Verify GPG signature of sources

https://docs.fedoraproject.org/en-US/packaging-guidelines/#_source_file_verification`

.gitignore

@@ -13,3 +13,4 @@
 /autoconf-archive-2018.03.13.tar.xz
 /autoconf-archive-2019.01.06.tar.xz
 /autoconf-archive-2021.02.19.tar.xz
+/autoconf-archive-2021.02.19.tar.xz.sig

autoconf-archive.spec

@@ -5,7 +5,12 @@ Summary:        The Autoconf Macro Archive
 License:        GPLv3+ with exceptions
 URL:            https://www.gnu.org/software/autoconf-archive/
 Source0:        https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz
+Source1:        https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz.sig
+# gpg --keyserver pool.sks-keyservers.net --recv-keys 1A4F63A13A4649B632F65EE141BC28FE99089D72
+# gpg --export --export-options export-minimal 1A4F63A13A4649B632F65EE141BC28FE99089D72 > gpgkey-1A4F63A13A4649B632F65EE141BC28FE99089D72.gpg
+Source2:        gpgkey-1A4F63A13A4649B632F65EE141BC28FE99089D72.gpg
 BuildArch:      noarch
+BuildRequires:  gnupg2
 BuildRequires:  make
 Requires:       autoconf
 
@@ -15,14 +20,15 @@ GNU Autoconf that have been contributed as free software by friendly
 supporters of the cause from all over the Internet.
 
 %prep
-%setup -q
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
+%autosetup -p1
 
 %build
 %configure
 %make_build
 
 %install
-%make_install INSTALL="install -p"
+%make_install
 # remove dir file which will be generated by /sbin/install-info
 rm -frv %{buildroot}%{_infodir}/dir
 # document files are installed another location
@@ -37,6 +43,7 @@ rm -frv %{buildroot}%{_datadir}/doc/%{name}
 %changelog
 * Fri Feb 19 2021 David King <amigadave@amigadave.com> - 2021.02.19-1
 - Update to 2021.02.19 (#1930679)
+- Verify GPG signature of sources
 
 * Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2019.01.06-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

sources

@@ -1 +1,2 @@
 SHA512 (autoconf-archive-2021.02.19.tar.xz) = a968c355c3cf66d74dc5b452141afbdf763e84a6c43b12c25da9a08482910d6d57ba3952aaf270d8cd5fd8b9d2dadf2d7d943ae2e1b067d68b71d2738d881aa0
+SHA512 (autoconf-archive-2021.02.19.tar.xz.sig) = f377e9b7c5099ce79ab6d7fe22610cd8869d8586089c9c6990984ef971a3bc31d8f4e0956e55e95c812981215c434536b54de5a13e3b449897aad87c1cfb663f