CPAN (and CPANPLUS) won't install because of a bad signature.

tphyahoo has asked for the wisdom of the Perl Monks concerning the following question:

I'm having trouble installing SQL::Translator with CPAN. It's complaining about a bad signature.

(FWIW, my ultimate goal is to install DBIx::Class::DigestColumns, but this seems to rely on SQL::Translator for the CPAN install.)

I tried both a CPANPLUS and a CPAN install. Both seemed to fail similarly, but the CPAN fail was a lot more verbose, whereas CPANPLUS just got to the point.

Can anyone advise?

CPANPLUS attempt:


ds0207:/home/hartman/nbarter # perl -MCPANPLUS -e 'install SQL::Transl
+ator'
gpgkeys: key AE7BD016338F08F8 not found on keyserver
gpg: Signature made Sat 11 Jun 2005 04:45:46 AM CEST using DSA key ID 
+338F08F8
gpg: requesting key 338F08F8 from hkp server pgp.mit.edu
gpg: no valid OpenPGP data found.
gpg: Can't check signature: public key not found
==> BAD/TAMPERED signature detected! <==
[ERROR] Signature check failed for module 'SQL::Translator' -- Not tru
+sting this module, aborting install

[MSG] Installing of SQL::Translator failed 







CPAN attempt: 

 perl -MCPAN -e 'install SQL::Translator' | tee out.txt 

..... blah blah blah....
SQL-Translator-0.07/images/sql-fairy.jpg
SQL-Translator-0.07/SIGNATURE

Signature invalid for distribution file. Please investigate.

Distribution id = K/KC/KCLARK/SQL-Translator-0.07.tar.gz
    CPAN_USERID  KCLARK (Ken Youens-Clark <kclark@cpan.org>)
    CALLED_FOR   SQL::Translator
    CHECKSUM_STATUS OK
    CONTAINSMODS Parse::RecDescent::SQL::Translator::Parser::DB2::Gram
+mar SQL::Translator SQL::Translator::Parser SQL::Translator::Parser::
+Access SQL::Translator::Parser::DB2 SQL::Translator::Parser::DB2::Gra
+mmar SQL::Translator::Parser::DBI SQL::Translator::Parser::DBI::DB2 S
+QL::Translator::Parser::DBI::MySQL SQL::Translator::Parser::DBI::Post
+greSQL SQL::Translator::Parser::DBI::SQLite SQL::Translator::Parser::
+DBI::Sybase SQL::Translator::Parser::Excel SQL::Translator::Parser::M
+ySQL SQL::Translator::Parser::Oracle SQL::Translator::Parser::Postgre
+SQL SQL::Translator::Parser::SQLite SQL::Translator::Parser::Storable
+ SQL::Translator::Parser::Sybase SQL::Translator::Parser::XML SQL::Tr
+anslator::Parser::XML::SQLFairy SQL::Translator::Parser::YAML SQL::Tr
+anslator::Parser::xSV SQL::Translator::Producer SQL::Translator::Prod
+ucer::ClassDBI SQL::Translator::Producer::Diagram SQL::Translator::Pr
+oducer::Dumper SQL::Translator::Producer::GraphViz SQL::Translator::P
+roducer::HTML SQL::Translator::Producer::MySQL SQL::Translator::Produ
+cer::Oracle SQL::Translator::Producer::POD SQL::Translator::Producer:
+:PostgreSQL SQL::Translator::Producer::SQLServer SQL::Translator::Pro
+ducer::SQLite SQL::Translator::Producer::Storable SQL::Translator::Pr
+oducer::Sybase SQL::Translator::Producer::TT::Base SQL::Translator::P
+roducer::TT::Table SQL::Translator::Producer::TTSchema SQL::Translato
+r::Producer::XML SQL::Translator::Producer::XML::SQLFairy SQL::Transl
+ator::Schema SQL::Translator::Schema::Constants SQL::Translator::Sche
+ma::Constraint SQL::Translator::Schema::Field SQL::Translator::Schema
+::Graph SQL::Translator::Schema::Graph::CompoundEdge SQL::Translator:
+:Schema::Graph::Edge SQL::Translator::Schema::Graph::HyperEdge SQL::T
+ranslator::Schema::Graph::Node SQL::Translator::Schema::Graph::Port S
+QL::Translator::Schema::Index SQL::Translator::Schema::Object SQL::Tr
+anslator::Schema::Procedure SQL::Translator::Schema::Table SQL::Trans
+lator::Schema::Trigger SQL::Translator::Schema::View SQL::Translator:
+:Shell SQL::Translator::Utils Test::SQL::Translator
    SIG_STATUS   OK
    UPLOAD_DATE  2005-06-13
    archived     tar
    build_dir    /root/.cpan/build/SQL-Translator-0.07
    incommandcolor 1
    localfile    /root/.cpan/sources/authors/id/K/KC/KCLARK/SQL-Transl
+ator-0.07.tar.gz
    unwrapped    YES

I'd recommend removing
/root/.cpan/sources/authors/id/K/KC/KCLARK/SQL-Translator-0.07.tar.gz.
+ Its
signature
is invalid. Maybe you have configured your 'urllist' with
a bad URL. Please check this array with 'o conf urllist', and
retry. For more information, try opening a subshell with
  look KCLARK/SQL-Translator-0.07.tar.gz
and there run
  cpansign -v
CPAN: Module::Build loaded ok
  Did not pass the signature test.


*************************8
[download]

I tired rm /root/.cpan/sources/authors/id/K/KC/KCLARK/SQL-Translator-0.07.tar.gz

but that didn't change anything.

Googling around I found...

http://www.mail-archive.com/module-authors@perl.org/msg04301.html

But I blushingly admit that I don't understand what these good folk are talking about.

Comment on CPAN (and CPANPLUS) won't install because of a bad signature. Download Code

Replies are listed 'Best First'.
Re: CPAN (and CPANPLUS) won't install because of a bad signature. by xdg (Monsignor) on Aug 21, 2006 at 11:48 UTC
Do you think that you're downloading from a good URL or one that is trying to inject a trojan SQL::Translator? If you think its a good source, delete Module::Signature and that will "solve" your problem. Module::Signature has had newline issues in some situations, so it's not always reliable. In the link you gave, it's a problem finding the right key to use. Many people run CPAN without Module::Signature and it's just fine. (Module::Signature has been removed from Bundle::CPAN because of the problems that people have had with it.) You can also manually download and install SQL::Translator if you don't want to delete Module::Signature. -xdg Code written by xdg and posted on PerlMonks is public domain. It is provided as is with no warranties, express or implied, of any kind. Posted code may not have been tested. Use of posted code is at your own risk.	[reply]
Re^2: CPAN (and CPANPLUS) won't install because of a bad signature. by tphyahoo (Vicar) on Aug 21, 2006 at 12:01 UTC
Thanks for the tip. I used it. Matt Trout from DBIC suggested rm -f `perldoc -l Module::Signature` as a nice way to do that. Also, when rerunning cpanp... `Could not find or check module 'Module::Signature' [THIS MAY BE A PROB +LEM!] at /usr/lib/perl5/site_perl/5.8.8/CPANPLUS/Dist.pm line 430 Running [/usr/bin/perl -MCPANPLUS::Internals::Utils::Autoflush Makefil +e.PL ]... Looking for GNU Privacy Guard (gpg), a cryptographic signature tool... GnuPG found (/usr/bin/gpg). Import PAUSE and author keys to GnuPG? [y] n` [download] The default was yes, I answered no.	[reply] [d/l] [select]


Clear questions and runnable code get the best and fastest answer
	PerlMonks