Re: [Module-build-general] Signatures not actually valid, it seems

[Ken W. <ke...@ma...>]

On Tuesday, September 2, 2003, at 10:11  AM, Dave Rolsky wrote:

> On Tue, 2 Sep 2003, Ken Williams wrote:
>
>> It has come to my attention that M::B's signatures don't play nice 
>> with
>> the MANIFEST file.  The signing process will proceed fine if SIGNATURE
>> isn't in the MANIFEST, but then the signature isn't valid
>> (Module::Signature complains about the missing entry).  If you add
>> SIGNATURE to the MANIFEST and don't create the SIGNATURE file first,
>> then 'Build dist' won't work because the file is missing.  If you do
>> create the SIGNATURE file (using 'touch SIGNATURE' or the like) then
>> Module::Signature seems unable to overwrite the file.
>>
>> Needs to be fixed, of course.
>
> I think this is why I added a "sign" property.  If this exists the 
> distdir
> action will call _sign_dir().  I think with this property set, things
> should work fine as long as SIGNATURE is in the MANIFEST.

Nope, still doesn't work - try doing this and then verify the signature 
using 'cpansign -v'.  It will complain because the SIGNATURE file is 
out of date (it was necessarily created before distdir & signing, 
because it was in the MANIFEST).

Autrijus says the solution may be to add "overwrite => 1" to 
Module::Signature::sign().  Then at least it works if you do "touch 
SIGNATURE; Build dist".

  -Ken