diff --git a/scripts/paycheck.py b/scripts/paycheck.py
index 80a5853..6ee36f2 100755
--- a/scripts/paycheck.py
+++ b/scripts/paycheck.py
@@ -179,6 +179,7 @@
       if options.check:
         report_file = None
         do_close_report_file = False
+        metadata_sig_file = None
         try:
           if options.report:
             if options.report == '-':
@@ -187,8 +188,7 @@
               report_file = open(options.report, 'w')
               do_close_report_file = True
 
-          metadata_sig_file = (
-              open(options.meta_sig) if options.meta_sig else None)
+          metadata_sig_file = options.meta_sig and open(options.meta_sig)
           payload.Check(
               pubkey_file_name=options.key,
               metadata_sig_file=metadata_sig_file,
@@ -200,6 +200,8 @@
               allow_unhashed=options.allow_unhashed,
               disabled_tests=options.disabled_tests)
         finally:
+          if metadata_sig_file:
+            metadata_sig_file.close()
           if do_close_report_file:
             report_file.close()