But, why not find a way to embed it in the same file? So, use a specially-named POD paragraph to hold a signature block. A simple program will read a file, throw away that sig block, normalize end-of-line characters, and feed the result to PGP, then insert the new sig block into the original (un-normalized) data.

The normalization is done so that people can sign and verify on different platforms. FTP or Unzip may change line endings, and don't affect the meaning or appearance of the script. Anything else that needs to be normalized for this issue?

The sig block would contain a line stating what it is, the normal base64-encoded PGP signature that's used in email, plain text for the signer's name, and a SHA-1 hash line (base64-encoded) of the same input that was signed.

The latter is a way to do some checking even if you don't have PGP available. This won't detect fraud like a digital signature, but will detect the common case of someone changing something and not updating the version number or release information.

Meanwhile, it's possible for a Perl program to automatically check the signatures for modules it loads. I'm not saying you always want to do that because of performance issues (though MS thinks its OK with .NET, and Java has something like that), but you could. Another thing is to automatically scan and verify the library directories that contain the .pm files, along with your daily backups and virus scans.

Any thoughts on this?

—John