diff --git a/CPAN-2.33-Add_verification_of_CHECKSUMS_signature.patch b/CPAN-2.33-Add_verification_of_CHECKSUMS_signature.patch
new file mode 100644
index 0000000..e698eac
--- /dev/null
+++ b/CPAN-2.33-Add_verification_of_CHECKSUMS_signature.patch
@@ -0,0 +1,59 @@
+diff -u -r CPAN-2.16.orig2/lib/CPAN/Distribution.pm CPAN-2.16/lib/CPAN/Distribution.pm
+--- CPAN-2.16.orig2/lib/CPAN/Distribution.pm	2017-02-14 16:28:12.000000000 +0100
++++ CPAN-2.16/lib/CPAN/Distribution.pm	2025-05-07 13:15:06.672972235 +0200
+@@ -1487,20 +1487,44 @@
+ 
+     $file = $self->{localfile};
+     $basename = File::Basename::basename($file);
++    my($signed_data);
+     my $fh = FileHandle->new;
+-    if (open $fh, $chk_file) {
+-        local($/);
+-        my $eval = <$fh>;
+-        $eval =~ s/\015?\012/\n/g;
+-        close $fh;
+-        my($compmt) = Safe->new();
+-        $cksum = $compmt->reval($eval);
+-        if ($@) {
+-            rename $chk_file, "$chk_file.bad";
+-            Carp::confess($@) if $@;
++    if ($check_sigs) {
++        my $tempdir;
++        if ($CPAN::META->has_usable("File::Temp")) {
++            $tempdir = File::Temp::tempdir("CHECKSUMS-XXXX", CLEANUP => 1, DIR => "/tmp" );
++        } else {
++            $tempdir = File::Spec->catdir(File::Spec->tmpdir, "CHECKSUMS-$$");
++            File::Path::mkpath($tempdir);
+         }
++        my $tempfile = File::Spec->catfile($tempdir, "CHECKSUMS.$$");
++        unlink $tempfile; # ignore missing file
++        my $devnull = File::Spec->devnull;
++        my $gpg = $CPAN::Config->{gpg} or
++            $CPAN::Frontend->mydie("Your configuration suggests that you do not have 'gpg' installed. This is needed to verify checksums with the config variable 'check_sigs' on. Please configure it with 'o conf init gpg'");
++        my $system = qq{"$gpg" --verify --batch --no-tty --output "$tempfile" "$chk_file" 2> "$devnull"};
++        0 == system $system or $CPAN::Frontend->mydie("gpg run was failing, cannot continue: $system");
++        open $fh, $tempfile or $CPAN::Frontend->mydie("Could not open $tempfile: $!");
++        local $/;
++        $signed_data = <$fh>;
++        close $fh;
++        File::Path::rmtree($tempdir);
+     } else {
+-        Carp::carp "Could not open $chk_file for reading";
++        my $fh = FileHandle->new;
++        if (open $fh, $chk_file) {
++            local($/);
++            $signed_data = <$fh>;
++        } else {
++            $CPAN::Frontend->mydie("Could not open $chk_file for reading");
++        }
++        close $fh;
++    }
++    $signed_data =~ s/\015?\012/\n/g;
++    my($compmt) = Safe->new();
++    $cksum = $compmt->reval($signed_data);
++    if ($@) {
++        rename $chk_file, "$chk_file.bad";
++        Carp::confess($@) if $@;
+     }
+ 
+     if (! ref $cksum or ref $cksum ne "HASH") {
diff --git a/perl-CPAN.spec b/perl-CPAN.spec
index 798ac54..979117d 100644
--- a/perl-CPAN.spec
+++ b/perl-CPAN.spec
@@ -36,6 +36,8 @@ Patch5:         CPAN-2.25-Fix-option-h-really-ignores-all-other-options-and-argu
 Patch6:         CPAN-2.18-Add-notes-about-first-configuration.patch
 # Change default urllist to HTTPS
 Patch7:         CPAN-2.29-Change_default_urllist_to_https.patch
+# use gpg --verify --output ... to disentangle data and signature
+Patch8:         CPAN-2.33-Add_verification_of_CHECKSUMS_signature.patch
 BuildArch:      noarch
 BuildRequires:  coreutils
 BuildRequires:  findutils
@@ -253,6 +255,7 @@ with "%{_libexecdir}/%{name}/test".
 %patch -P5 -p1
 %patch -P6 -p1
 %patch -P7 -p1
+%patch -P8 -p1
 # Change configuration name
 find -type f -exec sed -i -e 's/XCPANCONFIGNAMEX/cpan/g' {} \;
 # Remove bundled modules
@@ -326,6 +329,7 @@ make test
 * Wed May 07 2025 Michal Josef Špaček <mspacek@redhat.com> - 2.18-402
 - Resolves: RHEL-9605
   - Change default value for urllist to https://www.cpan.org
+  - Use gpg --verify --output ... to disentangle data and signature
 
 * Fri Feb 28 2025 Jitka Plesnikova <jplesnik@redhat.com> - 2.18-401
 - Resolves: RHEL-77186 - Update man page