Verify GPG signature of sources

Additionally, use pkgconfig syntax for BuildRequires.

dbus-python.spec

@@ -1,20 +1,24 @@
-Summary: D-Bus Python Bindings
 Name:    dbus-python
 Version: 1.2.16
-Release: 5%{?dist}
+Release: 6%{?dist}
+Summary: D-Bus Python Bindings
 
 License: MIT
 URL:     http://www.freedesktop.org/wiki/Software/DBusBindings/
 Source0: http://dbus.freedesktop.org/releases/dbus-python/%{name}-%{version}.tar.gz
 Source1: http://dbus.freedesktop.org/releases/dbus-python/%{name}-%{version}.tar.gz.asc
+# gpg --keyserver keyring.debian.org --recv-keys 36EC5A6448A4F5EF79BEFE98E05AE1478F814C4F
+# gpg --export --export-options export-minimal > gpgkey-36EC5A6448A4F5EF79BEFE98E05AE1478F814C4F.gpg
+Source2: gpgkey-36EC5A6448A4F5EF79BEFE98E05AE1478F814C4F.gpg
 
 # borrow centos7 patch to use sitearch properly
 Patch0: 0001-Move-python-modules-to-architecture-specific-directo.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1788491
 Patch1: python39.patch
 
-BuildRequires: dbus-devel
-BuildRequires: glib2-devel
+BuildRequires: gnupg2
+BuildRequires: pkgconfig(dbus-1)
+BuildRequires: pkgconfig(glib-2.0)
 # for %%check
 BuildRequires: dbus-x11
 BuildRequires: python%{python3_pkgversion}-gobject
@@ -45,6 +49,7 @@ Headers and static libraries for hooking up custom mainloops to the dbus python
 bindings.
 
 %prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %autosetup -p1
 
 # For new arches (aarch64/ppc64le), and patch0
@@ -80,6 +85,10 @@ make check -k || (cat test-suite.log && false)
 %{_libdir}/pkgconfig/dbus-python.pc
 
 %changelog
+* Sun Jun 13 2021 David King <amigadave@amigadave.com> - 1.2.16-6
+- Verify GPG signature of sources
+- Use pkgconfig for BuildRequires
+
 * Thu Jun 03 2021 Python Maint <python-maint@redhat.com> - 1.2.16-5
 - Rebuilt for Python 3.10