v0.1.0

#CPAN

I've uploaded a prototype module for generating and parsing metadata about software #AI and automation policies, based on ideas from the #Perl Toolchain Summit in April.

The idea is to have machine-readavle information about how code is generated, what kind of automated contributions are handled are allowed, and what kind of automation the maintainers of a project use.

There's a draft spec at https://github.com/CPAN-Security/cpan-metadata-v3/blob/main/automation-policy.md but it's already out-of-sync with the Perl code.

Ideas and feedback would be appreciated.

https://metacpan.org/release/RRWO/Dist-AutomationPolicy-v0.1.0

#CPAN

I've uploaded a prototype module for generating and parsing metadata about software #AI and automation policies, based on ideas from the #Perl Toolchain Summit in April.

The idea is to have machine-readavle information about how code is generated, what kind of automated contributions are handled are allowed, and what kind of automation the maintainers of a project use.

There's a draft spec at https://github.com/CPAN-Security/cpan-metadata-v3/blob/main/automation-policy.md but it's already out-of-sync with the Perl code.

Ideas and feedback would be appreciated.

https://metacpan.org/release/RRWO/Dist-AutomationPolicy-v0.1.0

#CPAN

I've uploaded a prototype module for generating and parsing metadata about software #AI and automation policies, based on ideas from the #Perl Toolchain Summit in April.

The idea is to have machine-readavle information about how code is generated, what kind of automated contributions are handled are allowed, and what kind of automation the maintainers of a project use.

There's a draft spec at https://github.com/CPAN-Security/cpan-metadata-v3/blob/main/automation-policy.md but it's already out-of-sync with the Perl code.

Ideas and feedback would be appreciated.

https://metacpan.org/release/RRWO/Dist-AutomationPolicy-v0.1.0

#CPAN

@barubary @offseq

Nope. Perl's built-in rand is seeded by 32-bits. The size of the internal state doesn't matter.

By making several requests to get session IDs, one can deduce the internal state of rand.

The multiplier does nothing to improve the security. Ultimately rand is just based in 32-bits.

#perl #cpan #cve

@barubary @offseq

Nope. Perl's built-in rand is seeded by 32-bits. The size of the internal state doesn't matter.

By making several requests to get session IDs, one can deduce the internal state of rand.

The multiplier does nothing to improve the security. Ultimately rand is just based in 32-bits.

#perl #cpan #cve

@barubary @offseq

Nope. Perl's built-in rand is seeded by 32-bits. The size of the internal state doesn't matter.

By making several requests to get session IDs, one can deduce the internal state of rand.

The multiplier does nothing to improve the security. Ultimately rand is just based in 32-bits.

#perl #cpan #cve

@barubary @offseq

Nope. Perl's built-in rand is seeded by 32-bits. The size of the internal state doesn't matter.

By making several requests to get session IDs, one can deduce the internal state of rand.

The multiplier does nothing to improve the security. Ultimately rand is just based in 32-bits.

#perl #cpan #cve

@barubary @offseq

Nope. Perl's built-in rand is seeded by 32-bits. The size of the internal state doesn't matter.

By making several requests to get session IDs, one can deduce the internal state of rand.

The multiplier does nothing to improve the security. Ultimately rand is just based in 32-bits.

#perl #cpan #cve

@offseq Wow, the details are pretty wrong here.

The session ID generation relies on an MD5 hash seeded with the built-in rand() function, which is seeded with predictable 32-bit values derived from process ID, epoch time, and object reference address.

• Perl's built-in PRNG has a 48-bit internal state and is seeded with 48 bits, not 32 bits. Edit: See below. Perl internally seeds its PRNG with 32 bits from /dev/urandom.
• The code in WebDyne::Session does not seed the PRNG explicitly.
• The value passed to rand() is converted to a double-precision floating point value and acts as an upper bound on the generated number. It is not a seed.
• WebDyne::Session effectively generates this bound as (process_id * 10_000_000_000.0 + unix_time()) * 10. The object address plays no part in this calculation. (It tries to, but the code is buggy and always multiplies by 10 instead.)

This predictability makes the session IDs insecure and potentially guessable by attackers, risking unauthorized access.

Yes. The generated session IDs are effectively something like md5_hex("2.84319174058601e+16").

The vulnerability affects versions through 2. 075 and does not apply to versions 1. 042 and earlier, which are distributed separately.

Incorrect. The vulnerability affects all versions of WebDyne::Session. The only difference is that in versions before 2.0, the "multiply by 10" code wasn't there, so the upper bound on generated random numbers was process_id * 10_000_000_000.0 + unix_time(). Everything else (md5_hex(), rand(), etc) was exactly the same.

#perl #CPAN #cve

@offseq Wow, the details are pretty wrong here.

The session ID generation relies on an MD5 hash seeded with the built-in rand() function, which is seeded with predictable 32-bit values derived from process ID, epoch time, and object reference address.

• Perl's built-in PRNG has a 48-bit internal state and is seeded with 48 bits, not 32 bits. Edit: See below. Perl internally seeds its PRNG with 32 bits from /dev/urandom.
• The code in WebDyne::Session does not seed the PRNG explicitly.
• The value passed to rand() is converted to a double-precision floating point value and acts as an upper bound on the generated number. It is not a seed.
• WebDyne::Session effectively generates this bound as (process_id * 10_000_000_000.0 + unix_time()) * 10. The object address plays no part in this calculation. (It tries to, but the code is buggy and always multiplies by 10 instead.)

This predictability makes the session IDs insecure and potentially guessable by attackers, risking unauthorized access.

Yes. The generated session IDs are effectively something like md5_hex("2.84319174058601e+16").

The vulnerability affects versions through 2. 075 and does not apply to versions 1. 042 and earlier, which are distributed separately.

Incorrect. The vulnerability affects all versions of WebDyne::Session. The only difference is that in versions before 2.0, the "multiply by 10" code wasn't there, so the upper bound on generated random numbers was process_id * 10_000_000_000.0 + unix_time(). Everything else (md5_hex(), rand(), etc) was exactly the same.

#perl #CPAN #cve

@offseq Wow, the details are pretty wrong here.

The session ID generation relies on an MD5 hash seeded with the built-in rand() function, which is seeded with predictable 32-bit values derived from process ID, epoch time, and object reference address.

• Perl's built-in PRNG has a 48-bit internal state and is seeded with 48 bits, not 32 bits. Edit: See below. Perl internally seeds its PRNG with 32 bits from /dev/urandom.
• The code in WebDyne::Session does not seed the PRNG explicitly.
• The value passed to rand() is converted to a double-precision floating point value and acts as an upper bound on the generated number. It is not a seed.
• WebDyne::Session effectively generates this bound as (process_id * 10_000_000_000.0 + unix_time()) * 10. The object address plays no part in this calculation. (It tries to, but the code is buggy and always multiplies by 10 instead.)

This predictability makes the session IDs insecure and potentially guessable by attackers, risking unauthorized access.

Yes. The generated session IDs are effectively something like md5_hex("2.84319174058601e+16").

The vulnerability affects versions through 2. 075 and does not apply to versions 1. 042 and earlier, which are distributed separately.

Incorrect. The vulnerability affects all versions of WebDyne::Session. The only difference is that in versions before 2.0, the "multiply by 10" code wasn't there, so the upper bound on generated random numbers was process_id * 10_000_000_000.0 + unix_time(). Everything else (md5_hex(), rand(), etc) was exactly the same.

#perl #CPAN #cve

@offseq Wow, the details are pretty wrong here.

The session ID generation relies on an MD5 hash seeded with the built-in rand() function, which is seeded with predictable 32-bit values derived from process ID, epoch time, and object reference address.

• Perl's built-in PRNG has a 48-bit internal state and is seeded with 48 bits, not 32 bits. Edit: See below. Perl internally seeds its PRNG with 32 bits from /dev/urandom.
• The code in WebDyne::Session does not seed the PRNG explicitly.
• The value passed to rand() is converted to a double-precision floating point value and acts as an upper bound on the generated number. It is not a seed.
• WebDyne::Session effectively generates this bound as (process_id * 10_000_000_000.0 + unix_time()) * 10. The object address plays no part in this calculation. (It tries to, but the code is buggy and always multiplies by 10 instead.)

This predictability makes the session IDs insecure and potentially guessable by attackers, risking unauthorized access.

Yes. The generated session IDs are effectively something like md5_hex("2.84319174058601e+16").

The vulnerability affects versions through 2. 075 and does not apply to versions 1. 042 and earlier, which are distributed separately.

Incorrect. The vulnerability affects all versions of WebDyne::Session. The only difference is that in versions before 2.0, the "multiply by 10" code wasn't there, so the upper bound on generated random numbers was process_id * 10_000_000_000.0 + unix_time(). Everything else (md5_hex(), rand(), etc) was exactly the same.

#perl #CPAN #cve

@offseq Wow, the details are pretty wrong here.

The session ID generation relies on an MD5 hash seeded with the built-in rand() function, which is seeded with predictable 32-bit values derived from process ID, epoch time, and object reference address.

• Perl's built-in PRNG has a 48-bit internal state and is seeded with 48 bits, not 32 bits. Edit: See below. Perl internally seeds its PRNG with 32 bits from /dev/urandom.
• The code in WebDyne::Session does not seed the PRNG explicitly.
• The value passed to rand() is converted to a double-precision floating point value and acts as an upper bound on the generated number. It is not a seed.
• WebDyne::Session effectively generates this bound as (process_id * 10_000_000_000.0 + unix_time()) * 10. The object address plays no part in this calculation. (It tries to, but the code is buggy and always multiplies by 10 instead.)

This predictability makes the session IDs insecure and potentially guessable by attackers, risking unauthorized access.

Yes. The generated session IDs are effectively something like md5_hex("2.84319174058601e+16").

The vulnerability affects versions through 2. 075 and does not apply to versions 1. 042 and earlier, which are distributed separately.

Incorrect. The vulnerability affects all versions of WebDyne::Session. The only difference is that in versions before 2.0, the "multiply by 10" code wasn't there, so the upper bound on generated random numbers was process_id * 10_000_000_000.0 + unix_time(). Everything else (md5_hex(), rand(), etc) was exactly the same.

#perl #CPAN #cve

@manwar Test2 is great, but whenever I see something using yath on one of my #CPAN testing machines it seems to be incredibly slow. Don't know why, and have better things to do than investigate, but that's put me off using it.

"575 Pull Requests in Three Weeks: What Happens When #AI Meets #CPAN Maintenance"

This is an interesting read, including the comments.

https://blogs.perl.org/users/todd_rinaldo/2026/04/575-pull-requests-in-three-weeks-what-happens-when-ai-meets-cpan-maintenance.html

#Perl #LLM #Claude

I've uploaded a new #Perl Critic policy that checks code for naive random data generation from a hash over not-so-randonm sources like rand(), system time, pid such as

md5_hex( rand . time . $$ . ++$counter )

This anti-pattern is used in many places, and has been the reason for several CVEs.

https://metacpan.org/release/RRWO/Perl-Critic-Policy-Security-RandBytesFromHash-v0.1.0

#CPAN #security

As a scholarly aside, I am curious as to who first came up this anti-pattern.

Gonna build a #CPAN testing VM with #DragonflyBSD. Any gotchas that my fedihomies think that a seasoned Unixhead should know about?

#perl

A few days ago I tried to build some perls with 32 bit ints and 128 bit floats. Cue test failures. Today I tried again, and this time I read my notes from last time on how to do it, and it Just Works.

Yay past me!

(the #BigInt modules bundled with some versions of perl don't like that combination of data sizes; the solution is to ignore their test failures, install anyway, and then upgrade to the latest versions from the #CPAN)

#perl #32bit #RidiculousComputing #ComputationalPerversions

I have released a new version of App::CpanDak, my sub-class of App::cpanminus / cpanm with "some sort of distroprefs"

You could already apply patches, skip tests, and set environment variables, to any distribution you installed; now you can augment version specifications.

Some::Fancy::Library has released a new version 1.3.4 that doesn't install cleanly? add a Some-Fancy-Library.options.yml with:

---
add_version_spec: "!= 1.3.4"

Hm, did Data::Random got deleted from #CPAN? I have some failing build pipelines and metacpan does not list it anymore, only some dependencies. #Perl Anybody knows who can investigate this?

MetaCPAN @metacpan now displays security advisories when you are viewing a module with advisories.

#Perl #CPAN #security #infosec #CVE @cpansec

@cpansec published a 2025 year in review!

We had lots of activities, and good progress in many places, but can do more.

Check it out, and if you feel inspired, join us!

https://security.metacpan.org/2026/01/31/CPANSec-Retrospective-2025.html

#CPAN #Perl #Security #FOSS #SupplyChainSecurity

I've released a new version of the #Perl module Hash::Util::Merge to #CPAN.

This module lets you merge hashes by applying a function to each value per key.

This version allows you to merge an arbitrary number of hashes

https://metacpan.org/release/RRWO/Hash-Util-Merge-v0.3.0

📡 Đã có module CPAN NOAA::Aurora giúp tích hợp dự báo cực quang vào app thời tiết. Cung cấp bản đồ cực quang bán cầu Bắc, tính xác suất tại tọa độ, và chuỗi dự báo 3 ngày hoặc 27 ngày từ NOAA SWPC. Dễ dùng, hỗ trợ cache. #NOAA #Aurora #SpaceWeather #CPAN #Perl #cựcquang #khíhạcvũtrụ

https://dev.to/dkechag/noaaaurora-for-space-weather-forecasts-793

Well, #Debian #Trixie 64-bit seems to be rock-solid when I run it in #Virtualbox, it's only a crashy piece of shit in #UTM. 32-bit Trixie is fine in UTM, as are #FreeBSD and #OpenBSD. This isn't a general 64-bit #Linux issue, as #Devuan #Excalibur seems to be stable.

I suppose that means it's time to ditch Debian for my #CPAN testing.

Is #CPAN still having issues? I made a new release, which shows up here:

https://metacpan.org/dist/Text-Markup

But some of the individual modules don't, e.g.,

https://metacpan.org/pod/Text::Markup

I poked around #perl blogs but didn't see any news

Regret to report that I have perpetrated software. Number::Phone version 4.0009 is on its way to the #CPAN. There are no significant code changes, it's mostly just data updates.

#perl #telecoms

RE: https://chaos.social/@sjn/115657831506377676

This is highly relevant for maintainers of #Perl and #CPAN packages. If you are interested in helping make CPAN secure (and therefore compliant), then join us!

https://security.metacpan.org/

Noticed tagline on CPAN (https://www.cpan.org). Great lines!

#CPAN #Perl

RE: https://fosstodon.org/@the_underbar/115550427921873654

We're famous! Hooray! 😄

(Well, not really. But the episode was good! 😅)

#CPAN #OpenSource #Security #Podcast

" This module is #unsupported, #unloved, #unmaintained, #obsolete, and #DEPRECATED. The most egregious of bugs might be fixed but I do not promise to do so. There is no support. Using this module is a Bad Idea. Under no circumstances will maintenance be handed over to anyone else. The PAUSE admins should note that anyone wanting to take over maintenance is not qualified to do so. "

Place your bets now on how many people are too fucking stupid to understand that in my code's doco.

#perl #cpan

" This module is #unsupported, #unloved, #unmaintained, #obsolete, and #DEPRECATED. The most egregious of bugs might be fixed but I do not promise to do so. There is no support. Using this module is a Bad Idea. Under no circumstances will maintenance be handed over to anyone else. The PAUSE admins should note that anyone wanting to take over maintenance is not qualified to do so. "

Place your bets now on how many people are too fucking stupid to understand that in my code's doco.

#perl #cpan

" This module is #unsupported, #unloved, #unmaintained, #obsolete, and #DEPRECATED. The most egregious of bugs might be fixed but I do not promise to do so. There is no support. Using this module is a Bad Idea. Under no circumstances will maintenance be handed over to anyone else. The PAUSE admins should note that anyone wanting to take over maintenance is not qualified to do so. "

Place your bets now on how many people are too fucking stupid to understand that in my code's doco.

#perl #cpan

" This module is #unsupported, #unloved, #unmaintained, #obsolete, and #DEPRECATED. The most egregious of bugs might be fixed but I do not promise to do so. There is no support. Using this module is a Bad Idea. Under no circumstances will maintenance be handed over to anyone else. The PAUSE admins should note that anyone wanting to take over maintenance is not qualified to do so. "

Place your bets now on how many people are too fucking stupid to understand that in my code's doco.

#perl #cpan

" This module is #unsupported, #unloved, #unmaintained, #obsolete, and #DEPRECATED. The most egregious of bugs might be fixed but I do not promise to do so. There is no support. Using this module is a Bad Idea. Under no circumstances will maintenance be handed over to anyone else. The PAUSE admins should note that anyone wanting to take over maintenance is not qualified to do so. "

Place your bets now on how many people are too fucking stupid to understand that in my code's doco.

#perl #cpan

#Perl conferences, mailing lists, and #CPAN (the Comprehensive Perl Archive Network) created a vibrant ecosystem long before the modern package managers of today. As the web matured and new languages emerged, #Python, #PHP, and later #Ruby, Perl’s dominance gradually waned. Still, many of the ideas Perl popularised, from regular expressions to package repositories, remain foundational today.
3/4

I’ve just published a new Ansible module called perlmod_install_info whose purpose is to help you install Perl modules on systems in the most portable way possible.

Specifically, this module knows how to search for Perl modules in dnf, yum, and apt repositories as well as in cpanm. It prefers the OS repositories over CPAN because generally speaking you’re better off going with the OS-packaged versions of modules when they’re available, both because that’s more robust and because the OS packages install much faster than CPAN. CPAN is needed as a backstop because the OS distributions don’t include all Perl modules.

What’s especially clever about this module is that when it does need to resort to CPAN to find a module that isn’t available in the OS repository, it recursively determines all of the dependencies of that module and checks for them in the OS repository. It then returns lists of modules you can install from the OS and modules you need to install from CPAN, so you can minimize the number of modules that end up coming from CPAN.

If this sounds useful to you, you can check it out on GitHub.

#Ansible #apt #CPAN #cpanm #dnf #Perl #perlmodInstallInfo #yum

https://blog.kamens.us/2023/09/13/just-published-perlmod_install_info-ansible-module/

I tried to tinker a bit with some Git branch for a future #PullRequest before “doing the real work” …

Now I’ve dug deeply into `cpanm` code, created two truth tables of 32 cases each and lost the whole day writing a lengthy update on this #GitHub issue. 😂
https://github.com/miyagawa/cpanminus/issues/651#issuecomment-1693607035

The issue is actually about building small #Docker containers with minimal @Perl dependencies while using the #CPAN client #cpanm alias #cpanminus.

@Perl Good news, the #Perl module IO::Socket::SSL now defaults to using the #TLS cryptographic protocol version 1.2 or greater. (Earlier versions have been widely deprecated for a couple of years due to weaknesses found in the #MD5 and #SHA1 hashing functions.)

Note that if you’ve updated #OpenSSL recently you may also have to rebuild and reinstall Net::SSLeay from #CPAN.

#infosec #security #cryptography #SSL https://g0v.social/@gugod/110392435778885615

@ovid @fuzzix I don’t do #Windows #Perl either, but the main thing is you use #ActiveState’s package manager instead of #StrawberryPerl’s full inclusion of #CPAN support and a C compiler toolchain

How to install Perl modules on Linux #Perl #PerlModules #cpan #cpanm #cpanminus #Linux
https://www.ostechnix.com/how-to-install-perl-modules-on-linux/