Sign the dist as the last step before creating the archive. Take care not to modify/regenerate dist meta files or the manifest.

Error: Old SIGNATURE detected. Please inform the module author to regenerate SIGNATURE using Module::Signature version 0.82 or newer. gpg: Signature made Mon 11 May 2009 12:05:45 PM JST gpg: using RSA key CE3E5B6EF5D53DE9 gpg: Can't check signature: No public key ==> BAD/TAMPERED signature detected! <==

Add a META.json to the distribution. Your buildtool should be able to autogenerate it.

Split the distribution, or fix the version numbers to make them consistent (use the highest version number to avoid version downgrade).

Error: 0.4.154,0.4.164,0.4.173,0.4.176

Add a 'repository' resource to the META.yml via 'meta_add' accessor (for Module::Build) or META_ADD parameter (for ExtUtils::MakeMaker).

Add SECURITY(.pod|md). See Software::Security::Policy.

Add SECURITY(.pod|md) and add a contact address. See Software::Security::Policy.

Add CONTRIBUTING(.pod|md). See https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/setting-guidelines-for-repository-contributors.