#!perl

use strict;
use warnings;
use 5.010;

our $VERSION = 0.001;

use English qw( -no_match_vars ) ;  # Avoids regex performance
                                    # penalty in perl 5.18 and
                                    # earlieri
use Test2::V0;
use Test2::Plugin::BailOnFail;

use Path::Tiny qw( path );

ok(path('SECURITY.md')->is_file(), 'Policy file SECURITY.md exists');

# Read file and remove whitespace from the end.
my $policy = path('SECURITY.md')->slurp_utf8 =~ s/[[:space:]]+$//rmsx;

my (@policy_lines, @wanted_lines);
foreach (split qr{\R}msx, $policy) { push @policy_lines, $_; }
do {
    local $INPUT_RECORD_SEPARATOR = undef;
    my $wanted = <DATA>;
    # Remove whitespace from the end.
    $wanted =~ s/[[:space:]]+$//msx;
    foreach (split qr{\R}msx, $wanted) { push @wanted_lines, $_; }
};
    is(\@policy_lines, \@wanted_lines, 'Policy file SECURITY.md is current');

done_testing;

__DATA__
# Security Policy for the Dist-Zilla-Plugin-WeaveFile distribution.

Report security issues by email to Mikko Koivunalho <mikkoi@cpan.org>.

This is the Security Policy for Dist-Zilla-Plugin-WeaveFile.

The latest version of the Security Policy can be found in the
[git repository for Dist-Zilla-Plugin-WeaveFile](https://github.com/mikkoi/env-dot/blob/main/SECURITY.md).

This text is based on the CPAN Security Group's Guidelines for Adding
a Security Policy to Perl Distributions (version 1.3.0)
https://security.metacpan.org/docs/guides/security-policy-for-authors.html

# How to Report a Security Vulnerability

Security vulnerabilities can be reported to the current Dist-Zilla-Plugin-WeaveFile
maintainers by email to Mikko Koivunalho <mikkoi@cpan.org>.

Please include as many details as possible, including code samples
or test cases, so that we can reproduce the issue.  Check that your
report does not expose any sensitive data, such as passwords,
tokens, or personal information.

If you would like any help with triaging the issue, or if the issue
is being actively exploited, please copy the report to the CPAN
Security Group (CPANSec) at <cpan-security@security.metacpan.org>.

Please *do not* use the public issue reporting system on RT or
GitHub issues for reporting security vulnerabilities.

Please do not disclose the security vulnerability in public forums
until past any proposed date for public disclosure, or it has been
made public by the maintainers or CPANSec.  That includes patches or
pull requests.

For more information, see
[Report a Security Issue](https://security.metacpan.org/docs/report.html)
on the CPANSec website.

## Response to Reports

The maintainer(s) aim to acknowledge your security report as soon as
possible.  However, this project is maintained by a single person in
their spare time, and they cannot guarantee a rapid response.  If you
have not received a response from them within 14 days, then
please send a reminder to them and copy the report to CPANSec at
<cpan-security@security.metacpan.org>.

Please note that the initial response to your report will be an
acknowledgement, with a possible query for more information.  It
will not necessarily include any fixes for the issue.

The project maintainer(s) may forward this issue to the security
contacts for other projects where we believe it is relevant.  This
may include embedded libraries, system libraries, prerequisite
modules or downstream software that uses this software.

They may also forward this issue to CPANSec.

# Which Software This Policy Applies To

Any security vulnerabilities in Dist-Zilla-Plugin-WeaveFile are covered by this policy.

Security vulnerabilities in versions of any libraries that are
included in Dist-Zilla-Plugin-WeaveFile are also covered by this policy.

Security vulnerabilities are considered anything that allows users
to execute unauthorised code, access unauthorised resources, or to
have an adverse impact on accessibility or performance of a system.

Security vulnerabilities in upstream software (prerequisite modules
or system libraries, or in Perl), are not covered by this policy
unless they affect Dist-Zilla-Plugin-WeaveFile, or Dist-Zilla-Plugin-WeaveFile can
be used to exploit vulnerabilities in them.

Security vulnerabilities in downstream software (any software that
uses Dist-Zilla-Plugin-WeaveFile, or plugins to it that are not included with the
Dist-Zilla-Plugin-WeaveFile distribution) are not covered by this policy.

## Supported Versions of Dist-Zilla-Plugin-WeaveFile

The maintainer(s) will only commit to releasing security fixes for
the latest version of Dist-Zilla-Plugin-WeaveFile.

Note that the Dist-Zilla-Plugin-WeaveFile project only supports major versions of Perl
released in the past 10 years, even though Dist-Zilla-Plugin-WeaveFile will run on
older versions of Perl.  If a security fix requires us to increase
the minimum version of Perl that is supported, then we may do so.

# Installation and Usage Issues

The distribution metadata specifies minimum versions of
prerequisites that are required for Dist-Zilla-Plugin-WeaveFile to work.  However, some
of these prerequisites may have security vulnerabilities, and you
should ensure that you are using up-to-date versions of these
prerequisites.

Where security vulnerabilities are known, the metadata may indicate
newer versions as recommended.

## Usage

Please see the software documentation for further information.
