This file is indexed.

/usr/share/perl5/Test/Signature.pm is in libtest-signature-perl 1.11-1.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
package Test::Signature;

use 5.005;
use strict;
use vars qw( $VERSION @ISA @EXPORT @EXPORT_OK );
use Exporter;
use Test::Builder;

BEGIN {
    $VERSION   = '1.11';
    @ISA       = qw( Exporter );
    @EXPORT    = qw( signature_ok );
    @EXPORT_OK = qw( signature_force_ok );
}

my $test = Test::Builder->new();

=head1 NAME

Test::Signature - Automated SIGNATURE testing

=head1 SYNOPSIS

    # This is actually the t/0-signature.t file from this distribution.
    use Test::More tests => 1;
    use Test::Signature;

    signature_ok();

=head1 ABSTRACT

C<Test::Signature> verifies that the C<Module::Signature> generated
signature of a module is correct.

=head1 DESCRIPTION

C<Module::Signature> allows you to verify that a distribution has
not been tampered with. C<Test::Signature> lets that be tested
as part of the distribution's test suite.

By default, if C<Module::Signature> is not installed then it will just
say so and not fail the test. That can be overridden though.

B<IMPORTANT>: This is not a substitute for the users verifying
the distribution themselves. By the time this module is run, the
users will have already run your F<Makefile.PL> or F<Build.PL> scripts
which could have been compromised.

This module is more for ensuring you've updated your signature
appropriately before distributing, and for preventing accidental
errors during transmission or packaging.

=cut

=head1 FUNCTIONS

C<signature_ok> is exported by default. C<signature_force_ok> must be
explicitly exported.

=head2 signature_ok()

This will test that the C<Module::Signature> generated signature
is valid for the distribution. It can be given two optional parameters.
The first is a name for the test. The default is C<Valid signature>.
The second is whether a lack of C<Module::Signature> should be regarded
as a failure. The default is C<0> meaning 'no'.

    # Test with defaults
    signature_ok()
    # Test with custom name
    signature_ok( "Is the signature valid?" );
    # Test with custom name and force C<Module::Signature> to exist
    signature_ok( "Is the signature valid?", 1 );
    # Test without custom name, but forcing
    signature_ok( undef, 1 );

=cut

sub action_skip { $test->skip( $_[0] ) }
sub action_ok { $test->ok( 0, $_[0] ) }

sub signature_ok {
    my $name  = shift || 'Valid signature';
    my $force = shift || 0;
    my $action = $force ? \&action_ok : \&action_skip;
  SKIP: {
        if ( !-s 'SIGNATURE' ) {
            $action->("No SIGNATURE file found.");
        }
        elsif ( !eval { require Module::Signature; 1 } ) {
            $action->(
                    "Next time around, consider installing Module::Signature, "
                  . "so you can verify the integrity of this distribution." );
        }
        elsif ( !eval { require Socket; Socket::inet_aton('pgp.mit.edu') } ) {
            $action->("Cannot connect to the keyserver.");
        }
        else {
            $test->ok( Module::Signature::verify(skip => 1) ==
                  Module::Signature::SIGNATURE_OK() => $name );
        }
    }
}

=head2 signature_force_ok()

This is equivalent to calling C<< signature_ok( $name, 1 ) >>
but is more readable.

    # These are equivalent:
    signature_force_ok( "Is our signature valid?" );
    signature_ok( "Is our signature valid?", 1);

    # These are equivalent:
    signature_force_ok();
    signature_ok( undef, 1 );

=cut

sub signature_force_ok {
    signature_ok( $_[0] || undef, 1 );
}

1;
__END__

=head1 NOTES ON USE

=head2 F<MANIFEST> and F<MANIFEST.SKIP>

It is B<imperative> that your F<MANIFEST> and F<MANIFEST.SKIP> files be
accurate and complete. If you are using C<ExtUtils::MakeMaker> and you
do not have a F<MANIFEST.SKIP> file, then don't worry about the rest of
this. If you do have a F<MANIFEST.SKIP> file, or you use
C<Module::Build>, you must read this.

Since the test is run at C<make test> time, the distribution has been
made. Thus your F<MANIFEST.SKIP> file should have the entries listed
below.

If you're using C<ExtUtils::MakeMaker>, you should have, at least:

    #defaults
    ^Makefile$
    ^blib/
    ^blibdirs$
    ^pm_to_blib$

These entries are part of the default set provided by
C<ExtUtils::Manifest>, which is ignored if you provide your own
F<MANIFEST.SKIP> file.

If you are using C<Module::Build>, there is no default F<MANIFEST.SKIP>
so you B<must> provide your own. It must, minimally, contain:

    ^Build$
    ^Makefile$
    ^_build/
    ^blib/

If you don't have the correct entries, C<Module::Signature> will
complain that you have:

    ==> MISMATCHED content between MANIFEST and distribution files! <==

You should note this during normal development testing anyway.

=head2 Use with Test::Prereq

C<Test::Prereq> tends to get a bit particular about modules.
If you're using the I<force> option with C<Test::Signature> then
you will have to specify that you expect C<Module::Signature> as a
prerequisite. C<Test::Signature> will not have it as a prerequisite
since that would defeat the point of having the I<force> variant.

If you are using C<ExtUtils::MakeMaker> you should have a line like the
following in your F<Makefile.PL>:

    'PREREQ_PM' => {
	'Test::Signature'   => '1.04',
	'Module::Signature' => '0.22',
	'Test::More'        => '0.47',
    },

If using C<Module::Build>, your F<Build.PL> should have:

    build_requires => {
	'Test::Signature'   => '1.04',
	'Module::Signature' => '0.22',
	'Test::More'        => '0.47',
    },

If you just want the default behaviour of testing the signature if and
only if the user already has C<Module::Signature> installed, then you
will need something like the following code. The example uses
C<Module::Build> format but it should be trivial for you to translate to
C<ExtUtils::MakeMaker>.

    #!/usr/bin/perl -w
    use strict;
    use Module::Build 0.18;

    my @extra_build;

    eval { require Module::Signature };
    if (!$@ or $Test::Prereq::VERSION)
    {
	push @extra_build, "Module::Signature" => '0.22'
    }

    my $m = Module::Build->new(
	dist_name => 'WWW-Yahoo-Groups',
	dist_version => '1.7.7',
	license => 'perl',

	requires => {
	    # various modules
	    'perl'             => '5.6.0',
	},
	build_requires => {
	    'Test::More'          => 0.47,
	    'Test::Prereq'        => 0.19,
	    'Test::Prereq::Build' => 0.04,
	    'Test::Signature'     => 1.04,
	    @extra_build,
	},
    );

    $m->create_build_script;

If you have any questions on using this module with C<Test::Prereq>,
just email me (address below).

=head2 Use with Module::Install

C<Module::Install> is a module to assist in the bundling of build
prerequisite modules in packages. Well, among other things.

C<Test::Signature> is a perfect candidate for such a module. As it's a
module aimed purely at those writing modules rather than those using
them.

Here's a good way to use it:

Make a test file (say, F<t/00sig.t>) that contains the following:

    use lib 'inc';
    use Test::More tests => 1;
    use Test::Signature;
    signature_ok();

In your F<Makefile.PL> (or F<Build.PL> if appropriate) add:

    include 'Test::Signature';

And that's it! You don't have to specify it as a prerequisite or
anything like that because C<Module::Install> will include it in your
distribution. And you don't have to worry about size because
C<Module::Install> strips out all this waffling POD.

=head1 THANKS

Arthur Bergman for suggesting the module.

Audrey Tang for writing L<Module::Signature>, and making some suggestions.

Tels suggested testing network connectivity to Audrey; Audrey added that
to C<Module::Signature> 0.16 and I (Iain Truskett) added it to this module
(as of 1.03).

=head1 BUGS

Please report bugs at E<lt>bug-test-signature@rt.cpan.orgE<gt>
or via the web interface at L<http://rt.cpan.org>

=head1 AUTHORS

Audrey Tang E<lt>cpan@audreyt.orgE<gt>
Original author: Iain Truskett E<lt>spoon@cpan.orgE<gt>, now passed away.

=head1 LICENSE AND COPYRIGHT

Copyright 2002, 2003 by Iain Truskett.
Copyright 2003, 2007, 2015 by Audrey Tang E<lt>cpan@audreyt.orgE<gt>.

This library is free software; you can redistribute it and/or modify
it under the same terms as Perl itself.

=head1 SEE ALSO

L<perl>, L<Module::Signature>, L<Test::More>.

L<Module::Build>, L<ExtUtils::Manifest>, L<ExtUtils::MakeMaker>.

L<Test::Prereq>, L<Module::Install>.

=cut