blogs.perl.org

Here is the final post about AWS S3 Server Side Encryption where I demo encryption using Customer Key.Please check out the link for more information: https://theweeklychallenge.org/blog/aws-customer-key-encryption

All three of us attended.

• Release blocker triage continues. Several more blockers have been resolved. We identified no blockers among new tickets but did consider #23346 and may ship it even if we do not consider it a blocker.
• We discussed some feedback regarding the fix for CVE-2025-40909 and requested that the patch be amended. A perldelta entry is also missing before we can ship the security releases.
• We discussed who will do then stable release and when. RC1 will be published by Philippe Bruhat on June 20th.
• We went over the scalar-context pair constructor proposal. Changing the fat arrow in general is out of the question and we don’t think any other proposal is likely to work.
• We went over the 2-arg open proposal. It seems mostly trivial to do and worthwhile as well, but the real complexity is in the implicit open done by readline. We will outline our thoughts on the thread.

[P5P posting of this summary]

Over the past year, I’ve been self-studying XS and have now decided to share my learning journey through a series of blog posts. This tenth post introduces you to what I call closures in XS.

Datastar is a new-ish entry in the world of hypermedia-oriented ,htmx alternatives, with a distinct focus on Server-Sent Events. It describes itself thus:

Datastar brings the functionality provided by libraries like Alpine.js (frontend reactivity) and htmx (backend reactivity) together, into one cohesive solution. It's a lightweight, extensible framework that allows you to:

1. Manage state and build reactivity into your frontend using HTML attributes.
2. Modify the DOM and state by sending events from your backend.

I added Perl for Datastar with Datastar::SSE, for the backend reactivity bits.

Happy Friday, this is my first hand experience with AWS Bedrock.
Please check out the link for more information:
https://theweeklychallenge.org/blog/aws-bedrock

Hi, you my have noticed our "ad" showing up on on metacpan.org - many thanks to David Cross for helping us out there! You may have to hit "refresh" a few times to see it (but not too many, please! xD)

Now, as much as we'd love to see everyone in Austin, TX on July 3-4, and it's sure to be a lot of fun, the PCC is a hybrid event, meaning we do permit remote attendees and worthy talks.

We already have many exciting and highly technical Perl talks. But we are selfish and we want more. It is okay if you even repeat a talk you've given elsewhere. We offer several levels of talks, including lightning talks, which we all know is how most of us got started. Do not be afraid! :-)

• https://www.meetup.com/austin-perl-mongers/events/305855419/
• https://www.papercall.io/perlcommunity
• https://www.papercall.io/cfps/6270/submissions/new

Over the past year, I’ve been self-studying XS and have now decided to share my learning journey through a series of blog posts. This first post introduces the fundamentals of creating an perl object from XS.

Just Aristotle and Graham this week.

• This week CVE-2025-40909 was assigned, for an issue we were already tracking (GH #23010). We coordinated during the week to get a fix merged (GH #23019) before 5.41.13. Thanks to Vincent Lefèvre for the report and Leon Timmermans for the fix. During the meeting we discussed getting out security releases for this soon.
• We caught up on release blocker triage. We are tentatively all clear: all previously identified release blockers are now resolved, and there were no new blockers in recent issues and pull requests – except possibly a 32-bit Windows build issue we are not yet certain about. We are keeping an eye on that.

[P5P posting of this summary]

Continue with the blog series, in this post, I am talking about AWS KMS Encryption.
Please check out the link for more information:
https://theweeklychallenge.org/blog/aws-kms-encryption

This post is adapted from my notes and recollection of the welcome speech I gave on the morning of Thursday May 1st, 2025, just before the initial stand-up.

This post is brought to you by Booking.com, the Diamond sponsor for the Perl Toolchain Summit 2025.

Booking.com is proud to sponsor the 2025 Perl Toolchain Summit as Perl continues to be a vital piece of our technology stack. We continue to rely on the Perl platform and tooling to serve millions of customers every day, helping them experience the world. Other than our interest in the evolution and modernization of the platform and tooling, the PTS is also a great opportunity to connect with the larger community and share learnings about how other companies and projects are tackling the challenges of working with Perl at scale (talking about both in systems and teams scalability), and how Perl fits an ever-changing and diverse technological landscape in other organizations.

You can learn more about Booking.com at the end of this article.

So, what exactly is a Readonly variable in Perl? A readonly variable is one that, once assigned a value, cannot be changed. Any attempt to modify it will trigger a runtime error. This mechanism enforces immutability, ensuring that critical values remain untouched and are protected from accidental or unauthorised alterations.

A meeting with full attendance.

• We caught up with new issues and pull requests without finding any new release blockers.
• We went over the state of the perldeprecation and perlexperiment POD pages. We found that perlexperiment does not yet reflect the change in direction regarding smartmatch. Other than that we saw nothing to do.
• We went over our options regarding readline again at length. We concluded that we are not yet sure about the big across-the-board change to I/O functions, and are definitely too far into the release cycle to undertake a fishing expedition. But we don’t want to leave this problem entirely unaddressed during this cycle, and the change proposed by Tony Cook is a strict improvement, even if only a minimal one. So we decided to ship it, possibly with a slightly different implementation that we may suggest.

[P5P posting of this summary]

AWS S3 Encryption isn't as complex as I thought initially. I had fun playing with it. You can give it a try too. Please check out the link below for more information.
https://theweeklychallenge.org/blog/aws-s3-encryption

I was inspired by Daniel Stenberg's recent article Detecting malicious Unicode to write Test::MixedScripts, which tests Perl source code and other text files for unexpected Unicode scripts.

Why should you care about this?

There are Unicode characters in different scripts (alphabets) that look similar and are easily confused.

A malicious person could replace a domain name or other important token with one that looks correct, for is associated with a host or other resource that they control.

Consider the two domain names, "оnе.example.com" and "one.example.com". They look indistinguishable in many fonts, but the first one has Cyrillic letters.

Confusing Unicode might be added to your codebase through a malicious patch submission or pull request. Or it could be added as text from an email or web page that you copied and pasted into your code.

The module is easy to use, and defaults to testing for Latin and Common characters:

This extended meeting took place between the three of us in person over several days at the PTS 2025 in the beautiful city of Leipzig.

Returning from the 27th installment of the German Perl or Perl/Raku Workshop, this time in Munich, I'd like to share some impressions.

Re-creating CVE-2024-56406 using docker container with affected Perl versions.
Please check out the link below for more information.
https://theweeklychallenge.org/blog/cve-2024-56406

Over the past year, I’ve been self-studying XS and have now decided to share my learning journey through a series of blog posts. This eighth post introduces you to Perl regular expressions in XS.

All three of us attended.

• We discussed the situation with readline and the filehandle error flag once again, starting over by revisiting the basic premise of the error flag. We think we now have a better understanding the overall situation, and this led us to a different approach about how to correct the overall situation, which we will outline as a proposal soon.
• We have been wanting to revert #22465 but wanted to include a testcase that demonstrates why, which we hadn’t gotten to. In order to get this into the looming final dev release, we talked through what the testcase needs to look like, and will submit a pull request ASAP.
• We caught up on new issues and pull requests for release blocker triage. We then reviewed the state of our current release blockers, some of which have been resolved, and one of which (#23026) we demoted based on our new understanding about the readline situation.

[P5P posting of this summary]