Repository navigation
Conversation
Deploying oss-docs with
|
| Latest commit: |
3db5d88
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://3394ecca.oss-docs.pages.dev |
| Branch Preview URL: | https://add-perl-capabilities.oss-docs.pages.dev |
wagoodman
force-pushed
the
add-perl-capabilities
branch
from
August 4, 2026 15:02
cad236e to
4927b14
Compare
wagoodman
force-pushed
the
add-perl-capabilities
branch
2 times, most recently
from
October 2, 2026 20:56
3120f69 to
4c73912
Compare
Covers both cpan catalogers, with the generated package and vulnerability snippets alongside the other ecosystems. The page spends most of its length on two things that are easy to get wrong: - **what is and is not cataloged.** CPAN client installs are picked up wherever they live, including local-lib and carton trees, but an installer only writes `install.json` when the distribution was resolved from a mirror, so local directory and tarball installs and everything `CPAN.pm` installs are found through `.packlist` instead. Modules from distro packages stay with deb, rpm and apk. Core and dual-life distributions bundled with the interpreter have no coverage at all, since nothing on disk carries their versions. Vendored, fatpacked and PAR-archived perl is invisible, because what it carries is module identity with no offline map to the distribution that shipped it. - **why a clean report is not the same as a safe one.** CPANSA covers 409 distributions out of roughly 42,000 on CPAN, and four Lemonldap-NG distributions are about a third of its 2,035 advisories. Most perl images produce no findings simply because nothing they installed is covered. Also notes that packages are keyed on distributions rather than modules (`libwww-perl`, not `LWP`), that a packlist-derived name is the installer's `NAME` and may not be the distribution name, that versions compare under `version.pm` rather than semver, and that the perl interpreter's purl changes from `pkg:generic/perl` to `pkg:cpan/perl`. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
wagoodman
force-pushed
the
add-perl-capabilities
branch
from
October 2, 2026 21:17
4c73912 to
3db5d88
Compare
wagoodman
marked this pull request as ready for review
October 2, 2026 21:19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Covers both cpan catalogers, with the generated package and vulnerability snippets alongside the other ecosystems.
The page spends most of its length on two things that are easy to get wrong:
Also notes that packages are keyed on distributions rather than modules (
libwww-perl, notLWP), that versions compare underversion.pmrather than semver, and that the perl interpreter's purl changes frompkg:generic/perltopkg:cpan/perl.The generated
syft-package-catalogers.jsonentries were derived by hand from the cataloger definitions, since the syft release carrying them is not out yet. Worth regenerating once it ships to confirm they come back identical.Warning
Waiting for the upstream PRs to land in syft/grype/vunnel before merging this...