Automic VaultAutomic Vault

brew

Install carton with Homebrew, apt

Perl module dependency manager (aka Bundler for Perl). Version 1.0.35 via Homebrew; verified 2026-06-13.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install carton

local Homebrew formula metadata

Linux

Debian aptverified · 92%
sudo apt install carton

Debian stable package indexes · carton · source: deb.debian.org

overview

Package summary

Perl module dependency manager (aka Bundler for Perl)

Commands and aliases

  • carton

history

Project history and usage

Carton is a Perl application dependency manager, described by its official README and MetaCPAN metadata as a Bundler-like tool for Perl. It tracks dependencies declared in cpanfile and pins resolved module versions in cpanfile.snapshot.

Project history

The public GitHub repository was created in 2011 and the README copyright line credits Tatsuhiko Miyagawa from 2011 onward. The latest MetaCPAN release metadata identifies Carton-v1.0.35, authored by MIYAGAWA and dated May 7, 2022.

Adoption history

Carton came from the Perl/CPAN application-deployment world, where repeatable local dependency installs mattered for web apps and services. Its README tells developers to commit cpanfile and cpanfile.snapshot so other machines and deployment boxes install the same dependency tree.

How it is used

A typical workflow declares modules in cpanfile, runs carton install, commits cpanfile and cpanfile.snapshot, then runs commands through carton exec or points Perl at local/lib/perl5. Deployment mode installs exactly from the snapshot, and carton bundle can vendor tarballs into vendor/cache for cached or offline installs.

Why package nerds care

Carton is important package-manager plumbing because it adapts the lockfile-and-local-install pattern to CPAN applications. Its README explicitly references Bundler, pip, npm, cpanm, cpanfile, and Carmel, making it a useful bridge between Perl packaging culture and the broader application dependency-manager era.

Timeline

  • 2011: Public GitHub repository created and copyright begins.
  • 2022: MetaCPAN release metadata lists Carton-v1.0.35.
  • 2020s: README documents cpanfile, cpanfile.snapshot, local installs, deployment mode, and vendored cache workflows.

Related projects

  • The README's SEE ALSO section points to Carmel, cpanm, cpanfile, Bundler, pip, npm, perlrocks, and only.
  • Carton is closely tied to CPAN, cpanfile, local::lib-style local installs, and Perl application deployment.

security posture

Risk level: orange

infrastructure mutation or orchestration signal.

Risk classifier

orange risk · medium confidence · infrastructure

Why

  • infrastructure mutation or orchestration signal

Signals

  • text:dependency manager

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 13 platform targets.
  • Installs with 1 runtime dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix
./cpanfile

executables

Installed executables

CommandKindExposureNote
cartoncliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version1.0.35
manager updated2026-06-13
local dataok
upstreamnot checked
latest detectednot detected

https://metacpan.org/pod/Carton

install metadata

Package metadata

Package keybrew:carton
Version1.0.35
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/carton
Homepagehttps://metacpan.org/pod/Carton
Repositoryhttps://github.com/perl-carton/carton
Upstream docshttps://metacpan.org/pod/Carton
LicenseArtistic-1.0-Perl OR GPL-1.0-or-later
Source archivehttps://cpan.metacpan.org/authors/id/M/MI/MIYAGAWA/Carton-v1.0.35.tar.gz
Last updated2026-06-13T01:03:34+02:00
Pulseupdated
Dependenciesperl
Bottleavailable (on arm64_big_sur, arm64_linux, arm64_monterey, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, big_sur, catalina, monterey, sonoma, ventura, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namecarton
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Debian apt95%

carton 1.0.35-1

Perl module dependency manager (aka Bundler for Perl)

https://metacpan.org/release/Carton

sudo apt install carton
  • Section: perl
  • Architecture: all
  • 8 dependencies
  • 2 optional deps
  • normalized package name match
  • Matched by: Carton
Debian stable package indexes · deb.debian.org · Debian stable package indexes: carton from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Ubuntu apt95%

carton 1.0.35-1

Perl module dependency manager (aka Bundler for Perl)

https://metacpan.org/release/Carton

sudo apt install carton
  • Section: universe/perl
  • Architecture: all
  • 8 dependencies
  • 2 optional deps
  • normalized package name match
  • Matched by: Carton
Ubuntu 24.04 LTS package indexes · archive.ubuntu.com · Ubuntu 24.04 LTS package indexes: carton from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • perlRuntime dependency declared by Homebrew.

Same workflow

  • carthageShares av.db curated category or tags: cli, dependency-management, dependency-manager, developer-tools.
  • caskShares av.db curated category or tags: cli, dependency-management, dependency-manager, developer-tools.
  • cocoapodsShares av.db curated category or tags: cli, dependency-management, dependency-manager, developer-tools.
  • coursierShares av.db curated category or tags: cli, dependency-management, dependency-manager, developer-tools.
  • cargo-editShares av.db curated category or tags: cli, dependency-management, developer-tools.
  • cargo-features-managerShares av.db curated category or tags: cli, dependency-management, developer-tools.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated configuration and credential file locations
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment