Always check the signature of the tarball

.gitignore

@@ -30,3 +30,5 @@ tevent-0.9.8.tar.gz
 /tevent-0.10.0.tar.gz
 /tevent-0.10.1.tar.gz
 /tevent-0.10.2.tar.gz
+/tevent.keyring
+/tevent-0.10.1.tar.asc

libtevent.spec

@@ -10,7 +10,10 @@ Release: 1%{?dist}
 Summary: The tevent library
 License: LGPLv3+
 URL: http://tevent.samba.org/
-Source: http://samba.org/ftp/tevent/tevent-%{version}.tar.gz
+Source0: http://samba.org/ftp/tevent/tevent-%{version}.tar.gz
+Source1: http://samba.org/ftp/tevent/tevent-%{version}.tar.asc
+# gpg2 --no-default-keyring --keyring ./tevent.keyring --recv-keys 9147A339719518EE9011BCB54793916113084025
+Source2: tevent.keyring
 
 # Patches
 Patch0001: 0003-wafsamba-Fix-few-SyntaxWarnings-caused-by-regular-ex.patch
@@ -20,6 +23,7 @@ BuildRequires: libtalloc-devel >= %{talloc_version}
 BuildRequires: doxygen
 BuildRequires: docbook-style-xsl
 BuildRequires: libxslt
+BuildRequires: gnupg2
 %if 0%{?with_python3}
 BuildRequires: python3-devel
 BuildRequires: python3-talloc-devel >= %{talloc_version}
@@ -59,6 +63,7 @@ Python 3 bindings for libtevent
 %autosetup -n tevent-%{version} -p1
 
 %build
+zcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} -
 %configure --disable-rpath \
            --bundled-libraries=NONE \
            --builtin-libraries=replace

sources

@@ -1 +1,3 @@
-SHA512 (tevent-0.10.2.tar.gz) = 1da8f28898f35daab515892b880d1de601062cc3e2b2570cd62e6913df17b0195a05acb7b484c628cddc0eb8b0cde893105ede3feb32bc5764e7d25684f332ba
+SHA512 (tevent.keyring) = 7dbdf9e20ee0c7d38ea7d475054792313666a81b496f7fef9218e20d41355a4c2fd61e273cfd527dee24637368eda0c2456f98b386cbcd4901322ea9a5e8fb1d
+SHA512 (tevent-0.10.1.tar.asc) = 9dacdcfac9cd451813211af4103dc4facc70e19bbf6269467d2bf7780ba72e7c079ccae272e5188abd673f24d6a6c617f92170d28f2dd473e34cfd47a80f02ae
+SHA512 (tevent-0.10.1.tar.gz) = 204295672618b8d720743f1d388f9a2d591805c8ef36cdb7e9ae3aa824bc288dab64b336e6a5f5babe6214a993b1ad3d0faa9d8ec2b30a9b927b3ea68bc5fd52