NEILB's Blog

Andreas König and I have been working to remove the modulelist permissions from the PAUSE database. At the QA Hackathon we worked through the remaining cases, where relevant reviewing them with RJBS, and most of them were removed on the last day of the QAH. Following the QAH we've resolved the last handful, so there are no longer any 'm' permissions in 06perms.txt. This means that the relevant parts of PAUSE can be removed, and a number of modules can be simplified.

The modulelist

In the early days of Perl 5 we didn't have PAUSE or CPAN. To share modules they'd written, people would put them on various ftp sites. As more modules were being written, we needed a way to keep track of them, so Tim Bunce started the Module List. This aimed to be a list of "all Perl 5 modules", each listed with the author.

When Andreas started work on PAUSE, his initial goal was to provide a system for maintaining the module list. As we know, it became more than that, but the permissions model retained the notion of "registered on the module list".

The permissions model

Up to now, PAUSE has had three levels of permission associated with a package:

• m, or module-list, was the highest level of ownership. PAUSE used to provide an interface where you could sign up for 'm' ownership of a namespace.
• f, or first-come, is the ownership granted if you're the first person to upload a module.
• c, or co-maint, gives you release permissions (if you release the module it will be added to the CPAN index), but you don't have permission to grant co-maint to someone else.

The 'm' permission trumped 'f': if a package had both an 'm' owner and an 'f' owner, then the 'f' was just treated like a co-maint.

A couple of years ago we dropped the ability to request an 'm' permission, but there were still nearly 8000 packages with an 'm'. This meant that the PAUSE interface still had to cope with 'm' permissions, and various modules had to know about it too.

When support for creating new 'm' permissions was dropped, we also lost the ability for PAUSE admins to reassign them: we'd have to ask Andreas to run a database update directly.

At last year's London Perl Workshop, Andreas and I had a chat about this, and agreed that I would identify batches of modules so that over time we could remove all of the 'm' permissions.

What's changed?

There are now no 'm' permissions in the PAUSE database: Generally the 'm' permissions were changed to 'f', and if there was already an 'f' then it got downgraded to a 'c'. Things were made a bit more complicated by the fact that PAUSE now handles package names case insensitively, which is why we had to work through the tricky cases at the QAH.

Ownership is now only signalled with an 'f' permission, and co-maint with a 'c'. That's it.

This means we can do the following things:

• Simplify the PAUSE interface, removing the part of the UI for handling modulelist permissions.
• Simplify modules like PAUSE::Permissions which let you query 06perms.txt, the export file from PAUSE which has all package permissions.
• Simplify documentation.
• PAUSE admins can now handle more use cases on their own, without requiring direct database intervention by Andreas.

There are still some permissions clashes resulting from the switch to case-insensitive handling of package names. That's one of my next projects.

Thanks particularly to Andreas for his patience with me over the last few months, and to Rik for his time on this at the QAH.

Thanks also to all the sponsors for the QAH: FastMail, ActiveState, ZipRecruiter, Strato, SureVoIP, CV-Library, OpusVL, thinkproject!, MongoDB, Infinity, Dreamhost, Campus Explorer, Perl 6, Perl Careers, Evozon, Booking, Eligo, Oetiker+Partner, CAPSiDE, Perl Services, Procura, Constructor.io, Robbie Bow, Ron Savage, Charlie Gonzalez, Justin Cook. Being in the same room as Andreas and Rik made it easy to resolve these tricky cases.