Alpha-Omega Donates USD 250,000 for Perl and CPAN Security
Furnished content.
Photo: Stian Kristoffersen; Editing: Salve J. Nilsen. In picture, from left: Paul Johnson, Stig Palmquist, Leon Timmermans, Robert Rothenberg, Salve J. Nilsen, Timothy Legge, and Olaf Alders.CPAN Security Group (CPANSec) and The Perl and Raku Foundation (TPRF) are happy to announce the April Task Force. This project is set up to strengthen the CPANSec CNA Function, improve the security posture of CPAN and Perl, and to help prepare these communities for the impact expected from the general availability of security analysis-capable Large Language Models.The April Task Force is fiscally hosted by The Perl and Raku Foundation and backed by a USD 250,000.00 grant from Linux Foundation and OpenSSF through the Alpha-Omega project.This funding follows the September 2025 OpenSSF open letter and the wider recognition that the major package registries - CPAN among them - need structured investment to keep pace with commercial-scale use. Scope and workThe task force will be focusing on:- Streamlining CVE processes and CNA function including workflow tooling for triage, creation, verification, and publishing
- Vulnerability work measurable backlog reduction in core Perl, CPAN tooling, and critical distributions
- Supply chain security improved CPAN maturity against the OpenSSF Principles for Package Repository Security
- Long-term sustainability and funding of the Perl and CPAN security communities and ecosystem
- Participation in and contribution to Alpha-Omega’s Security engineers-in-residence program, and cross-ecosystem forum for package registries
The teamLeon Timmermans Perl Steering Council member; Core Perl security, encryption-related modulesOlaf Alders MetaCPAN founder; CPAN publishing infrastructure, auditing CVE findings, maintainer outreach, patches development; Grant managerPaul Johnson Devel::Cover project lead; CPAN XS distributions, process automationRobert Rothenberg Long-term contributor to open source and Perl; Vulnerability research, CVE reporting, communication, triage workflowSalve J. Nilsen Long-term Perl community volunteer; Project facilitation, organizational design, policy, compliance and metadata, sustainabilityStig Palmquist Vulnerability research, exploit development, CNA processTimothy Legge Cybersecurity professional; CNA process, triage workflow, vulnerability researchFiscal host: The Perl and Raku FoundationThe Perl and Raku Foundation has predominantly assumed a “hands-off” role in the Perl and Raku communities, following a “servant leadership” philosophy for supporting these.With this funding, the foundation for the first time puts on the mantle of a facilitator and fiscal host.This is both in recognition of the changing legislative landscape, where EU regulations like NIS2 and CRA will require businesses to secure their applications, services and products - and that these changes in this landscape are likely to affect the Open Source Software projects affected businesses rely on.While the core activities that make Open Source fun and worth doing should remain and be protected, there is new work laid before us. Some of it is necessary, but too tedious to attract volunteers.A change in how Perl and CPAN Security can be supportedIn their grant letter, the Linux Foundation state it succinctly.Perl [is] among the most critical and widely-used projects in the open-source ecosystem, and any vulnerabilities therein would have a significant impact on The Linux Foundation’s members, and the public at large. Every major commercial user of Perl is already paying for some version of this work. Internal teams monitor CPAN advisories, maintain private patches, respond to incidents under time pressure, and absorb the cost of unaddressed backlogs when something surfaces. Today, none of this shows up as a budget line item called “CPAN security”, even if the cost is real and being paid needlessly in parallel across the industry.The April Task Force provides a new opportunity to facilitate a “shift left” for cost-saving across the industry. To enable this, TPRF is establishing a mechanism for ongoing corporate sponsorship of this work; details will follow in the foundation’s revised fundraising goals.Furthermore, we are exploring novel funding mechanisms expected through the EU Cyber Resilience Act, to facilitate the support of Perl and CPAN projects and communities through offering compliance-relevant assurances.How to engage- Report vulnerabilities through the CPAN Security Group.
- Engage directly with the CPAN Security Group on enterprise concerns.
- Allocate software engineering and security champion resources to OSS security work.
- Prepare your budgets for sustained support of your digital infrastructure commons.
The digital commons Perl and CPAN are part of, and industry relies on, cannot thrive on bystanders. Industry engagement is key both for its own long-term security posture, and for society at large.About the CPAN Security GroupThe CPAN Security Group (CPANSec) is a group of volunteers from the Perl community who work to support the security of the Perl ecosystem through education and outreach, security analysis of open source Perl distributions on CPAN, and support for fixing security vulnerabilities. CPANSec was founded at the Perl Toolchain Summit 2023 in Lyon.About the Perl and Raku FoundationThe Perl and Raku Foundation (TPRF) is a volunteer-led 501(c)(3) non-profit dedicated to advancing the Perl and Raku programming languages. The foundation provides financial, legal, and organizational stewardship that keeps both languages freely available and actively developed funding core maintenance and development grants, producing community conferences, and supporting shared infrastructure and user groups.Links
Read more here
posted at: 12:00am on 21-Jul-2026
path: /Programming/Perl | permalink | edit (requires password)
Three ways to write a table in Podlite
Furnished content.
In my previous article I introduced Podlite as a block-based markup language. Today I’ll zoom into one piece: tables.I write tables in three rough shapes: a few rows of words I’m jotting down, a visual grid like a tic-tac-toe board, or a data export I want to embed in a document. Podlite has three syntaxes around the same model, one per shape. The first has several flavors, so let’s start with that.One model, three syntaxesThe first syntax is text-mode. It’s flexible. The simplest version is =table followed by rows. Pipes for separators:=table mouse | mice horse | horses elephant | elephants
 Plus signs work too, and you can leave cells empty:=table X | O | ---+---+--- | X | O ---+---+--- | | X
 That renders as a tic-tac-toe board. Three rows of three cells, same table model as anything else.When you want a header and a caption, use the delimited form. Add :caption(...) and put a ===== row under the head:=begin table :caption('Critters') Animal Legs Eats ====== ==== ==== Zebra 4 Cookies Human 2 Pizza Shark 0 Fish=end table
 The parser handles whitespace, pipes, or plus signs as column boundaries. A ===== line marks the previous row as a header. I reach for this form first when I’m typing into a notebook. It stays readable as I edit, and it survives copy-paste from a terminal.The second syntax is structured. Use it when you need cell spans, semantic markup, or rich content in cells. Each row and each cell becomes its own block. The ===== line becomes a :header attribute on the row:=begin table :caption('My coffee morning')=begin row :header=cell Step=cell Tool=cell Time=end row=begin row=cell Grind=cell Burr grinder=cell 20s=end row=begin row=cell Brew=for cell :colspan(2)Aeropress, 90 seconds with bloom=end row=end table
 A cell can hold any Podlite block: a paragraph, a code block, a picture, an embedded diagram. This call was made early in the spec: tables in Podlite are not a visual feature, they are containers that render as a grid.The third syntax is data-driven. If the numbers are short enough to live in the document, put them directly inside a =data-table block:=begin data-table :caption('Build status') :mime-type<'text/csv; header=present'>component,statusparser,greenrenderer,greenplayground,yellow=end data-table
 Some data has its own life: a CSV export, a TSV log, anything that exists before the document does. Keep it in a separate =data block and reference it via :src. If the data starts with column labels, mark them with the header=present parameter from RFC 4180 3:=for data-table :src<data:walks> :caption('Walks this month')=begin data :key<walks> :mime-type<'text/tab-separated-values; header=present'>datedistancenote2026-04-125kmmorning fog2026-04-153kmpark loop2026-04-228kmcoastal trail=end data
 The =data block holds raw TSV: tab-split, no quoting, which is what most TSV tools emit. Tools that walk the document read the structured data directly, and readers see the rendered table from the same source.When tables breakTables break in real documents. A copy-paste loses a column, two rows pick different separators, a CSV cell holds an unmatched quote. The Podlite spec defines four rules so the parser warns you instead of silently corrupting the document:- Per-line separator detection. Each row decides its separator from what it sees.
- Cell count validation. Short rows pad with empty cells, long rows truncate. Both produce a warning.
- Mixed-separator warning. Pipes in the header and whitespace in data still work, but you get a warning.
- CSV recovery. Missing data renders an empty table. A non-CSV MIME type falls back to a
=code block so the content stays visible.
I’d rather see a warning in the console than ship a document with a dropped row.Try itPaste any of these examples into pod6.in. The playground renders Podlite live, no install needed. The full table grammar lives in the Podlite specification.If you build something with this, or hit a case the spec does not cover, open a discussion at podlite-specs.Thanks for reading,Alex
Read more here
posted at: 12:00am on 16-Jul-2026
path: /Programming/Perl | permalink | edit (requires password)
Musical Rhythms with Math in Perl
Furnished content.
Read more here
posted at: 12:00am on 30-Jun-2026
path: /Programming/Perl | permalink | edit (requires password)
The Perl Toolchain Summit 2026: Security, Testing, Porting and Community Collaboration
Furnished content.
From April 23-26, 2026, the invite-only Perl Toolchain Summit (PTS) brought together about 30 of the ecosystem's most active maintainers including four first-timers in Vienna, Austria for four days of uninterrupted deep-dive collaboration in pair-programming sessions, consensus discussions, and critical infrastructure work. Attendees tackled security tooling and infrastructure, modernization and redesign proposals, several CI and test harness improvements, Perl core optimizations, and metadata/spec updates.Thanks to all the sponsors’ support (financial, in-kind, and community), this year’s Summit was a success. It produced multiple module releases, consensus on future smoke-testing and CPAN Testers architecture, and a new CPANSec advisory feed that will allow developers to quickly assess any Perl project’s security using either CLI tools or the MetaCPAN website itself. Those advancements benefit all organizations relying on Perl directly or indirectly.PTS 2026 Key Results & DeliverablesSecurityCPANSec took it to another level, getting faster at discovering vulnerabilities (in modules, infrastructure and core) and improving its process:- Vulnerability triage;
- CNA improvements;
- Meta V3 is moving forward;
- Deprecated Module::Signature, considered “security theater”.
Testing and Quality AssuranceTesting and QA work included:- On the road to Devel::Cover 2.00;
- Several improvements made to Test::Smoke, with 3 releases: removal of dual PerlIO/stdio testing, making install more robust (and portable);
- Test::Smoke backend full rewrite to ensure sustainability with new features and better performance;
- The Test2 family of modules, including the new web user interface, was greatly improved, with many issues fixed and new features implemented;
- Syncing from backpan.perl.org to fill in CPAN Testers’ backpan;
- New MCP server mcp.cpantesters.org to browse CPAN Testers reports from your preferred LLM CLI.
Supply Chain and Other ModulesMany CPAN authors and maintainers worked on:PAUSEVery hacktive PAUSE table:- Implemented new API token access;
- Security fixes (“rand rand rand rand”, “ABRA time” and “META symlinks”);
- New dockerized PAUSE;
- Various pentesting (e.g. reviewing YAML parser);
- Ongoing work on OAuth/OIDC;
- Several Pull Requests merged.
FundingRecent years brought the topic of funding to the front of the stage. In particular to ensure the sustainability of Perl maintenance funds, accelerate some initiatives (e.g. CPAN Security efforts) and finance community events (like this one!).A lot of things happened on this front during the Perl Toolchain Summit:- A strong effort towards funding security work;
- General discussions about funding of the community.
Group discussionsThe Perl Toolchain Summit also provides a lot of opportunity for interaction.Whether they’re corridor discussions, small talk to get to know each other and build trust, discussions around a drink or group discussions (that led in the past to “consensus” or “amendment” papers), it all ends up strengthening the Perl toolchain.During this PTS in particular, there were a lot of group discussions, probably helped by having a dedicated meeting room.On the topic of AI- AI Policies Materials
- AI Policies Governance
- Share your AI tooling and tips!
On the topic of SecurityOn the topic of Perl core- Perl Ongoing and future features
- Perl core class/roles implementation
- Configure
- UTF-8
- Plan for Perl Platforms
PodcastsAs in 2025, PTS 2026 was an opportunity to record new episodes for The Underbar.There were over five hours of conversations recorded, about:- Configure
- Vienna.pm
- PPI
- the Perl Steering Council
- Karl Williamson
Bringing 30-35 experts under one roof enabled unprecedented collaboration with real-time problem solving, saving months of remote coordination and alignment. That kind of accelerated development and knowledge transfer not only brings the community together but fuels the contributors of critical open source projects for the rest of the year so they can renew their shared goals and work in the same direction. Having four first-time attendees gaining direct mentorship is also fundamental to seed future contributions and expand the volunteer base, ensuring the longevity of the Perl ecosystem and toolchain.The continued support of our sponsors ensures that the Perl Toolchain Summit remains a catalyst for Perl sustainability translating sponsor investment into tangible improvements in performance, security, and ecosystem features and coherence. We look forward to partnering again to power the next wave of innovation in Perl’s toolchain.- The Perl and Raku Foundation,
- Grant Street Group,
- Geizhals Preisvergleich,
- Vienna.pm,
- SUSE,
- Trans-Formed Media LLC,
- Ctrl O,
- Simplelists,
- HKS3 / Koha Support,
- Harald Jrg,
- Michele Beltrame (Sigmafin),
- Laurent Boivin.
Read more here
posted at: 12:00am on 14-May-2026
path: /Programming/Perl | permalink | edit (requires password)
|
|