@cpan.org email deliverability issues

We've come across some snags with emails sent to @cpan.org addresses since switching our forwarding system. Delays and bounces are happening more often than usual.

While we understand this is inconvenient, addressing this issue will require significant technical adjustments. As a result, we are unable to offer a specific timeframe for a resolution at this time.

Bottom line: if an receiving an email is urgent or crucial, don't use @cpan.org. For important emails, opt for using another address with better deliverability.

CPAN: ftp.cpan.org depreciation

As a followup to the CPAN Mirror List changes from last year, we're announcing that FTP service on ftp.cpan.org and ftp.perl.org is being deprecated. This means that any CPAN clients configured to use them will fail to fetch modules.

For the past several years, CPAN clients have defaulted to www.cpan.org to fetch modules, so this should only affect users using very old CPAN clients (usually associated with old versions of Perl) who did not explicitly set a mirror.

We're not setting a firm timeline on this depreciation, but there are only a small number of compatible FTP mirrors remaining, and the number is shrinking over time.  At some point, there will no longer be any remaining FTP mirrors, and the service will be terminated.  Because these mirrors are run by independent volunteers, we don't have a good way of measuring actual traffic.

If you think you might be using a CPAN client configured to use ftp.cpan.org or ftp.perl.org, please check, and reconfigure to use the globally available www.cpan.org instead.

If you're using CPAN.pm, you can configure www.cpan.org as the mirror with these commands:

o conf urllist https://www.cpan.org/ 

o conf commit

(If your perl doesn't have Net::SSLEay installed to support TLS, you can just use http://www.cpan.org/) 

Weekend Outage

You may have noticed that some perl.org services were unavailable this weekend.  Email continued to flow, and no data was lost.

The short version of the story is that we were bitten by this bug. and learned a lot about how Kubernetes works while we figured out what the issue was.

Sorry for any inconvenience!

CPAN Mirror List Changes

We sent the below email to all the CPAN Mirror contacts yesterday:

An Important Update about the CPAN Mirror List

You're receiving this email because you're listed as a contact point for a CPAN mirror. Thank you! The mirror network has been a huge part of CPAN’s success. Soon, the way clients use CPAN mirrors is changing. You don't need to do anything, but after reading this email, you might want to.

Some background: For a long time, when the CPAN client (aka CPAN.pm) started up for the first time, it prompted users to configure it by picking a nearby mirror. The assumption was that it would be best to find a geographically nearby mirror. This necessitated the keeping of a central list of mirrors which the client could retrieve and offer as a menu. That's the CPAN Mirror List, maintained by the Perl NOC.

In 2011, the client changed behavior to configure itself automatically, meaning that most new users never saw this list. Furthermore, www.cpan.org was pointed at a global CDN, meaning that traffic could be routed efficiently without client configuration. The CDN also meant that users wouldn’t need to worry about out of date or down mirrors..

After ten years of CPAN defaulting to the CDN, we are going to stop maintaining the mirror list. It will still be present, but have only one entry: www.cpan.org. This means that anyone attempting to pick a mirror from the list will only find this one option. The mirror status site will be replaced with a static page. As has always been the case, the CPAN client can be configured manually to use any mirror, whether or not it's on the mirror list.

Users who have configured their CPAN clients to point at your mirror will continue to hit it. No new users are likely to find it -- but after all, they were already very unlikely to do so! That said, you do not need to shut down your mirror. If you use your mirror, you can keep mirroring. We’re not removing or changing the ability to mirror. If you know you have users of your mirror who would like to keep using it, please feel free to keep mirroring it.

On the other hand, if you would like to stop mirroring CPAN, feel free to do that, too. Clients have always had to deal with their mirror going away, and they will be fine if you choose to shut down your mirror.

We have not set a firm date for the emptying of the mirror list, but we expect it to happen no earlier than mid-February and no later than June 2021.

If you have any questions, please email us at <cpan at perl.org>.

Concerned this is fake? A copy of this email can be found at https://log.perl.org/2021/02/cpan-mirror-list-changes.html.

Finally: Thanks! The mirror network helped make CPAN practical for many years, and CPAN helped make Perl a success. You were part of this endeavor, and we appreciate it! 

-- The CPAN Mirror List Admins

 

perl.com hijacked

 The perl.com domain was hijacked this morning, and is currently pointing to a parking site.  Work is ongoing to attempt to recover it.

 We encourage you NOT to visit the domain, as there are some signals that it may be related to sites that have distributed malware in the past.

  Some users may have it selected as their CPAN mirror.  To update your mirror in CPAN.pm use o conf urllist http://www.cpan.org/

# perl -MCPAN -eshell
cpan shell -- CPAN exploration and modules installation (v2.20)
Enter 'h' for help.

cpan[1]> o conf urllist http://www.cpan.org/
Please use 'o conf commit' to make the config permanent!
cpan[2]> o conf commit
commit: wrote '/root/.cpan/CPAN/MyConfig.pm'

Update 2021-01-28:

Work is underway to attempt to recover the domain.  If you're looking for the content, you can visit perldotcom.perl.org.

Update 2021-01-30:

Network Solutions is working with Tom Christiansen, the rightful registrant, on the recovery of the Perl.com domain. There is no estimated timeline for its recovery but the process is underway. The Perl.com site is temporarily at perldotcom.perl.org. Anyone using a perl.com host for their CPAN mirror should use www.cpan.org instead. Please direct all inquiries to brian d foy (brian.d.foy@gmail.com).

Update 2021-02-01:

We have contacted Network Solutions and verified that cpan.org is in the right hands and secured.

Update 2021-02-02:

Verisign has restored the proper nameservers (*.bitnames.com) for perl.com. You should see addresses in 151.101/16. If you still see something different, please leave a comment in GitHub issue #313. Some providers or services may have sinkholed or blocked Perl.com; if you are still seeing that, please let us know.

Update 2021-02-05:

Network Solutions has recovered the domain and your whois output should reflect that. If you notice that your firewalls or other security layers still mark perl.com as compromised, please leave us a note at https://github.com/tpf/perldotcom/issues/313.

 

rt.cpan.org will sunset on March 1st, 2021

Update 2/21/2021:

Updated information about the future of rt.cpan.org can be found at https://news.perlfoundation.org/post/rt-cpan-org-future

Update 2020-12-13:

rt.cpan.org will be sunset on March 1st, 2021 due to low and declining use.

Back when we started this service, it filled a need by providing a place for CPAN authors to track bug reports and feature requests. In recent years github.com and other sites have added issue tracking to their git repo hosting and many CPAN authors have migrated to these sites.

If you are a CPAN author, there are several tools to help you migrate existing tickets:

• https://github.com/dagolden/zzz-rt-to-github
• https://github.com/houseabsolute/RTx-ToGitHub

See Dave Cross' Plan for CPAN Authors, which describes steps you may wish to take to transition to a new bug tracking system.  

We're still finalizing the details, but the plan is to provide a static historical archive. 

This post will be updated as we figure things out.

Original Post 2020-12-04: 

(Encompassed by 2020-12-13 update.)

cpan.org email supported by Pobox

Earlier this year we quietly switched the infrastructure that forwards ${author}@cpan.org email addresses from our home-grown solution to Pobox’s Bulk Forwarding system. Our system wasn’t keeping up with the spam-filtering needs of these widely published email addresses.

Pobox is now detecting over 93% of the incoming email to @cpan.org as spam and taking care of it. That’s tens of thousands of spam emails a day that aren’t forwarded on. (Almost 2.5 million emails a month!) Said another way -- less than 7% of emails sent to @cpan.org are valid!

Beyond improved spam filtering, there’s also better forwarding due to support for SRS (for SPF) and ARC-Seals for DMARC. (The email is less likely to be rejected by the recipient mail server.)

On behalf of all the CPAN authors, we’d like to thank Pobox.com (part of the Fastmail family) for providing us this amazing service.

Perl bugs now on GitHub

For over 17 years, the Perl NOC has hosted an RT instance for Perlbug, the system that tracks and manages Perl bugs and feature requests.  Two weekends ago, it transitioned to GitHub.    Background is available in this thread.

We'd especially like to thank Todd Rinaldo who led the migration and did most of the work.  His attention to detail cannot be understated.  17 years of data (some of which had been migrated to RT from the previous system) required a lot of tweaking and polishing to make it look nice.  His hard work shows in the result.

It's been fun and interesting to support this particular piece of Perl development for so long.  We're excited about the new possibilities that GitHub's platform enables for Perl's fourth decade.

Henk Penning

It is with great sadness that we must report that Henk "HPP" Penning passed away this summer.  For the last decade he was the sole maintainer of the CPAN mirrors list, patiently working with hundreds of mirror operators around the world. He also managed the system that monitored the status of those mirrors, ensuring that out of date mirrors were quickly detected and removed.  His “instant mirroring” client was used by many mirrors to ensure that their copy of CPAN was up to date within minutes of a new package being added.

Even through the end, he carefully, gracefully, and with lots of patience made sure others had access to the systems he was running. He quietly worked in the background, but every Perl developer benefited from his work, knowingly or not.

He was also member of the Apache Software Foundation (and also managed their mirror network).  They posted a very nice memorial page that's worth reading.

We remember Henk for his ever present kindness and helpfulness.  The Perl and broader open source communities are will miss him.

- Ask & Robert

New perldoc site

Our friends at OpusVL have built a beautiful new perldoc.perl.org site.

The site automatically gets updated with new versions, and all the old URLs should work.

To report bugs, make pull requests or feature suggestions, see the GitHub projects: perldoc.perl.org-engine and perldoc.perl.org-export.

(The site is still on the Fastly CDN, so it should load nice and fast anywhere).

Maintenance Week

We're making some changes to the perl NOC hosting infrastructure this week.  There may be some instability.  We'll do our best to minimize it.  When we're done, we'll post an update with what's changed....

Email Outage

Due to a server failure, perl.org and cpan.org email is not currently flowing.  We're working on repairing it, but it may take several hours.

Update: The instance has suffered significant file-system corruption.  We're attempting to restore from a backup.  This may result in the loss of a small amount of mail that had been received but not yet delivered.

Update: Mail is flowing again.  It may take a few hours for the backlog to clear.

Server maintenance

We're doing maintenance today to the servers and network setup; disruptions to the CPAN master mirror, PAUSE, rt.cpan.org, rt.perl.org and the perl.org mailing lists may happen through the next ~8 hours (and possibly after as we finish things up).

Many of the servers are getting new drives or SSDs and the network setup will get a small overhaul if all goes well.