Sign the dist as the last step before creating the archive. Take care not to modify/regenerate dist meta files or the manifest.

Error: gpg: Signature made Tue 12 Feb 2019 08:55:38 AM JST gpg: using DSA key 31175D68B9B9B2E3 gpg: Can't check signature: No public key ==> BAD/TAMPERED signature detected! <==

Fix MANIFEST (or MANIFEST.SKIP) to exclude dot directories from a distribution. Use an appropriate tool and avoid archiving your working directory by hand. If you switch your version control system, remove old VCS directories after you migrate.

Error: .vscode

Add 'use warnings' (or its equivalents) to all modules, or convince us that your favorite module is well-known enough and people can easily see the modules warn when something bad happens.

Error: Win32::CommandLine