Topics this week include:

• perl-5.18.0-RC2 is now available
• Proposal: initial type annotation in SV
• What does PERL_HASH_SEED do?
• Designing an API
• Should we make hashes return keys in FIFO order?
• Release timing drift

perl-5.18.0-RC2 is now available

Fire up perlbrew: 5.18.0-RC2 is here. Time to test all your modules
against this release candidate! The perldelta also makes great
reading – all the stuff that’s new and different. Some highlights
include the hash ordering changes, experimental lexical subroutines,
Unicode 6.2 support, given aliasing global $_ and a metric
ton of bug fixes in the /(?{})/ and /(??{})/ regex constructions.

Release announcement

Read perldelta

Download the tarball

Proposal: initial type annotation in SV

Sébastien Aperghis-Tramoni wants to record the initial type of an SV to
help perl data serializers (Storable, Sereal, JSON::XS, etc) properly
encode Perl data structures.

Read the thread

What does PERL_HASH_SEED do?

Just in time for perl-5.18 Yves Orton committed patches to make the
environment variable PERL_HASH_SEED (and some new helpers) change
the behaviors of hash storage and traversal.

Read the thread

Designing an API

Responding to Nicholas Clark’s email pointing out that XS doesn’t have
a ‘real’ API, Yves Orton asks, should there be one?

Read the thread

Should we make hashes return keys in FIFO order?

Not quite done with hashing, Yves Orton asks if perl in 5.20 should
return keys in FIFO order (i.e., return keys in the order they were
inserted.) Some love it, some hate it; standard P5P reaction.

Read the thread

Release timing drift

David Golden points out that perl releases seem to be drifting
further back in the year than earlier yearly releases. He proposes
moving freezes forward a month so blockers can be resolved with
less urgency.

Read the thread

Topics this week include:

• Sequence (?#…) not recognized in regex
• How on earth did we manage to break pack() so badly?
• DAVEM TPF Grant April Report
• Problems with Carp::longmess() in 5.17.10 and before
• What does PERL_HASH_SEED do?

Sequence (?#…) not recognized in regex

Karl Williamson reports on a problem in Perl’s regex engine which he’s made a patch for. This thread
goes over the specifics and asks RJBS how the patch ought to be applied to blead for 5.18.

April thread

May thread

How on earth did we manage to break pack() so badly

Yves Orton writes, um, a strong critique of the behavior of pack() since 5.10. He feels it’s
annoying and wrong. Dave Mitchell thinks it might need some tweaks but is basically proper
behavior.

Read the thread

DAVEM TPF Grant April 2013 Report

Dave Mitchell gives his monthly summary of work done on perl as part of his TPF grant. These
are always interesting reads if you like to track the history of perl bug detection and squashing.

Read the thread

Problems with Carp::longmess() in 5.17.10 and before

Watch live code archealogy as P5P digs deep into some messy internals of Carp.

April thread

May thread

What does PERL_HASH_SEED do?

Steve Hay asks about the variance between the documented behavior of this environment
variable and the observed behavior in blead.

Read the thread

Topics from this month include:

• DAVEM TPF Grant Month 2013 report
• On eliminating external tools from the release process
• Blead on s390x
• archlib – (ed. RJBS asks, “Should we keep it or not?”)
• Status of z/OS/EBCDIC
• NWCLARK TPF grant March report
• status on 5.18.0 (as of April 24, 2013)

Topics from this month include:

• CVE-2013-1667: important rehashing flaw
• Some facts/observations on *early adopter* perl use
• Bleadperl v5.17.9-200-g0e0ab62 breaks MLEHMANN/JSON-XS-2.33.tar.gz
• the freeze: it’s getting cold in herre
• NWCLARK TPF grant February report
• more efficient precomputed hash keys
• Perlfunc for each(), keys(), values() has been changed

Topics from this month include:

• Will 5.18 also be smartmatch-challenged?
• Perl 7 or Perl 2013?
• EBCDIC support is on the chopping block
• perlopentut
  • perlopentut modernization
  • Don’t patch perlopentut: rewrite it completely
• blockers on 5.18
  • blockers of 5.18.0: a foreword
  • blocker: $ENV{foo} = undef
  • blocker: disable new COW by default
  • blocker: “in cleanup” warnings from destructor
  • blocker: something about Data-Util
• Salvaging lexical $_ from deprecation
• deprecate @*, %*, &*, ** too

Well, that was a nice little break. I didn’t intend for it to be so long
but there you go. Life gets real sometimes. To catch up I’m basically
going month by month through most of April. I plan to resume monthly
summaries starting the week of April 29, 2013.

Topics for this month:

• COW: big slowdown in simple pattern matches
• Who is the perl5 security team?
• module deprecations for 5.18
• NWCLARK TPF grant December report
• Perl5 blead now contains experimental (?[]) regex sets feature
• Why does Perl have its own regexp engine in 2012?
• perlopentut modernization
• use of LIKELY() and UNLIKELY() branch predictors

These are all of the “read the thread” link variety.

Topics for this week include:

• cPanel version of “Storable 2.39_01″ breaks backwards compatibility
• Please separate fixes to spelling from changes to code layout in patches
• Term::ANSIColor 4.01 released

cPanel version of “Storable 2.39_01″ breaks backwards compatibility

Alex Vandiver posted a message that cPanel has shipped a version of Storable
identified as 2.39_01 which appears to break the vendor-installed perl
environment on cPanel installations.

This has the effect of making other co-located Perl applications (RT for
example) break. A back-and-forth about this issue revealed that cPanel is
preparing a fix for this problem to be released in January 2013 – it looks
like they are moving to Sereal or Data::Messagepack.

Read the thread

Separate fixes to spelling from changes to code layout in patches

Earlier in this week, a patch was committed with included some whitespace
changes. In a followup, Ricardo Signes, the perl project manager asked
people submitting patches to

please separate fixes to spelling and grammar errors from changes to
code layout.

Read the thread

Term::ANSIColor 4.01 released

Russ Allbery announced that there’s a new release of Term::ANSIColor
which has been in Perl core since 5.6. This release includes improved docs
and fixes some test cases.

Read the announcement

Topics this week include:

• perl 5.17.7 is now available
• Solaris smoke testers wanted
• Parrot 4.11.0 “All together – Happy Birthday Lovebird” Released!
• successful s///e clobbers $! on MSWin32
• JROBINSON grant report, #13
• POSIX wrapper for strptime()
• Is this a known unicode bug in 5.16.2?

perl 5.17.7 is now available

Dave Rolsky announced that perl-5.17.7 is now available from a CPAN mirror near you.

Read the announcement

Read perldelta

Download the tarball

Solaris smoke testers wanted

Dave Rolsky also encouraged people who use Perl on Solaris to join the CPAN
testing/smoking group.

Read the message

Find out how to set up a smoker box

Parrot 4.11.0 “All together – Happy Birthday Lovebird” Released!

Reini Urban announced that Parrot 4.11.0 is now available for download.

Read the announcement

successful s///e clobbers $! on MSWin32

Which makes bugs on Win32 harder to track down when using Carp because
Carp::format_args() does such a substitution.

Read the thread

JROBINSON grant report, #13

Checking in on Jess Robinson’s Perl to Android cross compiling effort, it
looks like there’s an interesting side project which allows a Java process
to schlep fatpacked perl modules to an Android platform.

Full details are in the grant report. A demo is available on a blog
post.

Read the grant report

POSIX wrapper for strptime()

LeoNerd proposed making POSIX/strptime unbroken cross-platform, but there
was quite a bit of pushback on the idea. The primary objection was that
the purpose of the POSIX module is to expose OS-specific functionality, and
the second objection was that a cross-platform strptime already exists in
Time::Piece.

Read the thread

Is this a known unicode bug in 5.16.2?

Anders Melchiorsen reported a strange bug in Perl’s regex engine when it
somehow thinks it’s processing UTF-8 (even though it isn’t.) A series of
messages tracing the bug and trying to understand its origin followed. In a
followup Dave Mitchell supplied a fix for the problem.

Read the thread

Read the followup

Topics this week include:

• RFC: Adding a prototype attribute
• Undocumented %ENV behaviour
• rand() on Windows only uses 15 bits of entropy

RFC: Adding a prototype attribute

Peter Martini proposed adding a ‘prototype’ attribute into the Perl core, so
that other modules can use the syntactical space more cleanly. If you’re
interested in the specific implementation notes, please read the thread.

Read the thread

Undocumented %ENV behaviour

Kent Fredric reported a surprising property of %ENV in blead. Apparently, a
value stored in an environment variable is stringified. Kent later submitted
some patches to create a warning class when a ref is inserted into %ENV
(that would be stringified.)

Read the thread

Patch thread

rand() on Windows only uses 15 bits of entropy

You may recall a thread from a few weeks ago pointed out that the rand()
call on Win32 was woefully not random. In response, Yves Orton recently
created some patches to add the TinyMT32 random number generator. All of
this work is still very experimental, but there is going to be a round of
“does this break CPAN?”, so it will be interesting to see the outcome of
those tests.

Read the commit email

Topics this week include:

• security notice: Storable
• security notice: Locale::Maketext
• Does Unicode mandate a collation order?
• a job for someone? SvREFCNT_dec_NN()
• CERT Perl Secure Coding Standard

security notice: Storable

Ricardo Signes published a security notice about the Storable module that
ships in Perl’s core. He writes:

A number of times over the years, there's been discussion about Storable
as a vector for attack.  If a user can feed you Storable data that you
didn't expect, he has a good chance of doing nasty things to your
program.  This has been discussed on p5p and at YAPCs, but sadly never
made it into the documentation.

This has been fixed[.]

Thanks to Brian Carlson of cPanel who brought it to the P5P security team’s
attention.

Read the thread

security notice: Locale::Maketext

Rik also issued another notice courtesy of Brian Carlson about the
Locale::Maketext module which also ships in Perl’s core. Ricardo
summarizes the problems as:

* in a [method,x,y,z] template, the method could be a fully-qualified
  name
* template expansion did not properly quote metacharacters, allowing
  code injection through a malicious template

Read the thread

Does Unicode mandate a collation order?

There was a question (not strictly Perl related) about whether Unicode
mandates a collation order. It does, and the precise answer, according to
Tom Christensen is determined by what DUCET value is used internally by
the Unicode routines.

If you want the full explanation, read Tom’s reply

Read the thread

a job for someone? SvREFCNT_dec_NN()

Dave Mitchell writes that he’s just added the SvREFCOUNT_dec_NN() macro
which can be used in situations where the SV cannot be null. In such cases,
the macro saves some code space, a test and a jump in the code path. There
are 500 uses of the original SvREFCOUNT_dec in perl.

If you ever wanted to dive into Perl’s core and were looking for a fairly
easy task to get you going, this might be what you’re looking for.

Read the thread

CERT Perl Secure Coding Standard

Yves Orton wonders if anyone’s seen CERT’s Perl Secure Coding Standard.
Jeffrey Thalhammer writes back that he’s hopeful a Perl::Critic module will
ship early next year incorporating the standard’s guidelines.

Read the thread