CentOS 6 vs CPAN and Let's Encrypt

Here is the magic to get CPAN CLI to work with https.

# cpan

cpan[1]> o conf urllist https://www.perl.com/CPAN
Please use 'o conf commit' to make the config permanent!

cpan[2]> o conf urllist                                 
    urllist           
        0 [https://www.perl.com/CPAN]
Type 'o conf' to view all configuration items

cpan[3]> o conf commit
commit: wrote '/usr/share/perl5/CPAN/Config.pm'

If it is giving you problems with SSL certificat verification, then you have to upgrade openssl, ca-certificate to the latest version. Perl also maintains it's own SSL certificates in Mozilla::CA, so you might need to do

SSL_CERT_FILE=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem cpan Mozilla::CA

Minimal Perl

Setting up Perl on CentOS 6. I'm putting this here so that I can find it easily.

yum install perl perl-CPAN
cpan 
# make everything automatic
o conf prerequisites_policy follow
o conf build_requires_install_policy yes
o conf commit
q
cpan local::lib
cpan Bundle::CPAN # keep an eye on this because Realine wants you to hit enter
cpan App::cpanminus

Now we can install Imager (say)

sudo yum install giflib-devel libjpeg-devel libpng-devel libtiff-devel freetype-devel t1lib-devel
cpanm Imager

Someone broke the build

One can no longer cleanly do cpan Bundle::CPAN on a fresh install of CentOS 6. Some dependencies don't install properly. I had to do the following:

cpan CPAN::Meta::YAML Parse::CPAN::Meta 
cpan Test::YAML
cpan Compress::Raw::Zlib
cpan Spiffy Test::Base
cpan Module::Metadata  CPAN::Meta Perl::OSType version
cpan Compress::Raw::Bzip2
cpan Sub::Identify
cpan SUPER
cpan Test::MockModule
cpan Bundle::CPAN

At least I didn't have to go into /root/.cpan and install things by hand.

Perl signals and fork aren't safe.

My very first Perl bug ever!

Long story short: there is a race condition between the safe signal handlers (which just update a flag) and pp_fork() invokes the system fork(). No, pp_fork() doesn't reset all the flags, so the signals could be dispatched in the child process, even if they were meant for the parent.

What boggles me is that this bug is easily over 10 years old. I find it hard to believe that no one noticed it before. Of course, it will take a while for a patch to make it into perl. And all the perls installed out their still have the bug.

The work around is to block signals, fork(), then unblock signals.

I'll write (or someone) IPC::SafeFork to do the above. But also draw attention to the issue.