perlcpan

cpan not using configured repo instead trying to connect to cpan.org when installing perl modules

I have installed perl and cpan in an automated shell script. configure only one local repo from the script itself as below:

echo o conf urllist https://localrepo.mylab.mycompany.com/cpan
echo o conf commit

and it configured and wrote to config file:

commit: wrote '/root/.cpan/CPAN/MyConfig.pm'

When I displayed the urllist after this, it shown properly as :

urllist           
[https://localrepo.mylab.mycompany.com/cpan]
Type 'o conf' to view all configuration items

But when I try to install a perl module, it is trying to connect to cpan.org instead of localrepo

cpan -f -i inc::latest
20:16:59  Loading internal logger. Log::Log4perl recommended for better logging
20:16:59  
20:16:59  Trying with
20:16:59      /usr/bin/wget -O "/root/.cpan/sources/authors/01mailrc.txt.gz.tmp18229"
20:16:59  to get
20:16:59      https://cpan.org/authors/01mailrc.txt.gz
20:16:59  --2023-02-21 15:46:59--  https://cpan.org/authors/01mailrc.txt.gz
20:16:59  Resolving cpan.org (cpan.org)... 151.101.193.55, 151.101.129.55, 151.101.65.55, ...
20:19:21  Connecting to cpan.org (cpan.org)|151.101.193.55|:443... failed: Connection timed out.
20:21:27  Connecting to cpan.org (cpan.org)|151.101.129.55|:443... failed: Connection timed out.

I want to know why its connecting to cpan.org and how to make it to connect to localrepo.

Tried to delete all other repositories in the url list and added only one repo. Still not connecting to configured repo., if urllist is displayed it shows only one configured repo. and it never shows cpan.org repo.

Solution

  • Short answer: o conf pushy_https 0

    If the pushy_https setting is true (or undef), the CPAN client ignores the urllist setting and goes straight to CPAN, willy-nilly. This was added a couple years ago in response to a repository spoofing attack. The attack may not have involved Perl directly (my memory is unclear on this), but p5p decided to respond to it anyway. Making this the default means that the default behavior is safe, but it makes things a little more complex for those of us who keep their own mirrors, and the need to do this is not obvious.