Use %gpgverify to check the tarball's validity

.gitignore

@@ -24,3 +24,4 @@
 /emacs-26.1.tar.xz
 /emacs-26.2.tar.xz
 /emacs-26.3.tar.xz
+/emacs-26.3.tar.xz.sig

emacs.spec

@@ -9,15 +9,21 @@ Release:       2%{?dist}
 License:       GPLv3+ and CC0-1.0
 URL:           http://www.gnu.org/software/emacs/
 Source0:       https://ftp.gnu.org/gnu/emacs/emacs-%{version}.tar.xz
-Source1:       emacs.desktop
-Source3:       dotemacs.el
-Source4:       site-start.el
-Source5:       default.el
+Source1:       https://ftp.gnu.org/gnu/emacs/emacs-%{version}.tar.xz.sig
+# generate the keyring via:
+# wget https://ftp.gnu.org/gnu/gnu-keyring.gpg
+# gpg2 --import gnu-keyring.gpg
+# gpg2 --armor --export D405AA2C862C54F17EEE6BE0E8BCD7866AFCF978 > gpgkey-D405AA2C862C54F17EEE6BE0E8BCD7866AFCF978.gpg
+Source2:       gpgkey-D405AA2C862C54F17EEE6BE0E8BCD7866AFCF978.gpg
+Source3:       emacs.desktop
+Source4:       dotemacs.el
+Source5:       site-start.el
+Source6:       default.el
 # Emacs Terminal Mode, #551949, #617355
-Source6:       emacs-terminal.desktop
-Source7:       emacs-terminal.sh
-Source8:       emacs.service
-Source9:       %{name}.appdata.xml
+Source7:       emacs-terminal.desktop
+Source8:       emacs-terminal.sh
+Source9:       emacs.service
+Source10:      %{name}.appdata.xml
 # rhbz#713600
 Patch1:        emacs-spellchecker.patch
 Patch2:        emacs-system-crypto-policies.patch
@@ -64,6 +70,8 @@ BuildRequires: libacl-devel
 BuildRequires: gtk3-devel
 BuildRequires: webkit2gtk3-devel
 
+BuildRequires: gnupg2
+
 # For lucid
 BuildRequires: Xaw3d-devel
 
@@ -173,6 +181,7 @@ Summary: Development header files for Emacs
 Development header files for Emacs.
 
 %prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q
 
 %patch1 -p1 -b .spellchecker
@@ -180,7 +189,7 @@ Development header files for Emacs.
 autoconf
 
 # We prefer our emacs.desktop file
-cp %SOURCE1 etc/emacs.desktop
+cp %SOURCE3 etc/emacs.desktop
 
 grep -v "tetris.elc" lisp/Makefile.in > lisp/Makefile.in.new \
    && mv lisp/Makefile.in.new lisp/Makefile.in
@@ -301,8 +310,8 @@ install -p -m 0755 build-nox/src/emacs %{buildroot}%{_bindir}/emacs-%{version}-n
 chmod 755 %{buildroot}%{emacs_libexecdir}/movemail
 
 mkdir -p %{buildroot}%{site_lisp}
-install -p -m 0644 %SOURCE4 %{buildroot}%{site_lisp}/site-start.el
-install -p -m 0644 %SOURCE5 %{buildroot}%{site_lisp}
+install -p -m 0644 %SOURCE5 %{buildroot}%{site_lisp}/site-start.el
+install -p -m 0644 %SOURCE6 %{buildroot}%{site_lisp}
 
 # This solves bz#474958, "update-directory-autoloads" now finally
 # works the path is different each version, so we'll generate it here
@@ -320,7 +329,7 @@ mkdir -p %{buildroot}%{site_lisp}/site-start.d
 
 # Default initialization file
 mkdir -p %{buildroot}%{_sysconfdir}/skel
-install -p -m 0644 %SOURCE3 %{buildroot}%{_sysconfdir}/skel/.emacs
+install -p -m 0644 %SOURCE4 %{buildroot}%{_sysconfdir}/skel/.emacs
 
 # Install pkgconfig file
 mkdir -p %{buildroot}/%{pkgconfig}
@@ -328,7 +337,7 @@ install -p -m 0644 emacs.pc %{buildroot}/%{pkgconfig}
 
 # Install app data
 mkdir -p %{buildroot}/%{_datadir}/appdata
-cp -a %SOURCE9 %{buildroot}/%{_datadir}/appdata
+cp -a %SOURCE10 %{buildroot}/%{_datadir}/appdata
 # Upstream ships its own appdata file, but it's quite terse.
 rm %{buildroot}/%{_datadir}/metainfo/emacs.appdata.xml
 
@@ -337,23 +346,23 @@ mkdir -p %{buildroot}%{_rpmconfigdir}/macros.d
 install -p -m 0644 macros.emacs %{buildroot}%{_rpmconfigdir}/macros.d/
 
 # Installing emacs-terminal binary
-install -p -m 755 %SOURCE7 %{buildroot}%{_bindir}/emacs-terminal
+install -p -m 755 %SOURCE8 %{buildroot}%{_bindir}/emacs-terminal
 
 # After everything is installed, remove info dir
 rm -f %{buildroot}%{_infodir}/dir
 
 # Installing service file
 mkdir -p %{buildroot}%{_userunitdir}
-install -p -m 0644 %SOURCE8 %{buildroot}%{_userunitdir}/emacs.service
+install -p -m 0644 %SOURCE9 %{buildroot}%{_userunitdir}/emacs.service
 # Emacs 26.1 installs the upstream unit file to /usr/lib64 on 64bit archs, we don't want that
 rm -f %{buildroot}/usr/lib64/systemd/user/emacs.service
 
 # Install desktop files
 mkdir -p %{buildroot}%{_datadir}/applications
 desktop-file-install --dir=%{buildroot}%{_datadir}/applications \
-                     %SOURCE1
+                     %SOURCE3
 desktop-file-install --dir=%{buildroot}%{_datadir}/applications \
-                     %SOURCE6
+                     %SOURCE7
 
 #
 # Create file lists

gpgkey-D405AA2C862C54F17EEE6BE0E8BCD7866AFCF978.gpg

@@ -0,0 +1,91 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQENBE/UA7cBCADWKKjxDivnNJhYYFcxPj/441aBG+MnoSEILupVIiIWN6RyRmiQ
+pLHi3/05VZY4ngWMr4HX0a0iGnhfmljlAzerTfY//Puz7EYrN7EBMlm/abqsELXa
+LWsxGcimRQGv0IIyZEgzmkFhu1F5e4r1BflBuqh5V6Y5s/SuA74xRvolyW2uliET
+AiYGsO3zgY8j1ky4rU0TJhxGIl89WYPD0kzHji66zx9AxdWZ+EO4XtSuvbDghnxM
+DMHLj+HDV+Ytl64arTp05WHoepAowKFpCBCPupgPk5+ss76wU5og+kG0DLBkctCL
+Eywu0M1K08j5oVBSnOIqI71/yTV3cgCMRDNHABEBAAG0H05pY29sYXMgUGV0dG9u
+IDxuaWNvQHBldHRvbi5mcj6JAU4EEwEIADgWIQQo077YUf3zq1f++TwjNYekfCB5
+EAUCXYf1oAIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRAjNYekfCB5EN+K
+B/9W2UAElDBuBqiaCQ39n9M3/MIovCYM95/0fI+ucmUWEl3nY/ShT8LUPYtTEQn4
+xXUVC5Q64nG/h1t6F/NVDIC3Jgmrv4Zz5tkVrCDL2n7NIXO1SVbGEsgndM14bM5o
+WDyT8pdIlAhJEPMfRPJOayFlzasnIfaekjiO8xIBeRmPo6arGrJc+YKPbFs7Y1G0
+9XI5U5ctKA79qVQpqr0oiX1CU7nimbUC8LlWX9CohmF8mJkC9dp2YvoYLQrJTSMe
+vik/nm7vQJ96d0OsUXyLd432JakpjWNdfg+GlMu/KCrepYfVd9jS1AgyAP5IeRKa
+j+mFmpJZKhdR748xG61fEwqwtCJOaWNvbGFzIFBldHRvbiA8bmljb2xhc0BwZXR0
+b24uZnI+iQE7BBMBAgAlAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAUCVXWB
+zgIZAQAKCRAjNYekfCB5EBwACADDMA3E8hr6NF1mcFaPgDITqg8NztMr6VePYvkh
+spuKkdGJOVerDlotHqSTUtc91Av2LXKLfmsiXqUQNpTFGIHvNIw9rSqT6m0Dxsjt
+nxliCUj5UMoQk+qadnksJLo8sTTEcA7TB2WukII7QbsRfWi/mWxDH/uspzStJ3TC
+HZJZ16rKjhtq/OvYBSrjcWKvRfpAyB4kw6OxAoVvd9wgyYYd+OlfIca6AFdAUyQA
+TMbX6wpwO83FOWpk/hDY0ECEVHf/xCefx4mIVWWwPWQVYbJq5153jl88Hgbr/Of9
+5SM6qUnilkdhP2XhF47n2qwR+kxRGzRXoUWL4LnP8MfvBldVtClOaWNvbGFzIFBl
+dHRvbiA8cGV0dG9uLm5pY29sYXNAZ21haWwuY29tPokBOAQTAQIAIgIbAwYLCQgH
+AwIGFQgCCQoLBBYCAwECHgECF4AFAlV1gcUACgkQIzWHpHwgeRAxSAf/SLhYbU35
+2JVOHO1DRLTd/FcM44g2vZb9Nd5YOn8LIfcBsWs9LM3luGn7Boiyhj7z8K2z8xCc
+c0lL8kNmWqIuMANRePlcMg2D/awgh3w6j57v0wWqJmNI3M6pahQMx9jUJ1xKyH+z
+Ig10XLxavHcy4Hg7ELLT7IfqeT+SU5Ej732iNS0ruxYjZzFQgyYgTmnaLZ5LXEYY
+KOcTJj1O/ZjENBxVgVZFgv5XZYEHB/GmmGhOP5V6g8ysd3vqw+RjoJpShbJL7mY8
+wfMcpGJAbNHUYko5Om4xF1BQCYBXcP4Vmhjj1Ko4nMZeOiLMEcdYb187+1NHCYHJ
++mPYiB/Fi3KNn7QrTmljb2xhcyBQZXR0b24gPG5pY29sYXNAZm9yZXRhZ3NwbGF0
+c2VuLnNlPokBOAQTAQIAIgIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AFAlV1
+gc4ACgkQIzWHpHwgeRABvQf/QG0arguyPqiUaAtOcWGqxfW+5GMtYXD+Oz8r0S1B
+4Y1M7fQCaWjb/cvFEtX5mRpyuBwOmhJar8L94ikKCOa/wLd2cwplF0S+0Kup2xEC
+w+EIPPJrQar0t7tq5JC5Ujhi3txzaLBylJBEBf/mNpb0div3Maaibbt1n+/KHLeg
+ST10WRnI//CRM4b/ncCS3pNisO0F+y4VQ5wPar8DOIj/rNC1CsvrwehUxZ1O43OC
+qNpRu2PefaPAnyAL+sa3YWdAXYlQJJH6k9qrPRgMvciCf3BCjlhjyP19e3tMxO4T
+ReGD+yB5Em6XoTSOm4TGPbUdkjxayttPjWG0M4eO3iQ4sbQxTmljb2xhcyBQZXR0
+b24gPG5pY29sYXMucGV0dG9uQHdvbHRlcnNrbHV3ZXIuY29tPokBTgQTAQgAOBYh
+BCjTvthR/fOrV/75PCM1h6R8IHkQBQJcRxtiAhsDBQsJCAcCBhUKCQgLAgQWAgMB
+Ah4BAheAAAoJECM1h6R8IHkQNtMH/jvyD01ilH3x7cqG0l7O+3r/K9CXm1T0emrE
+2N4bwfrqbLn4wIVcVWl15RJglvmH11tRb3EcM6sm0S3MGkoQ5g3oSW9YfCfZJEvJ
++qgD4ci5ShxvOiwBAz7ffKShjHJi9tcvhpNV4hPM3mlYM9daqVHjegSCNNIvd/YF
+d0EtgcAmfT3Xgmp6aw2u3OD9ly87H31wfJGR5hvOix+gFNjImkS1qj0yFGHQDrod
+PCZxzZJipdaEf7lhFkn7S3VPoWxqiHFO055ibMNMrtl06h4BIh303WDCUCR3v40j
+Y+3hnuDvg1tGNnx2CxbNSkMO+ClJ9l2Ih/PmNdNKe2J6sPlOLXu5AQ0ET9QDtwEI
+AOrMjbdYIeCHcXHuzmE32loeGzn5EOkZwawFTNa+M/iRlSZK/29S5LN9GFyKSDuZ
+EkG0EFD4yToTFOqA+4vnjZ0KXTXbBU4YK/9GATfZzoeCWZqgqT0ptjOQeTAcvj6N
+fU2I2RRG7sYuD+X5ou9t4TVHOXyKUeeUcshUBwpy+87CK+s+gPKmE1lA4Y0gcLN2
+Ux7NBDzW4tIm/2dlelWquKWDr1rGIPdmjYSyWj58u2m/C61w/YOrGrP8DTCEImlF
+0neglMnGkPYvQWRf0XNbqVDt7PNc9jAPLNBVAqIsgr0c7vR0snhpmpsztBS6FVpq
+9okRTQ3/t8fJ8Po0GRqz8LsAEQEAAYkBPAQYAQgAJgIbDBYhBCjTvthR/fOrV/75
+PCM1h6R8IHkQBQJeEvneBQkSAV0nAAoJECM1h6R8IHkQFsgH/RLzB1eKjKR7cJFC
+bBgPqeoaEtnq6RoT36N1qgzxX7LJ+EDDpEzulX+xQofniZYOk4BuMZlJ7KtimH1v
+JHFbyI/RvFrZGycLFFEbl+CgSccTJHPUmKvLjzmB1MkYzOV+U8geloy8opzU2c5r
+5Mf/8BbKL5NsYyaFizA4CO28Zdyl3pVfFnd2mSeC1plCYmkgwIGekHpkD+R7ljuy
+xO/W0G9yTf8dxfD3dggIOLPot6fPUtwpASWVGFeukDm3fG/tLtN0DI5iYUPlW3Y2
+5khiu1xWhdlEW/N6R/2xrpMDb3vM5fUTacfDyujmfab6nK6yUnKQrYOOjvEziSBN
+vIL9ZQ+5AQ0EWkPBcgEIANfGaLvBesnttz9fhsHr8kUoeHZozZ3n/Y59u5waPiyj
+8HA+Z9gl4NQZ72Xxd8FzPBRHd00TuhjBZQEmkslmRYrQiXpa8VPt+nMG5v1tTy+T
+KZv9HWxQ6ExwezKM9Lwx7y3Q/GS/wj0XVO2JFBk/Pp3L/7P0qEWGo2o6TJLuXg+J
+6f+cwXL3ptpQKS6QsUgL2IQlFGc7Wv6XFV2sbX2H0faxuKZNLrN1EoURcjbP7okQ
+Mf/CB5P5qgTo+y7331p0c9Tr/RVQ3AO7ZcX89Kz0OuSuC+hxco35iWVs2LuhBMQ2
+v3SH6IrEq28GB9VpQthYBP8eWynLoZPJKrl6B7D0GDEAEQEAAYkCWwQYAQgAJgIb
+AhYhBCjTvthR/fOrV/75PCM1h6R8IHkQBQJeEvntBQkHkZ97ASnAXSAEGQECAAYF
+AlpDwXIACgkQ6LzXhmr8+XjSAAf/SgD/YLy7amSKQ94ELLc+HpNACnat4gsYgIP4
+zemE5YOgRxWXMYlwtX4DliEnpCcRtYPfGoYXVxTr33rqJ+uYhjBmzCs6P+zG+bZq
+5CC+71GeRaXeTtFUGmULe9VZEu7Oh4nEgqdteI3O8dRdpPI5rxyODktHf2oT1ICR
+w//QSt1kYE8GFPKd61QxB5o+bESswDe432DmLruEOop4EzL5hDvwLBMlHvbUAnit
+tyifU8RYRARZT39TPsnVTNjKSOuwfk3u9z4p4Fsna14EgFoHad7k5M8ff801ZIoD
+1DGRPEJSY3oKf7zoZnHH1YfDLQpQTVZmyprXzfmC2r9XuC1xIQkQIzWHpHwgeRDf
+Hwf/W/eZ+dDWkM7texQCFqxQlr/aihDJDIPNLU7NLVSqG/bLWaDL35vR9OoYyG6m
+4VQuqvgWeIydZE/rhaQZ2oriTvUDzXg4hqJe5fILJU6MY/JdJQqAQ5O0alUK0pL2
+Lh+lcvchu9DMfNwtzvZXEoXjDhQmAYww+XuX/LQoSGbhyX+QRmD2vMYaC3Of6Vfj
+XT7JEXPhtdMewdUwr/YHvD/RTgdFgGpb4AqfD7oG8ihLFgNMDrhA/POZoojGqIQS
+8gjkJhwsbi/lKCAr+n4a42CgRmb2HSGuX329meh2O9nfwLFSibc4Eaw9goWeGO8n
+2Fx5qDwmgMd8ZKJbd4/tC/PCdrkBDQRaQ8mQAQgAplV5IJPmiFZqv/4+M0hN3EIh
+5+ibmlvvi7bvkfiU/LaSHpd1LX+AoY1gWXetZmj4m+Buu3CqZRTT7vyNV0BH7Es6
+FEd9H5bVbVeKKrCiNqVG8DKFeOd2q6niKpnB5a1dLeoUbxn+JggErXXr9Bevnikv
+dD5C63mDdIMJfVKzJrNnRhMRfizsvAITFdnNTHC2l8j/GxHSp2nVn67iCvBL7fG/
+SR1ySKtejSQH7muuXJXcVggCunVEM1InRj68gcg4b0kZ1beqKkFCbVadezbIEQRk
+ULoM0ONXR7VkLh9oX78jjsp30kmMV6n7YXkdqaCX9UwT69Zcug6RSODt65CzAQAR
+AQABiQE8BBgBCAAmAhsgFiEEKNO+2FH986tX/vk8IzWHpHwgeRAFAl4S+fYFCQeR
+l2YACgkQIzWHpHwgeRCgrAf9Gt27U7I1WYvszmIaVXwC3GzQvjPbDl17uL00xe90
+IFe/wCzSXVrO0eWESEBlm2IqCux6KHapFoURjYTrmHXfQqJXV9X6uJc+JVD3hajx
+1gpPa26aPE5REjaPBnQQUkoJyAI8Xtx0AEULvVvtYsBJdqdQtQNbMtcU3oU/FPZV
+CT6KjrRZy4G+Z50wfH9+wed59eb4Pa804Ngc24KKdVjqkcGS3TcovMkIqtbdMlkV
+72mJERjP6ETPJIjV3efxp3zWHHouKxSK0X6RJ7iuIrNgim3P7lqALLq0LTg5gcWJ
+WigRa6zu3LAcwYAofO3bwCMOFmO6vaed/N45pUSF5o975A==
+=/cmd
+-----END PGP PUBLIC KEY BLOCK-----

sources

@@ -1 +1,2 @@
 SHA512 (emacs-26.3.tar.xz) = 4d5a4319253afb081e105a3697eb6eeb8d8a0da18cd41346e376ca5af1e180a26e641f76c64fad1b0253168f14a511f0a4d9d4141524fb1cf4d04f25b05a76e9
+SHA512 (emacs-26.3.tar.xz.sig) = c7cd4ae7dc2c14f705c48ae120dc85f32cb254b99dc192aa55c08af7f71bed31836ca8e8522731a46b6e16cca684b9823b4b90ae3a358dc2f8bcac7c5741847e