Add source file verification using %gpgverify

For the guidelines, see:
https://docs.fedoraproject.org/en-US/packaging-guidelines/#_source_file_verification

bison.spec

@@ -3,12 +3,18 @@ Name: bison
 Version: 3.6.4
 Release: 1%{?dist}
 License: GPLv3+
-Source: ftp://ftp.gnu.org/pub/gnu/bison/bison-%{version}.tar.xz
+Source0: https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz
+Source1: https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz.sig
+# genereted from https://ftp.gnu.org/gnu/gnu-keyring.gpg via:
+# curl https://ftp.gnu.org/gnu/gnu-keyring.gpg | gpg2 --import
+# gpg2 --export --export-options export-minimal 7DF84374B1EE1F9764BBE25D0DDCAA3278D5264E > gpgkey-7DF84374B1EE1F9764BBE25D0DDCAA3278D5264E.gpg
+Source2: gpgkey-7DF84374B1EE1F9764BBE25D0DDCAA3278D5264E.gpg
 
 # testsuite dependency
 BuildRequires: gcc-c++
 BuildRequires: autoconf
 BuildRequires: flex
+BuildRequires: gnupg2
 
 URL: http://www.gnu.org/software/bison/
 BuildRequires: m4 >= 1.4
@@ -68,7 +74,8 @@ these files are available.  See the Internationalization in the
 Bison manual section for more information.
 
 %prep
-%setup -q
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
+%autosetup
 
 %build
 %configure

upstream-key.gpg

@@ -1,48 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.1 (GNU/Linux)
-
-mQGiBD8yt+oRBADkmVuWjrl0k0lrYOdaczAslirKeiayAd8868d7V6GzfFc/HES4
-tFhi+okVybTAUJ6i4oKmIV0c5pNyzZ3TErHYFb40RP0FgW39SMgAIQ/H/kBMSjrq
-jQNQi9TsXolNc2v+8rkYGRkR20PiIUwKxeZvgB6tyMNFTb9/NrwqNM+E2wCgobBp
-1S/UnaRfYRt+CYH91TTTPWUD/jW/S9ddc0yXOwx2f99f+gIJ6KIQmRihP3LvTdlf
-vWwv1M8y9uWteXP11rcmvdRryL40irKP3gUnBHo7h3+vicTlG/YV0lvVPzo12mgO
-6yEO1eJmxYYkqeQ4Tzy95SG1xuoEYK6daOHPAZTBdoUCHJXaJhxbllPSgx6F0taT
-S4u9BADgXDuE1lduOsQeIa8LadO7MtRdCC+lpuh6OErNnHgVCBnOJzIWY6Vtw0mZ
-nvKvwQCTbgwC5ZF2VdcfKfnNsz1Uc/tie7bGo4rz1CnHMokRT6+CMpkSg0+8CAFM
-LSYIZP0Bs4YCD1XxoVef/3xqULSzY9tEc0hB/eCOfuXCFiHbuLQcUGF1bCBFZ2dl
-cnQgPGVnZ2VydEBnbnUub3JnPohdBBMRAgAdBQI/MrfrBQkB4TOABQsHCgMEAxUD
-AgMWAgECF4AACgkQ1h7LNGmkcmsIhwCdEqoVFmJzghAzkqwDlO+zO8vwNZMAn13H
-cKAWAkQ1XttffFpQ4g63o5CYuQENBD8yt+0QBACVjyAOjVJIv/H7mCYAIdx1mF+U
-BOIZzEKsJnqIR+8DZvDsmY6dvkvDEETlMlE3D+mH+CuNylDsHChDKBVTonrKsPdl
-woVjkh2lQ5x67U929cNpJ3O5+Y3DxiANj1NPV3rgUePO/HxqFnRZdWtw6kXcnDgQ
-ELVhB2ngzU1Jxfu9YwADBgP/UkK5GfBuhqY/5UessEZNs2vzRoVe/jsj4AF0zUfO
-37FbUllURV+3bK6knN6L/l77mDGh/oHqBr4drewxWN9EQMB8lhKHVunazmQ7kTcZ
-O8xnZQubASTnM6Hd7OL4wJAcpVyQOBaVsPDOf0vlqCHX+xj1T+mxJPhqZrHqmJeV
-j2iITAQYEQIADAUCPzK37QUJAeEzgAAKCRDWHss0aaRya+jOAJ96m9tB9UFY36ou
-H9CzH0gE60M9mACfXqEHT1kDN+s5z64kiKr0lNe3+9GZAaIEQuEYHxEEAP1h6Eyn
-sdMRGwx3/tlUoeHFjVe7fkN/JzlL5Z6oao+Y/Yf2ESBg/XB0/8FaS7CTQMHKChip
-a9Wivp+GiqzKCewULYLApLUS5WO+xJ8wGPIShIUh33Vups7rR7JGqQ98pxbTk8E/
-36zRUH6R6g0H9DPZbUxKZDWELKKSegYu3FQ7AKCpqJc9Vq8GTgFflXlGYffSENVk
-CwP/VMH3PtBfPRgwqiUrydXT95zogct+RivNzwzIsKxi+0w1BhYdCLNgXD7TA3lT
-QsgLytskVer1T1dmp6bwH5ZW05iTzSOQqq8EI4sA5AYq5JIvUmIRYKg5R+LGuDxP
-8Ruvw53NSE1hLtsC+qiQxHqcDK+t2vf8nSU7bcom92OuDZoD/3JEYfumdlrt/BR/
-Vv/dqG9kKLCoXNbuV+X4Aq8RTSOszopBUc+TJIqZNaAq13n4XUDqznhmlWq0d5x2
-CWQimDQzMn/2vjacJ/MNTdxcw+7s/rjnFy/LBWT/cRuUxgk3B+wlDHp4z5V1HLWF
-ed49y4OHWxF7qvONM3ccwABW/xnvtCBQYXVsIEVnZ2VydCA8ZWdnZXJ0QGNzLnVj
-bGEuZWR1PohkBBMRAgAkBQJC4RgfAhsDBQkFo5qABgsJCAcDAgMVAgMDFgIBAh4B
-AheAAAoJELk/YMa1xM4TocEAoI6ngp3vBGXrLRkFFibu5kNbFoIvAKClFUC21RFB
-xrC1eZoD2/df9IG/pLkCDQRC4RguEAgAutFBZGkpmjmVPG16cZDdXcAEEyKxse+s
-W3ftiv/h8x2cvEmy8x3A2tuCWf5gSJ3viawdkAp5w9d42IoC4O3COF3B7nRpR6FU
-6o193OXLrJhNjmBV5iGgyLZfkxuA686J7BP2yxUSzwJjAhyk1S+70sg3cygMLDT0
-EsID1n0Y5HWFHP5DkfNhIh0Kh4gqsCQBytO8cD/hsVSSbz+9ttDSV/LIzcCUgkJe
-O5HkxSnd/3CYB2FBIzlM0XIWvEoZ/z6shroIySIGZlxnbZXFO//nVEC4EHQ7JKyj
-7X+HvH2lumkjSnX51X0hmqBjeRvFK2gIu59DyZRTHiXtXE4Mdy+kXwADBQf+Ptps
-V+WJ1BuemoEmaDgNCuO+JxH1D04/ux7PXCxZKU1+k4vtwdDPXSDpWxpGD8XWgN9C
-if06GWHejBTgTRQoy4ygiBAo8B/vUQZdBL80z6rUuIOVg/EBUDiJV0Pz6Z7dwKfv
-Bb2+F8flhqJDdPLs6VxYddd5ZemXbBBe2KanIsyP7Pk586sTzuU7PMTcEMcizkzg
-HiMTY8zBd8+dBM7hn30/NORLsEfJpf+E4eC72TpJK4ZRfZpk03rMWBoZFziCfxjL
-XUOB44tQK0yn53vreX1jcc5urmI4z7j7yD3sypkYCwn7gpwyxPB9A6zDf9HyvWpf
-um6/jkof6fvV+OcRrYhPBBgRAgAPBQJC4RguAhsMBQkFo5qAAAoJELk/YMa1xM4T
-y7QAmgPizj1fRazw/BFTyStLPjUAFXNlAKCnTTwKv96JkWTxcIILLfibPRmnFw==
-=rfoO
------END PGP PUBLIC KEY BLOCK-----