Mac OS X Security Update 2009-001 might break your Perl (CPAN)

2009.02.12

Mac OS X Security Update 2009-001 might break your Perl (CPAN)

A couple of my friends on IRC have told me this, and since I'm using 10.4.11 I couldn't verify, but the latest Mac OS X Security Update 2009-001 apparently breaks your Perl, if you

are using Mac OS X 10.5 (Leopard)
and are using Perl that comes with Mac OS X
and have upgraded several core modules with CPAN in the past

In other words, it doesn't break yours if you a) haven't ever used CPAN with your perl, b) are on Tiger like me or c) have built Perl yourself, or are using other Perl like MacPorts one.

Once your Perl gets broken, you'll see errors like this:

% perl -MIO
IO object version 1.22 does not match bootstrap parameter 1.23
at /System/Library/Perl/5.8.8/darwin-thread-multi-2level/XSLoader.pm
line 94.

Compilation failed in require.
BEGIN failed--compilation aborted.

This is because the Security Update brings (old) IO.bundle with version 1.22 but your IO.pm has been updated to the latest 1.23 on CPAN shell. (But hey, 1.23 was released in 2006 ... Why do you bring that ancient version back, Apple!?)

The fix is to update IO.pm to 1.23, but since IO.pm is now broken, you can't even run CPAN shell to do this (Ugh!). You need to go to CPAN and grab IO-1.2301.tar.gz, unpack it and run "perl Makefile.PL; make; sudo make install" to fix this. You probably need to do the same against Scalar::Util and Storable.

This is another reason why you shouldn't use Perl that comes from vendors (Apple isn't any different from Fedora on this!) or use stuff like local::lib to keep system modules clean.

(Thanks lopnor and typester for the information!)

Feb 12, 2009 7:07:17 PM