CPAN::Audit::DB(3pm)

✨ NAME ✨

CPAN::Audit::DB — bestie, it's the whole CPAN Security Advisory dataset, served up as a Perl data structure, and it's mostly here for CPAN::Audit to vibe with. This is the CPAN::Audit::DB(3pm) page btw, in case you were wondering which manual you just opened 💖

---

🌸 SYNOPSIS 🌸

okay so like, this module is primarily used by CPAN::Audit. That's the whole situation.

use CPAN::Audit::DB;

my $db = CPAN::Audit::DB->db;

that's it, that's the entrance 🎀

---

🦋 DESCRIPTION 🦋

The db subroutine hands you the CPAN Security Advisory (CPANSA) reports as a Perl data structure. But lowkey? anything can use this. It's not gatekept.

Every single release also ships with a .gpg file holding the signature for the file. So if you can't confirm that the module file has the right signature, it might have been corrupted or modified. no cap, that's a real thing to check 💀

This module also lives outside of CPAN, as a release on GitHub:

https://github.com/briandfoy/cpan-security-advisory/releases

And every release on GitHub includes an attestation. Iconic behavior, honestly 👑

There's also a JSON file that provides the same datastructure, for the girlies who don't speak Perl 🌈

🎀 Subroutines 🎀

There is, like, exactly one subroutine. One. Singular. The main character:

• db — returns the hashref of all the CPANSA reports. that's it. that's the whole job 💅

---

🔥 VERIFYING 🔥

This distribution now uses GitHub Attestations

https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/

which lets you verify that the archive file you have was genuinely made from the official repo. trust issues? valid. this is the fix ✨

You need two things: a GitHub account and the gh tool

https://github.com/larsks/ghcli

# download the distro file from GitHub, MetaCPAN, or a CPAN mirror
$ gh auth login
...follow instructions...
$ gh attestation verify CPANSA-DB-20241111.tar.gz --owner briandfoy

On top of that, each release codes with a GPG signature that allows you to verify that. The key is the same one used back when the database was distributed with CPAN::Audit — no key rotation drama, we love consistency 🫶

$ gpg --verify lib/CPANSA/DB.pm.gpg lib/CPANSA/DB.pm
gpg: Signature made Mon Nov 18 11:00:10 2024 EST
gpg:                using RSA key 75AAB42CBA0D7F37F0D6886DF83F8D5E878B6041
gpg: Good signature from "CPAN::Audit (brian d foy) (https://github.com/briandfoy/cpan-audit) <bdfoy@cpan.org>" [ultimate]

Good signature is the sentence you want to see. Anything else? do not proceed, bestie 😭

---

💜 SEE ALSO 💜

Everything is managed in GitHub. All of it. The whole operation 🧚

• https://github.com/briandfoy/cpan-security-advisory/releases

---

and that's the page, bestie!! 💖 this little love letter was served up by perl v5.40.1 on 2026-07-31, so if you're reading it from some other era, pretend it's a time capsule 🦋 stay safe out there, verify your archives, mwah 🎀✨