I'm looking for advice on how to make a clean install and upgrade procedure that gives good control over the perl and non-perl dependencies (mostly java jar files). This is not a project for wide distribution - the number of platforms and environments are quite limited. It will need to install onto Solaris and Linux, non-root.

Plenty of other projects use these boxes, so we want to keep our project as isolated as possible. The company preferred procedure for installations and upgrades/downgrades is to make a change request which consists of a su project-user; cd project-dir; cvs up -r tag. (We actually develop with subversion, but export to cvs to satisfy this).

It is a Catalyst/DBIC project. Catalyst currently uses Module::Install. So one obvious route is to let it do the work. However you lose a degree of control over the versions of CPAN modules, I'm not sure how non-perl dependencies are handled, and I don't really want our project to be installed alongside its dependencies in the same lib tree. The change request would have the additional steps make; make test; [abort on error]; make install. Installing just Catalyst non-root causes enough grief for it to be a regular topic on the mailing list. And I compared the module versions of installed dependencies on two of our environments (using Module::ScanDeps) and felt a bit ill seeing the large number of differences.

A second option is to store the dependencies in the repository. It is bloated, but would give excellent control. To install an XS module, you'd need to build and install it into the working copy on both target environments and commit. Then rely on the /$archname/ portion of the perl libs to do the right thing. I can see it isn't appropriate for a distribution that would need to install on many different platforms, but that isn't the case here.

What has people's experience been? Are there other options I'm not seeing?