[PATCH] ExtUtils::MakeMaker and world writable files in dists
[email protected] (Cosimo Streppone)
| Newsgroups | perl.qa,perl.makemaker |
|---|---|
| Message-ID | <op.uh7jtwyis5ttvb@cn01> |
Hi! I don't know if I really understand the entire "world-writable files" security hole. Anyway, I think the average CPAN author doesn't really know or care about that, sadly. See also: http://use.perl.org/~cosimo/journal/37554 I'd really prefer not having to change my tar command on every system I use. Hence the EU::MM patch. I'm almost totally ignorant about EU::MM. The patch is against trunk, and a `make dist' now works for me on Linux (5.8.8) and Windows Vista (5.10.0). The dists built have the "correct" permissions. I tried to keep the `--mode' option inside $(TARFLAGS), but it seems that gnu tar doesn't like the following: $ tar --mode=0755 cvf blah.tar somedir $ tar c --mode=0755 vf blah.tar somedir and will only accept: $ tar cvf blah.tar --mode=0755 somedir Could this work? -- Cosimo
eumm_world_writable.patch
(application/octet-stream, 2.2 KB)
Index: lib/ExtUtils/MM_Unix.pm
===================================================================
--- lib/ExtUtils/MM_Unix.pm (revision 4310)
+++ lib/ExtUtils/MM_Unix.pm (working copy)
@@ -526,6 +526,9 @@
TAR tar command to use tar
TARFLAGS flags to pass to TAR cvf
+ TARADDFLAGS additional flags to pass to --mode=0755
+ TAR, separated because of tar
+ command line arguments parsing
ZIP zip command to use zip
ZIPFLAGS flags to pass to ZIP -r
@@ -565,6 +568,7 @@
my $self = shift;
$self->{TAR} ||= 'tar';
+ $self->{TARADDFLAGS} ||= '--mode=0755';
$self->{TARFLAGS} ||= 'cvf';
$self->{ZIP} ||= 'zip';
$self->{ZIPFLAGS} ||= '-r';
@@ -601,7 +605,7 @@
my $make = '';
foreach my $key (qw(
- TAR TARFLAGS ZIP ZIPFLAGS COMPRESS SUFFIX SHAR
+ TAR TARADDFLAGS TARFLAGS ZIP ZIPFLAGS COMPRESS SUFFIX SHAR
PREOP POSTOP TO_UNIX
CI RCS_LABEL DIST_CP DIST_DEFAULT
DISTNAME DISTVNAME
@@ -764,7 +768,7 @@
$(DISTVNAME).tar$(SUFFIX) : distdir
$(PREOP)
$(TO_UNIX)
- $(TAR) $(TARFLAGS) $(DISTVNAME).tar $(DISTVNAME)
+ $(TAR) $(TARFLAGS) $(DISTVNAME).tar $(TARADDFLAGS) $(DISTVNAME)
$(RM_RF) $(DISTVNAME)
$(COMPRESS) $(DISTVNAME).tar
$(POSTOP)
Index: lib/ExtUtils/MakeMaker.pm
===================================================================
--- lib/ExtUtils/MakeMaker.pm (revision 4310)
+++ lib/ExtUtils/MakeMaker.pm (working copy)
@@ -2577,6 +2577,7 @@
SHAR ('shar')
SUFFIX ('.gz')
TAR ('tar')
+ TARADDFLAGS ('--mode=0755')
TARFLAGS ('cvf')
ZIP ('zip')
ZIPFLAGS ('-r')
Index: lib/ExtUtils/MM_VMS.pm
===================================================================
--- lib/ExtUtils/MM_VMS.pm (revision 4310)
+++ lib/ExtUtils/MM_VMS.pm (working copy)
@@ -1116,7 +1116,7 @@
$(DISTVNAME).tar$(SUFFIX) : distdir
$(PREOP)
$(TO_UNIX)
- $(TAR) "$(TARFLAGS)" $(DISTVNAME).tar [.$(DISTVNAME)...]
+ $(TAR) "$(TARFLAGS)" $(DISTVNAME).tar "$(TARADDFLAGS)" [.$(DISTVNAME)...]
$(RM_RF) $(DISTVNAME)
$(COMPRESS) $(DISTVNAME).tar
$(POSTOP)