BBC: Blead Breaks LWP::Authen::Wsse

[jkeenan]

Prompted by a mention by @cjg-cguevara in #23526 (comment), I have been investigating recent CPANtesters failures in LWP::Authen::Wsse; see CPANtesters.

For me the essence of the failure was this:

$ uname -mrs
Linux 6.1.0-33-amd64 x86_64

$ gcc --version | head -n 2
gcc (Debian 12.2.0-14+deb12u1) 12.2.0
Copyright (C) 2022 Free Software Foundation, Inc.

$ ./bin/perl -v | head -2 | tail -1
This is perl 5, version 43, subversion 2 (v5.43.2 (v5.43.1-170-gcd791bd6a2)) built for x86_64-linux

$ ./bin/perl -V:config_args
config_args='-des -Dusedevel -Uversiononly -Dprefix=/home/jkeenan/testing/blead -Dman1dir=none -Dman3dir=none';

$ ./bin/cpan LWP::Authen::Wsse
Loading internal logger. Log::Log4perl recommended for better logging
Reading '/home/jkeenan/.cpan/Metadata'
  Database was generated on Sun, 03 Aug 2025 16:29:02 GMT
CPAN: HTTP::Tiny loaded ok (v0.090)
CPAN: Net::SSLeay loaded ok (v1.94)
CPAN: IO::Socket::SSL loaded ok (v2.095)
Fetching with HTTP::Tiny:
https://cpan.org/authors/01mailrc.txt.gz
Reading '/home/jkeenan/.cpan/sources/authors/01mailrc.txt.gz'
CPAN: Compress::Zlib loaded ok (v2.213)
............................................................................DONE
Fetching with HTTP::Tiny:
https://cpan.org/modules/02packages.details.txt.gz
Reading '/home/jkeenan/.cpan/sources/modules/02packages.details.txt.gz'
  Database was generated on Fri, 08 Aug 2025 01:41:02 GMT
  HTTP::Date not available
............................................................................DONE
Fetching with HTTP::Tiny:
https://cpan.org/modules/03modlist.data.gz
Reading '/home/jkeenan/.cpan/sources/modules/03modlist.data.gz'
DONE
Writing /home/jkeenan/.cpan/Metadata
Running install for module 'LWP::Authen::Wsse'
Fetching with HTTP::Tiny:
https://cpan.org/authors/id/A/AU/AUTRIJUS/LWP-Authen-Wsse-0.05.tar.gz
CPAN: Digest::SHA loaded ok (v6.04)
Fetching with HTTP::Tiny:
https://cpan.org/authors/id/A/AU/AUTRIJUS/CHECKSUMS
Checksum for /home/jkeenan/.cpan/sources/authors/id/A/AU/AUTRIJUS/LWP-Authen-Wsse-0.05.tar.gz ok
'YAML' not installed, will not store persistent state
CPAN: CPAN::Meta::Requirements loaded ok (v2.143)
CPAN: Parse::CPAN::Meta loaded ok (v2.150010)
CPAN: CPAN::Meta loaded ok (v2.150010)
Configuring A/AU/AUTRIJUS/LWP-Authen-Wsse-0.05.tar.gz with Makefile.PL
CPAN: CPAN::Reporter loaded ok (v1.2020)
Not a GLOB reference at /home/autrijus/.cpanplus/5.8.7/build/LWP-Authen-Wsse-0.04/inc/Module/Install.pm - /usr/local/lib/perl5/site_perl/5.8.7/Module/Install.pm line 83.
BEGIN failed--compilation aborted at Makefile.PL line 2.
(/home/jkeenan/testing/blead/bin/perl Makefile.PL INSTALLDIRS=site exited with 65280)
CPAN::Reporter: Makefile.PL result is 'unknown', Stopped with an error.
CPAN::Reporter: preparing a CPAN Testers report for LWP-Authen-Wsse-0.05
Do you want to review or edit the test report? (yes/no) [no] no
Do you want to send the report? (yes/no) [yes] yes
CPAN::Reporter: sending test report with 'unknown' via Metabase
Warning: No success on command[/home/jkeenan/testing/blead/bin/perl Makefile.PL INSTALLDIRS=site]
  AUTRIJUS/LWP-Authen-Wsse-0.05.tar.gz
  /home/jkeenan/testing/blead/bin/perl Makefile.PL INSTALLDIRS=site -- NOT OK

Note this "red flag":

Not a GLOB reference at /home/autrijus/.cpanplus/5.8.7/build/LWP-Authen-Wsse-0.04/inc/Module/Install.pm - /usr/local/lib/perl5/site_perl/5.8.7/Module/Install.pm line 83.
BEGIN failed--compilation aborted at Makefile.PL line 2.
(/home/jkeenan/testing/blead/bin/perl Makefile.PL INSTALLDIRS=site exited with 65280)

On the one hand, Not a GLOB reference is reminiscent of what we've been getting in failures associated with c005319 and #23131. See, for example, https://www.cpantesters.org/cpan/report/a82031c8-6e14-11f0-8489-d537f6d493e0.

On the other hand, inc/Module/Install.pm is a well-known problem. And what's that `/.cpanplus/5.8.7' doing there? (LWP-Authen-Wsse was last released to CPAN in 2005.)

And on the third hand, my own attempt to bisect the problem, with the following invocation:

$ perl Porting/bisect.pl \
--start=bbfbc490422f71c8728cccfdb87b7409d88e8cd2 \
--end=2d8768c62da44d40f518174ec6283bb8c848d62a \
--module=LWP::Authen::Wsse \
--with-module=HTML::Entities,HTML::HeadParser

... pointed to a commit other than c005319:

b7a7434345a06e5d95cb747b545da0c987aa5fc6 is the first bad commit
commit b7a7434345a06e5d95cb747b545da0c987aa5fc6
Author: Karl Williamson <khw@cpan.org>
Date:   Sun Jul 13 09:57:28 2025 -0600
Commit:     Karl Williamson <khw@cpan.org>
CommitDate: Mon Jul 28 08:01:05 2025 -0600

    mathoms.c Remove functions that just call their macro

We need more eyeballs here.

[mauke]

The weird file path is from https://metacpan.org/release/AUTRIJUS/LWP-Authen-Wsse-0.05/source/inc/Module/Install.pm#L1. Basically, treat /home/autrijus/.cpanplus/5.8.7/build/LWP-Authen-Wsse-0.04/inc/Module/Install.pm - /usr/local/lib/perl5/site_perl/5.8.7/Module/Install.pm as "the bundled Module::Install module". I'm not sure why the name has a cpanplus build directory hardcoded inside.

[mauke]

Possible fix: Change line 84

            next unless defined *{$glob}{CODE};

to

            next unless defined &{ref($obj) . '::' . $method};

That might just expose other issues, though.

[jkeenan]

Possible fix: Change line 84

        next unless defined *{$glob}{CODE};

to

        next unless defined &{ref($obj) . '::' . $method};

That might just expose other issues, though.

 82     foreach my $obj (@exts) {
 83         while (my ($method, $glob) = each %{ref($obj) . '::'}) {
 84             #next unless defined *{$glob}{CODE};
 85             next unless defined &{ref($obj) . '::' . $method};
 86             next if $method =~ /^_/;
 87             next if $method eq uc($method);
 88             $seen_method{$method}++;
 89         }
 90     }

Thanks, that surgery "worked" in the sense that when I did a fresh install of Perl 5 blead:

• bleadperl Makefile.PL failed, citing problem with inc/Module/Install.pm.
• After manually editing inc/Module/Install.pm in ~/.cpan/build/... directory, bleadperl Makefile.PL PASSed but cited two missing prerequisites.
• bleadcpan managed to install those 2 prereqs -- along with a ton of their prereqs.
• make and make test run manually in the ~/.cpan/build... directory completed successfully -- but that's almost meaningless because the only test is whether the module loads or not.

So it appears that a bundled Module::Install is once again the culprit.

[bulk88]

Possible fix: Change line 84

        next unless defined star{$glob}{CODE};

to

        next unless defined &{ref($obj) . '::' . $method};

That might just expose other issues, though.

1 old looks less use warnings strict violating than 2 . defined *{$glob}{CODE}; is something that needs to be fixed in some pp function for RV2CV optimization. Glob operator shouldn't be providing non-CPAN not public C API C level access to the HeVAL struct member in a HE * in a %:: HV , on the PURE PERL level.

It's a small test change to recog type sviv rok to a type cv, is a GV ptr on a higher level, don't just test the SvTYPE() of HeVAL for t_PVGV and call it done.