Incorrect 'authorized' field? HTML-Template

[szabgab]

http://api.metacpan.org/v0/release/WONKO/HTML-Template-2.95 says authorized: false
but https://metacpan.org/pod/HTML::Template does not show it unauthorized.
(neither does http://search.cpan.org/dist/HTML-Template/ )

[rwstauner]

This release is marked as unauthorized because it contains packages that are unauthorized.
However, the release page does not show that.

We specifically don't (currently) mark whole releases as "unauthorized" on the website because of the frequency with which a package will be overlooked when adding comaint. With better heuristics we may bring that label back.

In this case the main module contains several packages (though they do not have versions)
that are explicitly not allowed according to 06perms:

💥 zgrep -E '^HTML::Template(::[A-Z]+)?,' ~/perl5/cpan/mini/modules/06perms.txt.gz
HTML::Template,MPETERS,c
HTML::Template,SAMTREGAR,m
HTML::Template,WONKO,c
HTML::Template::COND,SAMTREGAR,f
HTML::Template::DEFAULT,SAMTREGAR,f
HTML::Template::ELSE,SAMTREGAR,f
HTML::Template::ESCAPE,SAMTREGAR,f
HTML::Template::FAQ,WONKO,f
HTML::Template::HTX,TALE,f
HTML::Template::IF,SAMTREGAR,f
HTML::Template::JIT,SAMTREGAR,f
HTML::Template::JSESCAPE,SAMTREGAR,f
HTML::Template::LOOP,SAMTREGAR,f
HTML::Template::NOOP,SAMTREGAR,f
HTML::Template::PRINTSCALAR,SAMTREGAR,f
HTML::Template::UNLESS,SAMTREGAR,f
HTML::Template::URLESCAPE,SAMTREGAR,f
HTML::Template::VAR,SAMTREGAR,f

So the packages still belong to a prior release in 02packages:

💥 zgrep -E '^HTML::Template(::[A-Z]+)?\s' ~/perl5/cpan/mini/modules/02packages.details.txt
HTML::Template                     2.95  W/WO/WONKO/HTML-Template-2.95.tar.gz
HTML::Template::COND                2.9  S/SA/SAMTREGAR/HTML-Template-2.9.tar.gz
HTML::Template::DEFAULT             2.9  S/SA/SAMTREGAR/HTML-Template-2.9.tar.gz
HTML::Template::ESCAPE              2.9  S/SA/SAMTREGAR/HTML-Template-2.9.tar.gz
HTML::Template::FAQ               undef  W/WO/WONKO/HTML-Template-2.95.tar.gz
HTML::Template::HTX                0.07  T/TA/TALE/HTML-Template-HTX-0.07.tar.gz
HTML::Template::JIT                0.05  S/SA/SAMTREGAR/HTML-Template-JIT-0.05.tar.gz
HTML::Template::JSESCAPE            2.9  S/SA/SAMTREGAR/HTML-Template-2.9.tar.gz
HTML::Template::LOOP                2.9  S/SA/SAMTREGAR/HTML-Template-2.9.tar.gz
HTML::Template::NOOP                2.9  S/SA/SAMTREGAR/HTML-Template-2.9.tar.gz
HTML::Template::PRINTSCALAR         2.9  S/SA/SAMTREGAR/HTML-Template-2.9.tar.gz
HTML::Template::URLESCAPE           2.9  S/SA/SAMTREGAR/HTML-Template-2.9.tar.gz
HTML::Template::VAR                 2.9  S/SA/SAMTREGAR/HTML-Template-2.9.tar.gz

I'm open to discussion about the best ways to combat confusion on a release like this one,
but at the moment, I think the bug here is that the release page on metacpan isn't showing these packages (and displaying them as unauthorized), which is a very easy fix.

[szabgab]

Hmm, thanks for looking into this (and for fixing the title)

Another bit of information: If I am not mistaken this would list all the files in this release http://api.metacpan.org/v0/file/_search?q=release:HTML-Template-2.95&size=1000&fields=authorized
but they are all authorized.

And just as an exercise for myself, I think this would list the files that are not authorized, but that's empty.
http://api.metacpan.org/v0/file/_search?q=release:HTML-Template-2.95%20AND%20authorized:false&size=1000&fields=authorized

[rwstauner]

Like I said, the "unauthorized" packages are in the main module, so you need to go deeper:
http://api.metacpan.org/v0/file/_search?q=release:HTML-Template-2.95&size=1000&fields=file.module.authorized

http://api.metacpan.org/v0/file/_search?q=release:HTML-Template-2.95%20AND%20file.module.authorized:false&size=1000&fields=authorized

Don't feel too bad, though, I did the same thing the first time.
The file has an authorized field, but each package (inside the module array) also has an authorized field. In this case that is the one that is important.

[szabgab]

Oh, so if I understand this correctly this deeper thing is relevant for files that contain multiple packages.
And in this case the package that also happens to be the file-name was authorized while other packages in the same file were not.

Wouldn't it be more correct if the authorized field of the file represented an 'and' of all the packages in that file? Just as the release was marked as unauthorized (in the database) because one of the packages was unauthorized.

[rwstauner]

Unfortunately it's not that simple...
If you try to install HTML::Template with a cpan client, this is the release you'll get,
so to say that this file as a whole is unauthorized would not be accurate.

Looking at the code, file.authorized is a reflection of module.authorized for the package that matches the file name. So in this case, because HTML::Template is authorized, the file HTML/Template.pm is authorized (even though it also contains unauthorized modules).

I'd like to agree with you (that file.authorized would be an "and") but PAUSE doesn't see it that way.
I'd be more inclined to remove file.authorized altogether to avoid the confusion, however in the vast majority of cases it represents a handy and very logical shortcut.

I dislike that the authorized field on releases is inconsistent with the authorized field on the main module file, however it's not clear to me what the answer should be. Currently a release is marked as unauthorized when it contains any packages that are not authorized. The problem is that it is in fact both. It is authorized because the main module is in 06perms and therefore 02packages. However it also doesn't seem right to mark a release as authorized if it contains any unauthorized modules, based on the definition of the word. It is precisely because of this obscurity that we took the "unauthorized" marking of releases off of the website.

If anybody has a better answer I'd love to hear it.