Sign the dist as the last step before creating the archive. Take care not to modify/regenerate dist meta files or the manifest.

Error: gpg: Signature made Sun 07 Jul 2019 04:42:49 AM JST gpg: using DSA key BC9B906714964AC8 gpg: Can't check signature: No public key --- SIGNATURE Thu Jul 25 05:38:58 2019 +++ @@ -1,41 +1,42 @@ SHA256 66e08748fa7fc635a234daa88db2558a05edd4131c28b5f4fd523549090d0887 .perlcriticrc -SHA256 4ffb9bf635ece1c691572c8423aeeecd7d06235977e161f05d1fba961c6417af Changes +SHA256 a1390b8938e083bded79f85549b73912c148f158073f74354aa79fdbfbeef255 Changes SHA256 d52a34724b2e3c40ffa2b3b378b574b9e3db27bc3132c88e0be3675f93f378a5 LICENSES/artistic.txt SHA256 ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6 LICENSES/gpl-2.0.txt -SHA256 a3e99e399543e24e5233e850eb76d33518019a49faa177de993ac171f57726c3 MANIFEST +SHA256 aa2b84a1384ec9fcff6394750b53e6c1424953a0cda313ee1ef6cf71564d0d7f MANIFEST SHA256 95a33de66f93629aaf10383ff5a269817d77b2126f409c4f4c387c918c99c463 MANIFEST.SKIP -SHA256 82f5c1125253e9cb3754f1462355e332338f1c74d290ef69a3857c7d2d8aeb93 META.yml -SHA256 4f0e3b9ce1f773a0bcec5e48d4ff561e3e03aec3dafa4c4bc153d61d3d544fb7 Makefile.PL +SHA256 c946459b4a9ea341731c3b31ee32a60c867d03df29fd0984090ddcfc481b31cb META.yml +SHA256 f98bfc4bf8c37e454120e9a98e798e4bff3a1c2328e40d9b5d1d76f13fd43b2e Makefile.PL SHA256 5436702b32ec143113821f582135c3f37d14d57dfcae775cb788721258a1ac3d Pg.h -SHA256 6713006416db79b6ec024e8d1a64c251fba2282658b5b0986b3cf1beea2bc612 Pg.pm -SHA256 0ad57b2d2a191af0fb267499916a68d370239be486f9c48376754f713dc657c7 Pg.xs -SHA256 789dec3f0c71174192bcf6ac13e757d785c5201cb1a3752aaabb30b5d5d39f9e README -SHA256 091470e6ecceda953ed298da9820efbdac398a3a688590c13c3e5d2688303291 README.dev +SHA256 042b7e538400d35723ab0b62f39f2f75d1dfd37ade7dbd6ee9b25bc26780a6d2 Pg.pm +SHA256 b6666c61ab66a016fd1b7fd2766482c193a2677244d3c2e8525005a84f2e6355 Pg.xs +SHA256 dc7ea161d67fd2267f607b740c1762551c12a2b5b55e50a27c360f7c9ae393d9 README +SHA256 7b35b56789708599bad9271522820ba227bf1480d170c29b8dbe7bf3145ca3d3 README.dev SHA256 345bc50603504f0ee6e3d3c3686731d4c63c3d06f74f546c18ba47ade0471855 README.win32 -SHA256 85107a9158e212cb688e8591feb8d46f51f490b81ad99dcb2b61bda35be17463 TODO -SHA256 9f7dd877714bada13ab8c0adbfd5cc9e86ce656363dd01312b4cc94e9061a721 dbdimp.c -SHA256 a8cba0d59471da9cc8e246bda3e6f868492bd118b1302cc890ce0b1fdcb147af dbdimp.h +SHA256 58986d93c3927fc032085929cc1a2cf0e47a64269f7ed758e45f78534f3ddd98 TODO +SHA256 9373a05a925237fb9f94f9bed01f9934b4ddcd7a798697626224780bcaa59c4c dbdimp.c +SHA256 abe4b4c70d4cbdce3302c5ee40fc0ededf236844072c0f7a86e40cd91598ce6e dbdimp.h SHA256 9e53f7f41aaaf1b540e2784756ef6f16f61b63df0d9956483aded3c49b6e0f48 dbivport.h -SHA256 8910eb3f0ac8c3b94c55f299724151affdd845d81120222fde53569022993acc lib/Bundle/DBD/Pg.pm +SHA256 49f497d36ef367e874e8eb302be3b29d25dae74302e4b40fdc30575a7ad13bd9 lib/Bundle/DBD/Pg.pm SHA256 f4d488374ac63cc389a6d0856dc363ab232db4903164fd485f271c1dd821e7bb quote.c SHA256 1ee43f02036bbb68c151903c2718c483ed223aff6cc93fb1408a9158adad9136 quote.h SHA256 50e3f4f1b61ddc81726161c68e9321fc3d4b7d7285560a7d69acbd8eedea9b5f t/00_signature.t SHA256 d7c0e3b288d8355756f8ecd54d79662e9f078002ac4b11c1a356d551212fb7f0 t/00basic.t SHA256 25940c950e125f5aac8ef702de35013545c8d01a75d500d9d87d2bfa54d1c2fd t/01connect.t SHA256 074329960bd0ea75b3ddfa5c2dd9c43791d171304dc242f7b073fe2daae3a7a6 t/01constants.t -SHA256 fcbc3ed9d5b70bf2d268cb2495d58af6ec49338f7af34b998466fa5765dd98cb t/02attribs.t -SHA256 29c9426aa2f2fe23ec542504280450a0ebc5abcccf917afc89ad434124ba99d8 t/03dbmethod.t -SHA256 1d96ed131830a766c6016063c0718b6e59a3c4474dd51ca82475e1baeefb21b5 t/03smethod.t -SHA256 08cbcf627c7ba29ad46c13f2abc71f56e0d8ac12bf5baea54ef35d2e83c775df t/04misc.t +SHA256 ae2154f32570991f9d9a913c1d055ed3c26465736a2b0cbcba5ab677e46aae06 t/02attribs.t +SHA256 5bfc8e6f3b42cbfa0bd063e9e5ba6d4fcfa80a8ae87992f1fd3ee10380346af6 t/03dbmethod.t +SHA256 91becf78591a882611ad2a8bf2d0d4f8a398b35b38bcb435c7fa948fef6fed7e t/03smethod.t +SHA256 46f5e1705ee5b7ae4e3c0de7b358c7714873175d1e54aa1926280ee66ccd9dcb t/04misc.t SHA256 ef0f9df83071dec45dc2209ae51b760479c41f74162971e6348b893359fae770 t/06bytea.t SHA256 1a9f054ff57a00d405a31abd2e85af3c65e4fa1fc778e37b90df3c8a97012645 t/07copy.t SHA256 51626b9a3649b33847af316ebbd727a1b592188d4e721a3775780227039b2524 t/08async.t SHA256 4280b2fb6636582508d5464842302a01d07f560418bf85e6c69c78cda8d5d339 t/09arrays.t +SHA256 a9f69d445a138922930eb2ffdd1a71cf528d6e735c725d6dcc988526c11b7777 t/10_pg_error_field.t SHA256 5d042b1e07826c148437cea4a623408bb24dca1ae9f8184d1408d23e3b244d1c t/12placeholders.t SHA256 1938ae88e623ea7116a76bb356b5ced0e9bc933751348b9ef620f5eb0ebf7c0f t/20savepoints.t SHA256 61010387dbaa9283d56f7abc16c9153bf1eda53f5323174b7881105d1275ddf3 t/30unicode.t SHA256 d222e11cf55fb1679e50f2da673f88f7e839a59e2d622c26788a263b38cd601c t/99cleanup.t -SHA256 cfc9c4cc32f5d4296b5a5c0920ebe49a85cec62ed9f14c2712963b0d5e6c7f26 t/dbdpg_test_setup.pl +SHA256 228617644869ec6545a1a7d09505b22db544ffcf10237a28d6e52615b0619602 t/dbdpg_test_setup.pl SHA256 50be982cc158a60f531674a593a55a05cac2f358b865e0cbcc6fc86285f719c0 t/lib/App/Info.pm SHA256 e930aed2b35b6dd2504c8652f8037ce8e98454e0105babeca46ee133996fa084 t/lib/App/Info/Handler.pm SHA256 bda949f555f730887b54d12627fdf17f290b245cf03ca14b7c4fc5b996c33884 t/lib/App/Info/Handler/Print.pm ==> MISMATCHED content between SIGNATURE and distribution files! <==

Add a META.json to the distribution. Your buildtool should be able to autogenerate it.

This is not a critical issue. Currently mainly informative for the CPANTS authors. It might be removed later.