Re^2: fetching asset files from github during installation of module from CPAN

[tmaly]

I was thinking of including the most recent version as of the date I publish the module to CPAN. Then I would want to attempt to try to fetch a newer version at installation time. I will give File::Fetch a shot. Thanks

[stevieb]

I'd go the route choroba stated, and wrap it into an early test in the test suite (eval to fetch).

Perform a significant number of tests against the version that is bundled with the module, and then perform the same extensive tests against the new version before installing it, as to ensure you don't break functionality of the module with a new version of the updated files during your install.

This way, by not doing it in Makefile.PL or something, if the fetch fails, or your unit tests don't pass on the new version of files, you can lean back on the existing bundled versions.

[MidLifeXis]

From a code review standpoint, I would reject the use of any installation that went outside of the code provided in the package at installation time, as this would provide a mechanism to

• identify users of the package
• inject some unknown, unreviewed chunk of code into the dev (prod - hopefully not) environment
• other creative attacks on an environment

Not saying that this is your intent, but use of that would be shot down in a heartbeat under any cursory review here.