[Catalyst] [ANNOUNCE] Alien::Dojo v0.01

[Matt S Trout]

Dominique Quatravaux wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Carl Franks wrote:
> 
>> I'm the one responsible for HTML::Dojo!
> 
> Hi Carl, nice to meet you!
> 
>> HTML::Dojo has been on cpan since last monday, I think. I left off
>> uploading it until they released Dojo 0.3.0
> 
> Since I mostly use search.cpan.org, I did not know about that either,
> sorry.
> 
>> Dojo FAQ Licenses and legal questions
>> http://dojo.jot.com/FAQ#Licenses%20and%20legal%20questions
> 
> The FAQ does not answer my shop's concern («can I legally bundle Dojo
> with a piece of software that is licensed like Perl?») and even if it
> did it would be nothing more than estoppel on the part of whomever the
> author of the FAQ is; as for most legal questions, only a judge
> currently living in the future knows the answer for sure. The
> surest-fire way of avoiding "copy"right liability is quite simply, not
> to copy Dojo into my deliverables in the first place. But if you are
> willing to take on the liability for me that's fine :-)

Given the licenses dojo is available under, at least one should be more 
than suitable; it's designed to permit commercial bundling so OSS 
bundling will certainly be covered.

>> Alien::Dojo uses a regex to parse the homepage, to find the
>> download link. That would easily be broken if they, for example,
>> added any any other attribute between the "<a" and the "href=".
> 
> That's why there is an option to manually download the zipfile: try
> unplugging the Ethernet and rebuilding the package. I'm open to
> suggestions on how to make the parser algorithm more robust (maybe use
> the first link that starts with http://download.dojotoolkit.org/ ?),
> but please elaborate on what's wrong with auto-download and regexes
> per se?

It's a foolish, fragile approach. Talk to the dojo maintainers about 
canonical URIs or at the very least use a real HTML parser.

> I expect the upgrade issue to confuse users no matter how it is done,
> since Dojo's numbering scheme is incompatible with Perl's. 

X.Y.Z is incompatible with perl?

I bet that'll come as a surprise to those of us running for e.g. "perl 
5.8.8" ...

Look at version.pm. Look at how CPAN handles version.pm-using modules. 
You may find it enlightening.

> That's why
> I chose to force A::D users to express their Dojo dependency in a
> non-CPAN compatible fashion; whereas you intend to use CPAN as a
> history mechanism for Dojo and deal with the release numbering scheme
> discrepancy. TIMTOWTDI, I guess.
> 
>> Have you tried using the Alien::Dojo module for anything though? As
>> it's quite broken at the moment.
> 
> No I didn't: as I said I'm new to Dojo. I wanted to release early, and
> planned to make bugfix releases often as I made progress in
> understanding Dojo.

If you aren't sure if something works, put an _ in the version number so 
it gets marked as a developer release and unsuspecting users don't 
install it expecting it to work.

>> I plan on adding a new method, so that the entire distribution can
>> be output to a directory, just like Alien::Dojo's install(). Once
>> that's added, would HTML::Dojo likely meet all your needs?
> 
> Can you please also find a way to retain my (planned) feature of
> allowing for multiple Dojo versions in a single Perl package? "use
> only" simply doesn't cut the mustard for me. Other than that I do
> indeed need a flat-file copy of Dojo (to serve from a "raw" Apache)
> and I would prefer not to have to duplicate it into some work
> directory (A::D's ->path() does provide that kind of "zero-copy"). But
> that's no biggie and I can live without that.

I tend to bundle all the modules an application needs into the 
rpm/dev/whatever for the application itself as a local lib/ tree that 
the app pushes onto @INC; anything else leaves you vulnerable to 
distro-induced upgrades and as such isn't IMO acceptable for production.