Closed dcollinsn closed 7 years ago
Thanks for the report. This one is actually a bit trickier than your last report. The last one was fixed by adding . to all the requires in the test files. This one appears to have 2 less obvious things going wrong.
First, one of the tests ends up trying to install Test-Simple-1.302078, which appears to be the version right before Test::Simple fixed it's own . in @INC issue. I'm going to look into removing the download-and-install part of t/23_install_array.t to prevent errors in Test::Simple from tripping it up again. However, looking more closely at the time stamps in the error log, 1.302079 (the version with the @INC fix) was released well before April 11th, which concerns me a little why it chose 1.302078 instead of a later version. (edit: Oops, just noticed, 1.302079-1.302082 were trial releases, so they would not have been chosen. Rerunning this smoke now would remove this issue, but the other one would remain.)
Second, t/gh3.t and t/21_install.t both appear to be failing because PERL_USE_UNSAFE_INC was explicitly set to 0 and were trying to install the UnsafeInc test dist which intentionally fails when PERL_USE_UNSAFE_INC is false. So I'm going to look into fixing that condition, although I'm not entirely sure what the right way to go about it might be right now.
Okay, I just pushed a new version (v0.19) to CPAN that should correct this issue. @dcollinsn, would you mind verifying that this new version is fixed for you as well?
A recent security patch to Perl itself removed '.', the current working directory, from \@INC, the default search path for 'use', 'do', and 'require'. This fix for CVE-2016-1238 will be part of Perl 5.26.0, due to be released this April, 2017. CPAN clients will temporarily provide backwards compatibility during the module build/test process by setting the environment variable PERL_USE_UNSAFE_INC=1 during build, test, and install. HOWEVER:
1) This environment variable is a temporary fix only for compatibility, due to be removed for Perl 5.30.0. 2) This may mask errors in your module itself, by testing your module under different conditions than those that it will actually be run under.
To read more about this, you may find the following links helpful:
During a smoke-test of all of cpan, your distribution was found to be unable to configure, build, test, or install without adding '.' to @INC. This means that your distribution will stop building properly for all users when the CPAN clients remove this temporary compatibility fix, and that it may already have problems when
use
d, problems which are being masked by this temporary compatibility fix.A full error log follows: