Invalid signature errors, CPAN, gpg

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View

When I try to install some packages (most notably Bundle::CPAN) using CPAN, I
get the following errors:

gpg: Signature made Mon Feb 27 01:57:02 2006 EST using DSA key ID A317C15D
gpg: requesting key A317C15D from x-hkp:// ...
gpg: no valid OpenPGP data found.
gpg: Can't check signature: public key not found
==> BAD/TAMPERED signature detected! <==

What's wrong, how can I fix it, and can I run the install without checking
signatures? Thanks.

Re: Invalid signature errors, CPAN, gpg

Quoted text here. Click to load it

Does that terminate the process ?

Quoted text here. Click to load it

I don't know the answer as I never use to install modules. I just
manually download the source, extract to some location, 'cd' to that
location and run (in succession) 'perl Makefile.PL', 'make test', and 'make
install'. That way, the problem of verifying gpg signatures is avoided.


Re: Invalid signature errors, CPAN, gpg

Thanks Rob,

Yes it does terminate the process, otherwise I wouldn't care. The error seems to
occur in two places: before it compiles, I think, which is fatal, and later when
it runs the tests, which I can turn off.

I used CPAN because it did all the interdependencies for me so I wouldn't have
to manually install every module. It was good while it still worked. Oh well.


Sisyphus wrote:
Quoted text here. Click to load it

Re: Invalid signature errors, CPAN, gpg

Quoted text here. Click to load it

I expect that there's a way of avoiding that termination - but, like I said,
I can't really help.

Quoted text here. Click to load it

Yes - that's the temptation it offers. The drawback is that you might have
to spend the time and energy you saved (and more) working out how to get to behave as you wish.

Mostly the depenedencies aren't too extensive - but there are exceptions,
and those exceptions will probably increase over time as authors assume that is being used, and it therefore doesn't matter if their module needs
20 other obscure modules, because the whole process is automated.

For some reason really irritates me - to the extent that I just
cannot bring myself to use it. (That's mainly just me, however :-)


Site Timeline