PTS 2024 Projects

Add projects below that you're thinking of working on. If you see someone else's project that you'd like to help on, add your name, but email them as well please.

Group discussions ("consensus documents") proposals

  1. Common incident response organization and plan for Perl/PAUSE/CPAN/etc. (proposed by sjn)
  2. Security contact point consolidation and/or clarification of responsibilities. (proposed by sjn)
  3. Succession planning template. (proposed by sjn)


  1. Short presentation and discussion about CPAN version normalizing (see this blog post & cpanspec) - Tina Müller (‎tinita‎)
  2. "My future plans for Perl" - Paul Evans (‎LeoNerd‎)
  3. Cyber Resilience Act update - Salve J. Nilsen (‎sjn‎).
    • To prepare, the video from sjn's talk on NIS2 and CRA at PTS 2023 may be worth a look at, as it's still 80-90% relevant. This year's talk should get us up to speed to the current state of CRA.

Salve J. Nilsen (‎sjn‎)

  • CPANSec
    • Discussions on...
      • Introduction of project sustainability metadata to CPAN::Meta::Spec
      • Introduction of SBOMs in the toolchain and throughout the ecosystem
      • Introduction of PackageURLs in the toolchain
      • Introduction of "Open Source Software Steward" and CE-related metadata due to EU requirements
      • Operating changes in the CPAN ecosystem due to EU legislation
      • Funding & budgeting for CPAN ecosystem activities
    • Finalize PackageURL support in CPAN::DistnameInfo
    • Implement a CPAN::Meta::Spec update to prepare for new EU requirements

Test Coverage (Paul Johnson (‎pjcj‎))

  • cpancover
    • The backend system has been down for a while due to infrastructure problems
      • Containerise the entire system to isolate it from the underlying infrastructure
      • Currently only the actual Devel::Cover run is containerised
    • Simplify development setup using above work
      • Get development and production environments looking identical
    • Continue discussions on production migration
      • Consider adding redundancy
    • Simplify and automate the process of updating perl and other dependencies
  • Devel::Cover
    • look into intermittent BSD cpants failures
    • work on existing tickets

Paul Evans (‎LeoNerd‎)

  • "My future plans for Perl" - presentation
  • Followups and resolution on `local::lib-alike-in-core`, multiple MetaCPAN indexes per perl version

Breno Oliveira (‎garu‎)

  • CPANSec
    • CPAN Vulnerability Index
      • review pipelines and make index as up to date as possible
      • make feed available, browsable and searchable on our own website
      • Integrate with MetaCPAN
    • CPAN Provenance & Supply Chain Security
      • risk assessment of the Perl software supply chains, and lessons learned from recent events on PAUSE/CPAN and other languages package managers.
      • understand current state of distribution signing, limitations and what can be done to improve them either on PAUSE, cpan* client tools or MetaCPAN - maybe considering something like SLSA.
    • CPAN Metadata and SBOM
      • readers/writers for SPDX and CycloneDX
      • a module for writing a SBOM file on the fly from any indexed distribution on CPAN
      • integration with MetaCPAN
    • CPAN Software Composition Analysis
      • understand if it would be interesting to support VEX files
  • CPAN Testers
    • discuss and assess current project needs with peers and stakeholders, (hopefully) understanding why and how people use all related tools and services today (either from CPAN Testers or third parties), to trace a proper roadmap on how can the project add the most value to its actual and potential users, including:
      • better tooling (client-side)
      • better visualization and correlation features (server-side)
      • test report improvements
      • integrations (cpancover, metacpan, pause, etc)

Leo Lapworth (‎ranguard‎)

  • LOOKING FOR (more) HELP... ideally k8s or ElasticSearch experience
  • MetaCPAN - ElasticSearch now provided us with a cluster, so we need to migrate to it
  • MetaCPAN - K8's
    • Setup Cluster storage as per discussion -
    • Migrate more parts ( metacpan-explorer etc)
    • kube-state-metrics
    • Clean up old puppet systems so clear what is now in k8's
    • Clean up Fastly configs, delete any no in use
    • Look to move one of the cluster nodes to a 2nd data center
    • Possible additions - job queues / cron job failure email alerts
    • Anything else on

Ricardo Signes (‎rjbs‎) and Matthew Horsfall (‎alh‎) and Robert

  • new PAUSE server
    • make it possible to quickly install a working PAUSE instance on a stock Linux machine
    • prove it works with a relatively good degree of fidelity
    • set one up and cut "real" PAUSE over to it
    • document how to use the installer for testing
    • document how to upgrade the PAUSE software
    • look at whether we can increase the number of active PAUSE operators

Leon Timmermans (‎leont‎)

H.Merijn Brand (‎Tux‎)

Kenichi Ishigaki (‎charsbar‎)

  • Fix PAUSE deadlocks (and find unindexed distributions to reindex)
  • Add 'class' support to PAUSE indexer
  • Multifactor auth for PAUSE
  • Start discussing new and proper PAUSE API

Tina Müller (‎tinita‎)