  def test_verify_duplicate_file
    FileUtils.mkdir_p 'lib'
    FileUtils.touch 'lib/code.rb'

    build = Gem::Package.new @gem
    build.spec = @spec
    build.setup_signer
    open @gem, 'wb' do |gem_io|
      Gem::Package::TarWriter.new gem_io do |gem|
        build.add_metadata gem
        build.add_contents gem

        gem.add_file_simple 'a.sig', 0444, 0
        gem.add_file_simple 'a.sig', 0444, 0
      end
    end

    package = Gem::Package.new @gem

    e = assert_raises Gem::Security::Exception do
      package.verify
    end

    assert_equal 'duplicate files in the package: ("a.sig")', e.message
  end
The software does not verify, or incorrectly verifies, the cryptographic signature for data.