Considering cpm

[zakame]

I'm thinking of adding App::cpm as either another CPAN tool on the standard images, or on its own Docker image tag (e.g. perl:5.28-cpm.)

@skaji @miyagawa what do you think?

[christopherraa]

👍 from me! cpm is great and far preferred over cpanm.

[NapoSky]

Would be definitely great to improve a lot CI which includes docker perl images

[zakame]

Revisiting this since cpanm has issues when configured to fetch over HTTPS, namely breaking fetches of dev/backpan dists that could be referenced in cpanfiles or explicitly in e.g. cpanm MyModule@1.00_01 cc @waterkip @skaji #115 (comment)

According to http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html cpm

• By default cpm always uses https and downloads files from MetaCPAN's CPAN mirror, which we consider a trusted source. You can specify your own mirror in the command-line arguments, and even in your cpanfile.

And with that latter point referring to https://metacpan.org/pod/App::cpm::Tutorial#cpanfile-and-dist/url/mirror/git-syntax

[waterkip]

I don't think it would hurt to ship it in the image, it is safe enough to try.

We could get feedback on what users would want to have, eg, cpm -g --test by default and/or other options, such as prebuilt. That should allow for a transition to cpm in favor of cpanm so we get all the good things we don't have with cpanm.

[christopherraa]

Me personally I'd prefer no default options, following the principle of least astonishment. Some have a preference to run tests for dependencies that are installed and others don't. Preference in installation targets also vary greatly. So my take is to just leave all options off and let the user add those that are required for their project.

Anyway: getting cpm into the default image would be amazing however it is done.

[zakame]

Due for release in docker-library/official-images#12612, thanks everyone for their feedback!