That's a good question. The answer seems to be yes, but there may be caveats. It open()s the pathname for reading and uses Digest::MD5 to generate a fingerprint. Thinking about that, I'm really not sure if that behavior is well-defined. It doesn't seem to cause a problem on Linux at any rate. The fingerprint is the same as for an empty file. That's okay because the module also keeps info from stat() and that's what you are worried about when detecting whether a directory has changed. It checks the inode, mode, uid, gid, size, and mtime. If that's sufficient for you, I'd give it a go.
I've used File::Signature on Solaris to create a tripwire-esque tool for monitoring data integrity but it wasn't for general use; it had a limited scope and I don't think the issue of monitoring directories ever came up.
I've also just noticed that make test fails one test if you run it as root. It's not of any consequence though because it is testing an error condition which doesn't occur for root. Specifically, it is creating an unreadable file and testing the error returned when it tries to create a signature for the unreadable file. But, root can read it despite its mode, so there is no error and the test fails.
-sauoq
"My two cents aren't worth a dime.";
| 
