[Module-build-general] Figuring out signature stuff

[Ken W. <ke...@ma...>]

Hi people who seem to know about signing modules,

I finally got gpg working, and Module::Signature with it.  Now I'm 
trying to figure how how Module::Build should organize things.  It 
seems to me things should happen in this order when building a 
distribution:

  1) The distdir (e.g. Sample-Module-0.11/ ) is created, including
     a META.yml file inside it
  2) Module::Signature creates a SIGNATURE file in the distdir, scanning
     the contents of the distdir and the MANIFEST inside it

Because it seems like the distribution should be created, then signed.

But it looks to me like the patches submitted to M::B so far create a 
SIGNATURE file in the top-level development directory, based on the 
MANIFEST and MANIFEST.SKIP file (so it knows what files to skip), and 
signs things before the distdir is created.

The problem with this is that developers can override the 
ACTION_distdir() method, doing whatever they want.  For instance, in 
HTML::Mason, the POD documentation gets tweaked before going in the 
distdir.  So the signatures could be wrong if they're done with the 
local versions.

What I'd like to do is to tell Module::Signature what directory to 
create the SIGNATURE file in, which would be the distdir in this case.  
Autrijus, could this happen?  Then I'd switch things around in M::B to 
take advantage of it.

  -Ken