Re: CVE-2013-2145: perl Module::Signature code execution vulnerability

[Russ Allbery <rra () stanford edu>]

Vincent Danen <vdanen () redhat com> writes:

> I've suggested to upstream that if they want this to be used seriously
> for trust (and not just verifying that the distribution is untampered
> with, according to whomever was able to sign the SIGNATURE file), that
> they should disable the auto-retrieval of keys by default and/or CPAN
> should manage their own keyserver of trusted keys and cpansign should
> only pull from that keyserver.  The first is probably practical enough
> to do, the second I'm not so sure.

Speaking as a CPAN author, the second would be awesome.  For bonus points,
once one registers a key with CPAN, CPAN could then even check one's
uploads and disallow uploads that aren't signed with the proper key.

It would require work by the CPAN maintainers, but the general
infrastructure is in place to do things like this and one could bootstrap
from CPAN username/password.

-- 
Russ Allbery (rra () stanford edu)             <http://www.eyrie.org/~eagle/>