[PATCH] ExtUtils::MakeMaker and world writable files in dists

[email protected] (Cosimo Streppone)
Newsgroups perl.qa,perl.makemaker
Message-ID <op.uh7jtwyis5ttvb@cn01>
Hi!

I don't know if I really understand the entire
"world-writable files" security hole.

Anyway, I think the average CPAN author doesn't
really know or care about that, sadly.
See also:

http://use.perl.org/~cosimo/journal/37554

I'd really prefer not having to change my tar
command on every system I use. Hence the EU::MM
patch.

I'm almost totally ignorant about EU::MM.
The patch is against trunk, and a `make dist' now
works for me on Linux (5.8.8) and Windows Vista (5.10.0).
The dists built have the "correct" permissions.

I tried to keep the `--mode' option inside $(TARFLAGS),
but it seems that gnu tar doesn't like the following:

   $ tar --mode=0755 cvf blah.tar somedir
   $ tar c --mode=0755 vf blah.tar somedir

and will only accept:

   $ tar cvf blah.tar --mode=0755 somedir

Could this work?

-- 
Cosimo
eumm_world_writable.patch (application/octet-stream, 2.2 KB)
Index: lib/ExtUtils/MM_Unix.pm
===================================================================
--- lib/ExtUtils/MM_Unix.pm	(revision 4310)
+++ lib/ExtUtils/MM_Unix.pm	(working copy)
@@ -526,6 +526,9 @@
 
   TAR           tar command to use              tar
   TARFLAGS      flags to pass to TAR            cvf
+  TARADDFLAGS   additional flags to pass to     --mode=0755
+                TAR, separated because of tar
+                command line arguments parsing
 
   ZIP           zip command to use              zip
   ZIPFLAGS      flags to pass to ZIP            -r
@@ -565,6 +568,7 @@
     my $self = shift;
 
     $self->{TAR}      ||= 'tar';
+    $self->{TARADDFLAGS} ||= '--mode=0755';
     $self->{TARFLAGS} ||= 'cvf';
     $self->{ZIP}      ||= 'zip';
     $self->{ZIPFLAGS} ||= '-r';
@@ -601,7 +605,7 @@
 
     my $make = '';
     foreach my $key (qw( 
-            TAR TARFLAGS ZIP ZIPFLAGS COMPRESS SUFFIX SHAR
+            TAR TARADDFLAGS TARFLAGS ZIP ZIPFLAGS COMPRESS SUFFIX SHAR
             PREOP POSTOP TO_UNIX
             CI RCS_LABEL DIST_CP DIST_DEFAULT
             DISTNAME DISTVNAME
@@ -764,7 +768,7 @@
 $(DISTVNAME).tar$(SUFFIX) : distdir
 	$(PREOP)
 	$(TO_UNIX)
-	$(TAR) $(TARFLAGS) $(DISTVNAME).tar $(DISTVNAME)
+	$(TAR) $(TARFLAGS) $(DISTVNAME).tar $(TARADDFLAGS) $(DISTVNAME)
 	$(RM_RF) $(DISTVNAME)
 	$(COMPRESS) $(DISTVNAME).tar
 	$(POSTOP)
Index: lib/ExtUtils/MakeMaker.pm
===================================================================
--- lib/ExtUtils/MakeMaker.pm	(revision 4310)
+++ lib/ExtUtils/MakeMaker.pm	(working copy)
@@ -2577,6 +2577,7 @@
     SHAR         ('shar')
     SUFFIX       ('.gz')
     TAR          ('tar')
+    TARADDFLAGS  ('--mode=0755')
     TARFLAGS     ('cvf')
     ZIP          ('zip')
     ZIPFLAGS     ('-r')
Index: lib/ExtUtils/MM_VMS.pm
===================================================================
--- lib/ExtUtils/MM_VMS.pm	(revision 4310)
+++ lib/ExtUtils/MM_VMS.pm	(working copy)
@@ -1116,7 +1116,7 @@
 $(DISTVNAME).tar$(SUFFIX) : distdir
 	$(PREOP)
 	$(TO_UNIX)
-        $(TAR) "$(TARFLAGS)" $(DISTVNAME).tar [.$(DISTVNAME)...]
+        $(TAR) "$(TARFLAGS)" $(DISTVNAME).tar "$(TARADDFLAGS)" [.$(DISTVNAME)...]
 	$(RM_RF) $(DISTVNAME)
 	$(COMPRESS) $(DISTVNAME).tar
 	$(POSTOP)
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.