RubyGems - javonet-ruby-sdk - Versions diffs - 2.1.1 → 2.1.2 - Mend

javonet-ruby-sdk 2.1.1 → 2.1.2

Files changed (888) hide show

data/lib/javonet-ruby-sdk/Binaries/Perl/Linux/X64/deps/lib/perl5/Alien/Build/Manual/Security.pod DELETED Viewed

@@ -1,293 +0,0 @@
-# PODNAME: Alien::Build::Manual::Security
-# ABSTRACT: General alien author documentation
-# VERSION
-__END__
-=pod
-=encoding UTF-8
-=head1 NAME
-Alien::Build::Manual::Security - General alien author documentation
-=head1 VERSION
-version 2.78
-=head1 SYNOPSIS
- perldoc Alien::Build::Manual::Security
-=head1 DESCRIPTION
-You are rightly concerned that an L<Alien> might be downloading something random
-off the internet.  This manual will describe some of the real risks and go over
-how you can mitigate them.
-=head2 no warranty
-L<Alien::Build> provides L<Alien> authors with tools to add external non-Perl
-dependencies to CPAN modules.  It is open source software that is entirely
-volunteer driven, meaning the people writing this software are not getting
-compensated monetarily for the work.  As such, we do our best not to
-intentionally introduce security vulnerabilities into our modules, or their
-dependencies.  But it is also not our responsibility either.  If you are
-operating in an environment where you need absolute security, you need to
-carefully audit I<all> of the software that you use.
-=head2 L<Alien::Build> vs. L<CPAN>
-I suppose you could argue that L<Alien::Build> based L<Alien>s and L<Alien>s
-in general are inherently less secure than the the Perl modules on L<CPAN>
-that don't download random stuff off the internet.  Worse yet, L<Alien>s
-might be downloading from insecure sources like C<http> or C<ftp>.
-This argument falls apart pretty quickly when you realize that
-=over 4
-=item 1
-Perl modules from L<CPAN> are in fact random stuff off the internet.
-Most modules, when installed execute a C<Makefile.PL> which can execute
-completely arbitrary Perl code.  Without a proper audit or firewalls
-that L<CPAN> code could be making connections to insecure sources
-like C<http> if they are not themselves doing something nefarious.
-=item 2
-By default, the most frequently used L<CPAN> client L<App::cpanminus|cpanm>
-uses C<http> to fetch L<CPAN> modules.  So unless you have specifically
-configured it to connect to a secure source you are downloading
-even more random stuff than usual off the internet.
-=back
-The TL;DR is that if you are using a Perl module, whether it be
-C<Foo::PP>, C<Foo::XS> or C<Alien::libfoo> and you are concerned about
-security you need to audit all of your Perl modules, not just the L<Alien>
-ones.
-=head2 Restricting L<Alien::Build> by environment
-Okay, granted you need to audit software for security regardless of
-if it is L<Alien>, you still don't like the idea of downloading external
-dependencies and you can't firewall just the L<CPAN> module installs.
-L<Alien::Build> based L<Alien>s respect a number of environment variables
-that at least give you some control over how aggresive L<Alien::Build>
-will be at fetching random stuff off the internet.
-=over 4
-=item C<ALIEN_DOWNLOAD_RULE>
-This environment variable configures how L<Alien::Build> will deal
-with insecure protocols and files that do not include a cryptographic
-signature.
-Part of the design of the L<Alien::Build> system is that it typically
-tries to download the latest version of a package instead of a fixed
-version, so that the L<Alien> doesn't need to be updated when a new
-alienized package is released.  This means that we frequently have
-to rely on TLS or bundled alienized packages to ensure that the
-alienized package is fetched securely.
-Recently (as of L<Alien::Build> 2.59) we started supporting cryptographic
-signatures defined in L<alienfile>s, but they are not yet very common,
-and they only really work when a single alienized package URL is hard
-coded into the L<alienfile> instead of the more typical mode of operation
-where the latest version is downloaded.
-=over 4
-=item warn
-This mode will warn you if an L<Alien::Build> based L<Alien> attempts
-to fetch a alienized package insecurely.  It will also warn you if
-a package doesn't have a cryptographic signature.  Neither of these
-things wild stop the L<Alien> from being installed.
-This is unfortunately currently the default mode of L<Alien::Build>,
-for historical reasons.  Once plugins and L<Alien>s are updated to
-either use secure fetch (TLS or bundled alienized packages), or
-cryptographic signatures, the default will be changed to
-C<digest_or_encrypt>.
-=item digest_or_encrypt
-This mode will require that before an alienized package is extracted
-that it is either fetched via a secure protocol (C<http> or C<file>),
-or the package matches a cryptographic signature.
-This will likely be the default for L<Alien::Build> in the near future,
-but it doesn't hurt to set it now, if you don't mind submitting
-tickets to L<Alien>s or L<plugins|Alien::Build::Plugin> that don't
-support this mode yet.
-=back
-=item C<ALIEN_INSTALL_NETWORK>
-By design L<Alien>s should use local installs of libraries and tools
-before downloading source from the internet.  Setting this environment
-variable to false, will instruct L<Alien::Build> to not attempt to
-fetch the alienized package off the internet if it is not available
-locally or as a bundled package.
-This is similar to setting C<ALIEN_INSTALL_TYPE> to C<system> (see
-below), except it does allow L<Alien>s that bundle their alienized
-package inside the L<CPAN> package tarball.
-Some L<Alien>s will not install properly at first, but when they error
-you can install the system package and try to re-install the L<Alien>.
-=item C<ALIEN_INSTALL_TYPE>
-Setting C<ALIEN_INSTALL_TYPE> to C<system> is similar to setting
-C<ALIEN_INSTALL_NETWORK> to false, except that bundled alienized
-packages will also be rejected.  This environment variable is really
-intended for use by operating system vendors packaging L<Alien>s,
-or for L<Alien> developer testing (in CI for example).  For some
-who want to restrict how L<Alien>s install this might be the right
-tool to reach for.
-=back
-Note that this is definitely best effort.  If the L<Alien> author makes
-a mistake or is malicious they could override these environment variables
-inside the C<Makefile.PL>, so you still need to audit any software to
-ensure that it doesn't fetch source off the internet.
-=head2 Security Related Plugins
-There are a number of plugins that give the user or installer control
-over how L<Alien::Build> behaves, and may be useful for rudimentary
-security.
-=over 4
-=item L<Alien::Build::Plugin::Fetch::Prompt>
-This plugin will prompt before fetching any remote files.  This only
-really works when you are installing L<Alien>s interactively.
-=item L<Alien::Build::Plugin::Fetch::HostAllowList>
-This plugin will only allow fetching from hosts that are in an allow list.
-=item L<Alien::Build::Plugin::Fetch::HostBlockList>
-This plugin will not allow fetching from hosts that are in a block list.
-=item L<Alien::Build::Plugin::Fetch::Rewrite>
-This plugin can re-write fetched URLs before the request is made.  This
-can be useful if you have a local mirror of certain sources that you
-want to use instead of fetching from the wider internet.
-=item L<Alien::Build::Plugin::Probe::Override>
-This plugin can override the C<ALIEN_INSTALL_TYPE> on a perl-Alien basis.
-This can be useful if you want to install some L<Alien>s in C<share>
-mode, but generally want to enforce C<system> mode.
-=back
-=head2 local configuration
-You can configure the way L<Alien::Build> based L<Alien>s are installed with the
-local configuration file C<~/.alienbuild/rc.pl>.  See L<Alien::Build::rc> for
-details.
-=head1 CAVEATS
-This whole document is caveats, but if you haven't gotten it by now then,
-fundamentally if you need to use Perl modules securely then you need to
-audit the code for security vulnerabilities.  If you think that the security
-of L<Alien::Build> and the L<Alien>s that depend on it, then I<patches welcome>.
-=head1 SEE ALSO
-=over 4
-=item L<Alien::Build::Manual>
-Other L<Alien::Build> manuals.
-=back
-=head1 AUTHOR
-Author: Graham Ollis E<lt>plicease@cpan.orgE<gt>
-Contributors:
-Diab Jerius (DJERIUS)
-Roy Storey (KIWIROY)
-Ilya Pavlov
-David Mertens (run4flat)
-Mark Nunberg (mordy, mnunberg)
-Christian Walde (Mithaldu)
-Brian Wightman (MidLifeXis)
-Zaki Mughal (zmughal)
-mohawk (mohawk2, ETJ)
-Vikas N Kumar (vikasnkumar)
-Flavio Poletti (polettix)
-Salvador Fandiño (salva)
-Gianni Ceccarelli (dakkar)
-Pavel Shaydo (zwon, trinitum)
-Kang-min Liu (劉康民, gugod)
-Nicholas Shipp (nshp)
-Juan Julián Merelo Guervós (JJ)
-Joel Berger (JBERGER)
-Petr Písař (ppisar)
-Lance Wicks (LANCEW)
-Ahmad Fatoum (a3f, ATHREEF)
-José Joaquín Atria (JJATRIA)
-Duke Leto (LETO)
-Shoichi Kaji (SKAJI)
-Shawn Laffan (SLAFFAN)
-Paul Evans (leonerd, PEVANS)
-Håkon Hægland (hakonhagland, HAKONH)
-nick nauwelaerts (INPHOBIA)
-Florian Weimer
-=head1 COPYRIGHT AND LICENSE
-This software is copyright (c) 2011-2022 by Graham Ollis.
-This is free software; you can redistribute it and/or modify it under
-the same terms as the Perl 5 programming language system itself.
-=cut

data/lib/javonet-ruby-sdk/Binaries/Perl/Linux/X64/deps/lib/perl5/Alien/Build/Manual.pod DELETED Viewed

@@ -1,148 +0,0 @@
-# PODNAME: Alien::Build::Manual
-# ABSTRACT: The Alien::Build Manual
-# VERSION
-__END__
-=pod
-=encoding UTF-8
-=head1 NAME
-Alien::Build::Manual - The Alien::Build Manual
-=head1 VERSION
-version 2.78
-=head1 SYNOPSIS
- perldoc Alien::Build::Manual::Alien
- perldoc Alien::Build::Manual::AlienAuthor
- perldoc Alien::Build::Manual::AlienUser
- perldoc Alien::Build::Manual::Contributing
- perldoc Alien::Build::Manual::FAQ
- perldoc Alien::Build::Manual::PluginAuthor
-=head1 DESCRIPTION
-L<Alien::Build> comes with a number of manuals that are useful depending on how you
-are using L<Alien>.
-=over 4
-=item L<Alien::Build::Manual::Alien>
-General alien author documentation.
-=item L<Alien::Build::Manual::AlienAuthor>
-Alien author documentation.
-=item L<Alien::Build::Manual::AlienUser>
-Alien user documentation.
-=item L<Alien::Build::Manual::Contributing>
-Overly-detailed contributing guide.
-=item L<Alien::Build::Manual::FAQ>
-Frequently Asked Questions about L<Alien::Build>.
-=item L<Alien::Build::Manual::PluginAuthor>
-L<Alien::Build> plugin author documentation — or how to extend L<Alien::Build> with the plugin system.
-=item L<Alien::Build::Manual::Security>
-Documents some of the challenges and configuration tools related to security of L<Alien>s.
-=back
-=head1 SEE ALSO
-=over 4
-=item L<Alien::Base>
-=item L<Alien::Build>
-=item L<alienfile>
-=back
-=head1 AUTHOR
-Author: Graham Ollis E<lt>plicease@cpan.orgE<gt>
-Contributors:
-Diab Jerius (DJERIUS)
-Roy Storey (KIWIROY)
-Ilya Pavlov
-David Mertens (run4flat)
-Mark Nunberg (mordy, mnunberg)
-Christian Walde (Mithaldu)
-Brian Wightman (MidLifeXis)
-Zaki Mughal (zmughal)
-mohawk (mohawk2, ETJ)
-Vikas N Kumar (vikasnkumar)
-Flavio Poletti (polettix)
-Salvador Fandiño (salva)
-Gianni Ceccarelli (dakkar)
-Pavel Shaydo (zwon, trinitum)
-Kang-min Liu (劉康民, gugod)
-Nicholas Shipp (nshp)
-Juan Julián Merelo Guervós (JJ)
-Joel Berger (JBERGER)
-Petr Písař (ppisar)
-Lance Wicks (LANCEW)
-Ahmad Fatoum (a3f, ATHREEF)
-José Joaquín Atria (JJATRIA)
-Duke Leto (LETO)
-Shoichi Kaji (SKAJI)
-Shawn Laffan (SLAFFAN)
-Paul Evans (leonerd, PEVANS)
-Håkon Hægland (hakonhagland, HAKONH)
-nick nauwelaerts (INPHOBIA)
-Florian Weimer
-=head1 COPYRIGHT AND LICENSE
-This software is copyright (c) 2011-2022 by Graham Ollis.
-This is free software; you can redistribute it and/or modify it under
-the same terms as the Perl 5 programming language system itself.
-=cut