thanks for the pointers. yes the code is in strings and not on file. so I do not have to use the hook yet

I'm afraid you are missing the point here.

But as long as you're happy, it's OK for me. :)

Cheers Rolf
_{(addicted to the Perl Programming Language :)
Wikisyntax for the Monastery FootballPerl is like chess, only without the dice}

LanX, I think I got the point but please correct me if not:

• install the hook in @INC to read any required module via a network transfer or even from an array of strings each representing a module.
• do not eval any module at all. Instead eval the executable/test script. For each of its required modules, if not found in @INC will eventually reach the hook sub and get it to load.
• in this way only required modules are eval'ed, the rest wait either in the array of strings (as is the case with me) or at the server if via network.

All this is nice but I omitted one detail: The module files read are encrypted. The user supplies a password at runtime in order to be able to load them. So, with this detail, the trilemma is:

• use the password to decrypt all the modules at once, destroy the password-var, keep the modules in-memory-waiting for the hook to load them whenever needed. Modules stay in the array of strings as plaintext, for the sake of destroying the password-var and also not statically bundling the app with lots of modules.
• store the password in the hook to decrypt module-strings whenever requested. This is the dynamic bundling so-to-speak but with the danger that the password remains in memory for the time of the execution.
• do not use a hook, but decrypt the modules at once, destroy the password, eval ALL the modules (static bundling) before executing the test script, destroy all plaintext module strings - essentially within a a few (critical) seconds.

The last option minimises the danger of memory-dumping the password and the plaintext module strings but does eval all the modules at once (they may not be needed) and then executes the script. The up-side is that modules now reside in the perl interpreter and memory-dumping that will take significantly more effort than memory-dumping a plaintext string variable.

So, I am good+genki with 3rd option (Update: I believe...),

thanks, bliako