.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1 +1,87 @@
-SOURCES/App-cpanminus-1.7044.tar.gz
+App-cpanminus-0.9935.tar.gz
+/App-cpanminus-1.0013.tar.gz
+/App-cpanminus-1.0014.tar.gz
+/App-cpanminus-1.0015.tar.gz
+/App-cpanminus-1.1002.tar.gz
+/App-cpanminus-1.1004.tar.gz
+/App-cpanminus-1.1006.tar.gz
+/App-cpanminus-1.1007.tar.gz
+/App-cpanminus-1.1008.tar.gz
+/App-cpanminus-1.2001.tar.gz
+/App-cpanminus-1.3000.tar.gz
+/App-cpanminus-1.3001.tar.gz
+/App-cpanminus-1.4000.tar.gz
+/App-cpanminus-1.4003.tar.gz
+/App-cpanminus-1.4004.tar.gz
+/App-cpanminus-1.4005.tar.gz
+/App-cpanminus-1.4006.tar.gz
+/App-cpanminus-1.4007.tar.gz
+/App-cpanminus-1.4008.tar.gz
+/App-cpanminus-1.5000.tar.gz
+/App-cpanminus-1.5001.tar.gz
+/App-cpanminus-1.5002.tar.gz
+/App-cpanminus-1.5003.tar.gz
+/App-cpanminus-1.5004.tar.gz
+/App-cpanminus-1.5005.tar.gz
+/App-cpanminus-1.5006.tar.gz
+/App-cpanminus-1.5007.tar.gz
+/App-cpanminus-1.5008.tar.gz
+/App-cpanminus-1.5010.tar.gz
+/App-cpanminus-1.5011.tar.gz
+/App-cpanminus-1.5013.tar.gz
+/App-cpanminus-1.5014.tar.gz
+/App-cpanminus-1.5015.tar.gz
+/App-cpanminus-1.5017.tar.gz
+/App-cpanminus-1.5018.tar.gz
+/App-cpanminus-1.5019.tar.gz
+/App-cpanminus-1.5021.tar.gz
+/App-cpanminus-1.6002.tar.gz
+/App-cpanminus-1.6005.tar.gz
+/App-cpanminus-1.6006.tar.gz
+/App-cpanminus-1.6008.tar.gz
+/App-cpanminus-1.6101.tar.gz
+/App-cpanminus-1.6102.tar.gz
+/App-cpanminus-1.6104.tar.gz
+/App-cpanminus-1.6105.tar.gz
+/App-cpanminus-1.6107.tar.gz
+/App-cpanminus-1.6108.tar.gz
+/App-cpanminus-1.6902.tar.gz
+/App-cpanminus-1.6907.tar.gz
+/App-cpanminus-1.6909.tar.gz
+/App-cpanminus-1.6911.tar.gz
+/App-cpanminus-1.6912.tar.gz
+/App-cpanminus-1.6913.tar.gz
+/App-cpanminus-1.6914.tar.gz
+/App-cpanminus-1.6915.tar.gz
+/App-cpanminus-1.6918.tar.gz
+/App-cpanminus-1.6921.tar.gz
+/App-cpanminus-1.6922.tar.gz
+/App-cpanminus-1.6927.tar.gz
+/App-cpanminus-1.7001.tar.gz
+/App-cpanminus-1.7004.tar.gz
+/App-cpanminus-1.7009.tar.gz
+/App-cpanminus-1.7011.tar.gz
+/App-cpanminus-1.7012.tar.gz
+/App-cpanminus-1.7014.tar.gz
+/App-cpanminus-1.7016.tar.gz
+/App-cpanminus-1.7018.tar.gz
+/App-cpanminus-1.7019.tar.gz
+/App-cpanminus-1.7020.tar.gz
+/App-cpanminus-1.7022.tar.gz
+/App-cpanminus-1.7025.tar.gz
+/App-cpanminus-1.7027.tar.gz
+/App-cpanminus-1.7030.tar.gz
+/App-cpanminus-1.7031.tar.gz
+/App-cpanminus-1.7034.tar.gz
+/App-cpanminus-1.7036.tar.gz
+/App-cpanminus-1.7037.tar.gz
+/App-cpanminus-1.7038.tar.gz
+/App-cpanminus-1.7039.tar.gz
+/App-cpanminus-1.7040.tar.gz
+/App-cpanminus-1.7041.tar.gz
+/App-cpanminus-1.7042.tar.gz
+/App-cpanminus-1.7043.tar.gz
+/App-cpanminus-1.7044.tar.gz
+/App-cpanminus-1.7045.tar.gz
+/App-cpanminus-1.7046.tar.gz
+/App-cpanminus-1.7047.tar.gz

.perl-App-cpanminus.metadata

@@ -1 +0,0 @@
-3cd3997099036fce470b42b0c95d31f01e2543ff SOURCES/App-cpanminus-1.7044.tar.gz

App-cpanminus-1.7044-SHA1-SHA256-in-checksum-chat.patch

@@ -0,0 +1,32 @@
+From 215c69b180f8de546c5965c37950d67c6cd8dc33 Mon Sep 17 00:00:00 2001
+From: Stig Palmquist <stig@stig.io>
+Date: Tue, 9 Mar 2021 09:29:43 +0100
+Subject: [PATCH] SHA1 -> SHA256 in checksum chat()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Petr Pisar: Ported from 2c24e534bbd1b843233dda3d66650645883f70a2
+commit in upstream devel branch.
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ lib/App/cpanminus/script.pm | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/App/cpanminus/script.pm b/lib/App/cpanminus/script.pm
+index 1b26b5d..af44442 100644
+--- a/lib/App/cpanminus/script.pm
++++ b/lib/App/cpanminus/script.pm
+@@ -1637,7 +1637,7 @@ sub verify_archive {
+ sub verify_checksum {
+     my($self, $file, $chk_file) = @_;
+ 
+-    $self->chat("Verifying the SHA1 for $file\n");
++    $self->chat("Verifying the SHA256 for $file\n");
+ 
+     open my $fh, "<$chk_file" or die "$chk_file: $!";
+     my $data = join '', <$fh>;
+-- 
+2.26.2
+

gating.yaml

@@ -0,0 +1,19 @@
+# Fedora
+--- !Policy
+id: fedora_policy
+product_versions:
+  - fedora-*
+decision_contexts:
+  - bodhi_update_push_testing
+  - bodhi_update_push_stable
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
+
+# RHEL
+--- !Policy
+product_versions:
+  - rhel-*
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

perl-App-cpanminus.rpmlintrc

@@ -0,0 +1,2 @@
+from Config import *
+addFilter("-tests.noarch: W: no-documentation");

perl-App-cpanminus.spec

@@ -1,20 +1,26 @@
 Name:           perl-App-cpanminus
-Version:        1.7044
+Version:        1.7047
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        Get, unpack, build and install CPAN modules
-License:        GPL+ or Artistic
+# Other files:  GPL+ or Artistic
-Group:          Development/Libraries
+## unbundled
+# lib/App/cpanminus/fatscript.pm:   File::pushd:    ASL 2.0
+## at build-time only
+# fatunpack:    GPL+
+License:        GPL-1.0-or-later OR Artistic-1.0-Perl
 URL:            https://metacpan.org/release/App-cpanminus
 Source0:        https://cpan.metacpan.org/authors/id/M/MI/MIYAGAWA/App-cpanminus-%{version}.tar.gz
 Source1:        fatunpack
+# Correct an SHA version in a message, in upstream's devel branch,
+# <https://github.com/miyagawa/cpanminus/pull/617>
+Patch0:         App-cpanminus-1.7044-SHA1-SHA256-in-checksum-chat.patch
 BuildArch:      noarch
 BuildRequires:  %{_bindir}/podselect
 BuildRequires:  coreutils
-BuildRequires:  findutils
 BuildRequires:  make
-BuildRequires:  perl-interpreter
 BuildRequires:  perl-generators
-BuildRequires:  perl(ExtUtils::MakeMaker) >= 6.30
+BuildRequires:  perl-interpreter
+BuildRequires:  perl(ExtUtils::MakeMaker) >= 6.76
 BuildRequires:  perl(File::Path)
 BuildRequires:  perl(File::Spec)
 BuildRequires:  perl(Getopt::Long)
@@ -67,7 +73,6 @@ Requires:       perl-core
 %else
 Requires:       perl
 %endif
-Requires:       perl(:MODULE_COMPAT_%(eval "`perl -V:version`"; echo $version))
 # Current dependency generator cannot parse compressed code. Use PPI to find
 # them, and list them manually:
 # Archive::Tar is optional
@@ -75,7 +80,7 @@ Requires:       perl(:MODULE_COMPAT_%(eval "`perl -V:version`"; echo $version))
 # Compress::Zlib is optional
 Requires:       perl(CPAN::DistnameInfo)
 Requires:       perl(CPAN::Meta)
-Requires:       perl(CPAN::Meta::Check)
+Requires:       perl(CPAN::Meta::Check) >= 0.018
 Requires:       perl(CPAN::Meta::YAML)
 Requires:       perl(Digest::SHA)
 Requires:       perl(ExtUtils::Install) >= 1.46
@@ -113,25 +118,51 @@ Why? It's dependency free, requires zero configuration, and stands alone
 but it's maintainable and extensible with plug-ins and friendly to shell 
 scripting. When running, it requires only 10 MB of RAM.
 
+%package tests
+Summary:        Tests for %{name}
+Requires:       %{name} = %{?epoch:%{epoch}:}%{version}-%{release}
+Requires:       perl-Test-Harness
+
+%description tests
+Tests from %{name}. Execute them
+with "%{_libexecdir}/%{name}/test".
+
 %prep
 %setup -q -n App-cpanminus-%{version}
 # Unbundle fat-packed modules
 podselect lib/App/cpanminus.pm > lib/App/cpanminus.pod
 
 for F in bin/cpanm lib/App/cpanminus/fatscript.pm; do
+    # CVE-2024-45321 - patch to use https instead of http
+    perl -pi -E 's{http://(cpan\.cpantesters\.org|www\.cpan\.org|backpan\.perl\.org|cpan\.metacpan\.org|fastapi\.metacpan\.org|cpanmetadb\.plackperl\.org)}{https://$1}g' "$F"
     %{SOURCE1} --libdir lib --filter '^App/cpanminus' "$F" > "${F}.stripped"
     perl -c -Ilib "${F}.stripped"
     mv "${F}.stripped" "$F"
 done
 
+%patch -P0 -p1
+
+# Help generators to recognize Perl scripts
+for F in t/*.t; do
+    perl -i -MConfig -ple 'print $Config{startperl} if $. == 1' "$F"
+    chmod +x "$F"
+done
+
 %build
-perl Makefile.PL INSTALLDIRS=vendor
+perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1 NO_PERLLOCAL=1
-make %{?_smp_mflags}
+%{make_build}
 
 %install
-make pure_install DESTDIR=%{buildroot}
+%{make_install}
-find %{buildroot} -type f -name .packlist -delete
 %{_fixperms} %{buildroot}/*
+# Install tests
+mkdir -p %{buildroot}%{_libexecdir}/%{name}
+cp -a t %{buildroot}%{_libexecdir}/%{name}
+cat > %{buildroot}%{_libexecdir}/%{name}/test << 'EOF'
+#!/bin/bash
+cd %{_libexecdir}/%{name} && exec prove -I . -j "$(getconf _NPROCESSORS_ONLN)"
+EOF
+chmod +x %{buildroot}%{_libexecdir}/%{name}/test
 
 %check
 make test
@@ -139,14 +170,86 @@ make test
 %files
 %license LICENSE
 %doc Changes README
-%{perl_vendorlib}/*
+%{perl_vendorlib}/App*
-%{_mandir}/man3/*
+%{_mandir}/man1/cpanm*
-%{_mandir}/man1/*
+%{_mandir}/man3/App::cpanminus*
 %{_bindir}/cpanm
 
+%files tests
+%{_libexecdir}/%{name}
+
 %changelog
-* Fri Mar 29 2019 Jitka Plesnikova <jplesnik@redhat.com> - 1.7044-5
+* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1.7047-6
-- Rebuild with enable hardening (bug #1636329)
+- Bump release for October 2024 mass rebuild:
+  Resolves: RHEL-64018
+
+* Mon Sep 23 2024 Jitka Plesnikova <jplesnik@redhat.com> - 1.7047-5
+- Patch the code to use https instead of http (CVE-2024-45321)
+- Resolves: RHEL-56507
+
+* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 1.7047-4
+- Bump release for June 2024 mass rebuild
+
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.7047-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.7047-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Tue Aug 01 2023 Jitka Plesnikova <jplesnik@redhat.com> - 1.7047-1
+- 1.7047 bump (rhbz#2227489)
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.7046-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.7046-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.7046-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Tue May 31 2022 Jitka Plesnikova <jplesnik@redhat.com> - 1.7046-2
+- Perl 5.36 rebuild
+
+* Wed Apr 27 2022 Jitka Plesnikova <jplesnik@redhat.com> - 1.7046-1
+- 1.7046 bump
+
+* Thu Jan 27 2022 Jitka Plesnikova <jplesnik@redhat.com> - 1.7045-1
+- 1.7045 bump
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.7044-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.7044-14
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Fri May 21 2021 Jitka Plesnikova <jplesnik@redhat.com> - 1.7044-13
+- Perl 5.34 rebuild
+
+* Tue Mar 09 2021 Petr Pisar <ppisar@redhat.com> - 1.7044-12
+- Correct an SHA version in a message
+- Package tests
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.7044-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.7044-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jun 23 2020 Jitka Plesnikova <jplesnik@redhat.com> - 1.7044-9
+- Perl 5.32 rebuild
+
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.7044-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.7044-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Fri May 31 2019 Jitka Plesnikova <jplesnik@redhat.com> - 1.7044-6
+- Perl 5.30 rebuild
+
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.7044-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 
 * Mon Jul 16 2018 Petr Pisar <ppisar@redhat.com> - 1.7044-4
 - Require full Perl for non-duallived sub-packaged core modules

plans/internal.fmf

@@ -0,0 +1,12 @@
+summary: Private (RHEL) beakerlib tests
+enabled: false
+adjust:
+  - when: distro == rhel
+    enabled: true
+    because: private tests are accesible only within rhel pipline
+discover:
+  - name: rhel
+    how: fmf
+    url: https://pkgs.devel.redhat.com/git/tests/perl-App-cpanminus
+execute:
+    how: tmt

plans/sanity.fmf

@@ -0,0 +1,5 @@
+summary: Sanity tests
+discover:
+    how: fmf
+execute:
+    how: tmt

sources

@@ -0,0 +1 @@
+SHA512 (App-cpanminus-1.7047.tar.gz) = c58b58773b5cd06f346228af46136beffcf07cf49dd51c6d914e2fe4c2a592b5c94901510da8c7ff55795e6beb25bf5344ac798d817ab0a1f2450ff75cbaa17d

tests/upstream-tests.fmf

@@ -0,0 +1,11 @@
+summary: Upstream tests
+component: perl-App-cpanminus
+require: perl-App-cpanminus-tests
+test: /usr/libexec/perl-App-cpanminus/test
+enabled: true
+tag:
+  - rhel-buildroot
+adjust:
+  - enabled: false
+    when: distro < rhel-10 or distro < centos-stream-10
+    continue: false