The indirect object form of system absolutely does not use the shell.
my $valid = 0;
foreach my $keyring (@keyrings) {
# Verify that the file has been correctly signed with a valid signature.
- my @verify_args = (GPGV_BIN, "--keyring", $keyring,
- $sig_file, $upload_file);
- if (!system (@verify_args)) {
+ my @gpgv_args = ('--keyring' => $keyring, $sig_file, $upload_file);
+ if (0 == system { GPGV_BIN } 'gpgv', @gpgv_args) {
$valid = 1;
last;
}