NEILB's Blog

Last week I attended the toolchain summit in Lyon, along with 38 other members of our community. For four days we were all working to make the CPAN and Perl toolchain better. This is my log of what I did.

I was one of the organisers, so a good chunk of time was spent on admin tasks. This included things like making sure we had a stand-up every day, keeping people informed about discussions and other events going on, tweeting to thank all the sponsors, and solving various issues that came up.

There were a number of PAUSE issues I really wanted to see fixed, including two security issues related to permissions. Andreas and I went through the list on the first day, and agreed priorities. Pete Sergeant wrote a test case for one of the security issues, after talking it through with Graham Knop. I banged my head against the other security issue for a while, and eventually reproduced it. Andreas wrote a test for it, and then fixed both of them. Kenichi Ishigaki subsequently fixed one of the other issues on the hitlist. A successful summit for PAUSE!

I sketched a document with ideas for how we might define the quality of CPAN distributions. A group of us had a session where we walked through this and bounced around each of the quality attributes, identifying existing tool support, and ideas for filling at least some of the gaps. I'll be writing up a long blog post on this, in the next couple of weeks.

I wrote a guide to running the summit, and organised a session where we went through the guide. This resulted in a lot of good input from people trying to make the event even better. The idea is to have a clear definition of what the summit is and isn't, how we decide who attends, and how to run it. One of the goals is to have a play book that makes it easier to run. Right now it's a rough google doc with lots of notes taken during the session. I'm going to distil it down to a markdown document in github.

There were a number of ad-hoc discussions on CPAN distributions that don't follow certain conventions, and ideas for dealing with them, and making it easier for packagers and tool writers to choose to ignore them. We bounced around some proposals, many of which were shot down. One of the ideas was to create an alternative index for CPAN, which has a number of stricter criteria for inclusion, and which only includes the latest release for each distribution. We're going to work on that idea some more to see if it has legs.

Following the above discussion, I decided to try and do more to sort out CPAN distributions that don't have a META file in the release tarball. I'm ordering the list by CPAN River position, and the furthest upriver distribution (Expect) has already been fixed.

Writing blog posts about distribution metadata before the summit had prompted some ideas. I raised tickets on two of them, one of which was implemented in ExtUtils::MakeMaker by Chris Williams (BINGOS).

I chaired a retrospective on the handling of DBIx::Class ownership. You'll be hearing about two specific recommendations from this very soon.

I reviewed the new MetaCPAN interfaces for viewing PAUSE permissions, and went through some ideas with Babs Veloso. She has started working on ideas for improving the interfaces, which I owe her more feedback on. She was greatly in demand: it's incredibly useful having someone with design skills at the summit.

I did some more work on my stand-alone river data generator. I ended up not spending as much time on this as I'd hoped I would, but I'm almost there.

The toolchain summit is only possible with the support of sponsors. Thank you to Booking.com, ActiveState, cPanel, FastMail, MaxMind, Perl Careers, MongoDB, SureVoIP, Campus Explorer, Bytemark, CAPSiDE, Charlie Gonzalez, Elastic, OpusVL, Perl Services, Procura, XS4ALL, and Oetiker+Partner.