This document discusses the permissions model for uploading modules to CPAN via PAUSE. It describes how permissions are assigned based on who first uploads ("f") or registers ("m") a module. Module owners can grant co-maintainer ("c") permissions. Permissions are stored in $CPAN/modules/06perms.txt and the PAUSE::Permissions module can query this data. There are some anomalies where modules have different "m" and "f" users or no assigned owners. The document encourages developers to keep permissions tidy.

1. PAUSE::Permissions
A lightning talk given at London Perl Workshop 2012
The permissions model that controls who
can upload what modules to CPAN, via
PAUSE
Neil Bowers Andreas König
NEILB ANDK

2. PAUSE::Permissions
A module for querying the data behind the
model
Neil Bowers Andreas König
NEILB ANDK

3. PAUSE and CPAN

4. $CPAN/modules/06perms.txt
• Who has what permissions for which modules

5. $CPAN/modules/06perms.txt
Time::Fake,ROSULEK,f
Time::Fields,PIP,f
Time::Format,PGOLLUCCI,f
Time::Format,ROODE,m
Time::Format_XS,ROODE,f
Time::Frame,PIP,f
Time::Fuzzy,JQUELIN,m
Time::GPS,ZEFRAM,f
Time::HiRes, JHI, c Time::HR,AGOLOMSH,f
Time::HiRes,DEWEG,c
Time::HiRes,JHI,c
module PAUSE id
Time::HiRes,ZEFRAM,m
Time::HiRes::Value,PEVANS,f
permission Time::Human,JHOBLITT,f
Time::Implementation,FOTANGO,f
Time::Implementation,STIG,c
Time::Interval,AHICOX,f

6. Upload a new module
• If you’re the first to upload a module to CPAN, you
get the 'f' permission (“first come”)
Module::Path,NEILB,f
• You’re considered the owner

7. Register module on module list
• If you register the module, you get an 'm' permission
Graph::Reader,NEILB,m
• Internally you also still have 'f'
• 'm' takes precedence over 'f'

8. You register modules, not dists
• I registered PAUSE::Permissions
• The dist also includes PAUSE::Permissions::Module
PAUSE::Permissions,NEILB,m
PAUSE::Permissions::Module,NEILB,f
• What should you do with other modules in dists?
• If they’re public-facing, consider registering them
• Otherwise 'f' is fine

9. Co-maintainers
• The owner of a module can grant co-maint perms
• Using the PAUSE web interface
• They get a 'c' permission.
PAUSE::Permissions,ANDK,c
PAUSE::Permissions,NEILB,m
PAUSE::Permissions::Module,ANDK,c
PAUSE::Permissions::Module,NEILB,f
• Co-maints can upload new versions of a module
• Co-maints cannot grant co-maint permissions

10. Permissions are on modules
• Years back I created some Locale:: modules
• I handed them to SBECK, he's expanded the dist
Locale::Codes,SBECK,f
Locale::Constants,NEILB,c Locale::Codes::Constants,SBECK,f
Locale::Country,NEILB,c Locale::Codes::Country,SBECK,f
… lots more modules …
Locale::Currency,NEILB,c Locale::Constants,SBECK,f
Locale::Country,SBECK,m
Locale::Language,NEILB,c Locale::CountryCodes,SBECK,f
Locale::Script,NEILB,c Locale::Currency,SBECK,m
Locale::CurrencyCodes,SBECK,f
Locale::Language,SBECK,m
Locale::LanguageCodes,SBECK,f
Locale::Script,SBECK,f
Locale::ScriptCodes,SBECK,f
• I have co-maint on the original modules
• but not on those he's subsequently added.

11. Someone else's module
• If you upload a module you don't have perms for
• The dist will make it to your author directory
• The offending module won't be indexed (but ok modules will be)
• search.cpan.org will shout at you

12. Deleting dists from CPAN
• You can only delete dists that you uploaded
• Regardless of whether you're the owner
• Permissions are associated with modules, not dists,
remember
• If you don't like a co-maint's release
• Revoke co-maint, then supersede with a new release
• But talk to them first!

13. Namespace squatting
• Upload a module, then delete the dist (via PAUSE)
• The module won't exist on CPAN
• But you'll have an 'f' permission
No::Such::Module,NEILB,f
• No-one else will be able to use that name
• Free it up using PAUSE ("Change Permissions")

14. Developer releases
• Developer releases don't trigger permissions
• If your first release of a module is a developer
release, you won't get any permissions.
• Someone else could gazump you
• "This may change" - ANDK

15. Transfer of ownership
• You can transfer ownership to another user
• They get your 'm' or 'f'
• You get 'c'
PAUSE::Permissions,ANDK,m
PAUSE::Permissions,NEILB,c
PAUSE::Permissions::Module,ANDK,f
PAUSE::Permissions::Module,NEILB,c

16. Taking over a module
"Usually, after all this hassle,
we are reasonably quick at assigning co-maintenance permissions,
but don't hold your breath"

17. Anomaly #1: different m and f
• Modules with different 'm' and 'f' users?
• This can't happen TM
Catalyst::Engine::Apache,AGRUNDMA,m
Catalyst::Engine::Apache,MSTROUT,f
• But when it does
• 'm' is the owner
• 'f' is treated as a co-maint
• There are some special conventions
• Eg P5P has 'f' on some modules
Tie::SubstrHash,LWALL,m
Tie::SubstrHash,P5P,f

18. Anomaly #2: modules with no owner
• There are 1000+ modules with co-maints only
DBIx::Class::Loader,AMS,c
DBIx::Class::Loader,DMAKI,c
DBIx::Class::Loader,KRAIH,c
DBIx::Class::Loader,MRAMBERG,c
DBIx::Class::Loader,SRI,c
DBIx::Class::Loader,TEMPIRE,c
• How does this come about?
• You can give up your permissions: "Change Permissions" on PAUSE
• Make your case to PAUSE admins for ownership
• PAUSE Admins: modules@perl.org

19. Anomaly #3: modules with no perms
• Some modules are on CPAN but not in 06perms.txt
• Upload a module, then give up your 'f' permission
• It's open season on the module name again

20. PAUSE::Permissions
use PAUSE::Permissions;
my $pp = PAUSE::Permissions->new;
my $mp = $pp->module_permissions('PAUSE::Permissions');
my $owner = $mp->owner; # NEILB
my @comaints = $mp->co_maintainers; # ANDK

21. Finally
• Largest number of co-maints any module has?
• Tidy up your permissions please