CPAN verification must authenticate the checksums it uses
engineeringperlsecuritycpanThree disclosed vulnerabilities separate valid signatures from trustworthy package selection. The fixes bind checksums to author paths and tighten what clients accept.