Should CPAN::Audit::DB be a separate distro?

[briandfoy]

I'd like the users of cpan-audit to weigh in on whether they'd like CPAN::Audit::DB to be a different distro that they can update independently.

My intent is to release a new version of CPAN::Audit::DB every day that there is an update. I want this to be extremely fresh. Robert Rothenberg has been adding lots of good reports—almost every day. It's good stuff.

There are two parts of cpan-audit: the thing that uses the data to make a report based on your installation, and the data itself. Since CPAN::Audit is the main module, that means that I have to bump its version every time I update the data even if nothing else changes. With the small list of dependencies, this means you might disturb your setup as downstream things update.

[schelcj]

Being able to load a new dataset at runtime with cpan-audit would be nice feature as well.

[robrwo]

The docs for CPAN::Audit should explicitly state that the DB needs to be updated regularly. It should also issue a warning if the DB is too old.

I might also suggest that the DB module eventually be changed to an external DB (SQLite, recutils) that is included via something like File::Share. I think trying to include all of the data in a single module as a data structure is too unwieldy.

[briandfoy]

Yeah, I like the SQLite idea. I've added it to the v2 discussion.

[stigtsp]

I'd think a JSON data file might make the most sense, so it can easily be consumed without evaling anything.

SQLite has had quite a few vulnerabilities over the years, so I'm not sure this is a safe format to consume.

[briandfoy]

I'm now making a JSON file and distributing it with the module. The JSON file is also in the Releases section in the GitHub repo so you can grab it apart from the Perl module.