From 5ab927249593cf18e7277c74fd87b233a5f8f188 Mon Sep 17 00:00:00 2001
From: Michael Catanzaro <mcatanzaro@gnome.org>
Date: Fri, 14 May 2021 14:19:21 -0500
Subject: [PATCH] Add GPG verification of source tarball

---
 .gitignore                                       |   1 +
 ...-5AA3BC334FD7E3369E7C77B291C559DBE4C9123B.gpg | Bin 0 -> 1905 bytes
 libwpe.spec                                      |  12 +++++++++++-
 sources                                          |   1 +
 4 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 gpgkey-5AA3BC334FD7E3369E7C77B291C559DBE4C9123B.gpg

diff --git a/.gitignore b/.gitignore
index eca4808..a2be982 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,4 @@
 /libwpe-1.9.90.tar.xz
 /libwpe-1.9.91.tar.xz
 /libwpe-1.10.0.tar.xz
+/libwpe-1.10.0.tar.xz.asc
diff --git a/gpgkey-5AA3BC334FD7E3369E7C77B291C559DBE4C9123B.gpg b/gpgkey-5AA3BC334FD7E3369E7C77B291C559DBE4C9123B.gpg
new file mode 100644
index 0000000000000000000000000000000000000000..b7add3ac53b7725b6af25037d24a97e4fcedbd2c
GIT binary patch
literal 1905
zcmb8wX*Ao38V2xxBGK5|)DlEhBDL@P5?ksL#9EB0tqn5v(9kL()~cm<thH28wUuIw
zrA4@7ucfxCifTtKHP;eEskL0U=iGblIrq$m`TCsa!|%)cy!oJ~5HsTw=tT&?*gNi@
zjd3+wk@IT|JZ~>+Ibs<S_=Mfrv5}%G0?QLrxUv6^Yg`_MeHw6u70Ny|++2vkHpSVl
ztiE$Fbmi%#%=+#)VJq7*o@nepHKH?Ern<94TKE#E#C`r_>dkxWD_OHGG?k6cKj2!N
zGp~}{r~1%BeXQ`&IA^Qh^OKH%C$X2D9b5npF&3E|ZI=)~kiH6wf&eW`obD3KxQA>T
z*ROJs+Z+AGFiD`OgG!J#wPHK7&2n9B$0LQOklL%hxT$>^kt5I^3MeoL=?w+Tl2Szx
zEW=|h6c{1kB^;s|D(g*63&_!K?N!|=*SU{56rz_Ojc{5EnUmn+oOj>gPS1TvI;ywi
z%0NlR+rtJ}kvh^wX99+6Z^i4JwWVC<=sk^?@SnI)@V`~BhAzO0j;t$NIUB1r^L;g|
zw@%ClkdTB%;aqhyTt{#zj0WabNpo|lcF*WKwmOy|AEY!-Im+&DTwzVziN&j=22&rz
z>bsmuf^*%VPA6D;-+S$EAj4@m<AROn(S&80vBt}mifh+QnhbDW6yKf_GRn56ib9G&
zd67`Y#E?)*5K20jL<tEZ69Z&Wdc?C5k!*C9kRrTDp5F_KK@@L;BpQV8A}3$~7Quio
zgTR6@P%aMGIX0*OCkKoRiU6~L00bK1T-vT?Grg!;L=9`m=(|3<G{}pEg5BF<$WRWX
z_KF9<$pQaQZr}nGo2x~@i7%H|rQQg**q~{(A2nr{fr4`_`|x7@{DQwv^WYCnHkJGy
zkoubB|J1KX{LVG<^(F@R5*0mz0u7R4ziV;-)q;gVe+}&Y|KMycpcp6gtnT3V-F`9r
zI8tFJk@D864GR>ZQok_?*-mxI{80bs<0P9p6JGXK2+#McfWv{e^Dpzo?btWRPRlf1
z{^^(fRqpfDhi;~kcGZAGu5SP9+<538y;AA!0mv#-?^`HFYP3P_aaJL}JvwA5x>&(B
zCxMfyuAj9fX3`W+3sKV&60A#H=}|JPF+8x$YV?eQTxEx8b#_DENp>{{O;w@Z#}!N!
z$?q381sRJ**F`>$UoWeZvJRGHKA)@zwletC{&0V#rWu@28+txxDB7j|aPo_R!30iK
zRM*HcORikb_;hkg$zlxdDI}_XeOStf^lKIn{9?N)F>q?dLqDUIQr%fE$kS0Xd1b@A
zzOn`h`y!hDfZKf!XSK%s*c$I>YVNw(JsLe(xQs2`+EPvXF-IoOACuniNwA?ijjbyY
zM_JLk7OfUslh$UL6UZ4p)0XnUe3ncGDs_UfD=rI{(D!~w{>5+9NB1#VR^TwnL0l>O
zki|Zo?B@Q=OzVaW!E|kR;s-t?xIrj@5J;7_er*$kv}P9I5iR{?$kK8<KN|@*7rNjV
zM3JfTPt-iNK?z%5d?7YbSYu#hZ7M2x?L`*9sOajoM}stOnqOBSB5G03*%a6s={bfx
z0Qv}e+v}`|G@oFVAp&E?GhUxca~kRHRDI%Wb@SfH;Gpm&_kF{Pie?#(hK0?%Pw1xv
zk_i2{f1%QxB1-6wY*0hZY~~G15a+tL%*v6o02}*-Q`#)(99~_aN~5*5`?kP6zWHaB
z8pDsJbYA@fGgdjEJU+Sa|27hv2;2Uu%R9bXx7Gpw^|!h4LPVmLxvEQ=sZ%}=byPm(
z=M$w&fiJiYE8Y$rz9TcpdBMq|!D)26rm6mbH}Vsf9~2d#Zv)XD`CP)IsD0R(e1cJ3
zT102A<D<D><#G>sHXNfP<K~%7ygH&YS&@sS&0n#%TkUg&EJA-!cLHucO19Ml*9oL3
zsEp;bLk9JeGu{t?a6Ro6&7LCoaGPTMLH4kkS)u**yIZ!rK~iFi@;O0CCovJ==Vbca
zRpa!pmnBMo4|CqUKPFyjG4WBHN*zqLzd*+r$m3@0eMzHPVe_)W;Gu{L%B+Jrtyd&6
zi2{$KxS<o%Z-?0VO7|+4kEgh)2kXD3(~e5su;1SJc8RSmE!MOY;Ap8MMKL57C)9X0
zXgNXop2f>ei2E`RyX-|VM7z5OeevJ8Jvxh}ZUM^E^vp2bwO-~P;t|%>&#<bgwNp1N
z)VP*#$UguN@Ty^cu6mJJoe+$0TYyzLhJVzJMoZ>#D8HOjj1`x?W2hV|c)_QOCW5ZA
zn|B<j{{+5&ZFt#-i~DB`jv+1AY=OR^v*aDYv~}xq7VwTKt82S+Fjld*9wWB6gS=Y~
z-!^w3Y{u$J-r_(nJ4j-w3u4U6*|A$m<`AKaV1NS({`ap0i*Wz%7P_>YZDB>x-c+jP
m<Iu^%u(4J~8kCOz<t#-_{|5NSG@svj<siu0AmIeh7Wx+i!(M*?

literal 0
HcmV?d00001

diff --git a/libwpe.spec b/libwpe.spec
index 2f846f0..80413fa 100644
--- a/libwpe.spec
+++ b/libwpe.spec
@@ -1,12 +1,18 @@
 Name:           libwpe
 Version:        1.10.0
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        General-purpose library for the WPE-flavored port of WebKit
 License:        BSD
 URL:            https://github.com/WebPlatformForEmbedded/%{name}
 Source0:        https://github.com/WebPlatformForEmbedded/libwpe/releases/download/%{version}/%{name}-%{version}.tar.xz
+Source1:        https://github.com/WebPlatformForEmbedded/libwpe/releases/download/%{version}/%{name}-%{version}.tar.xz.asc
+# Created from https://keys.openpgp.org/vks/v1/by-fingerprint/5AA3BC334FD7E3369E7C77B291C559DBE4C9123B
+# $ gpg --import 5AA3BC334FD7E3369E7C77B291C559DBE4C9123B.asc
+# $ gpg2 --export --export-options export-minimal 5AA3BC334FD7E3369E7C77B291C559DBE4C9123B > gpgkey-5AA3BC334FD7E3369E7C77B291C559DBE4C9123B.gpg
+Source2:        gpgkey-5AA3BC334FD7E3369E7C77B291C559DBE4C9123B.gpg
 
 BuildRequires:  gcc-c++
+BuildRequires:  gnupg2
 BuildRequires:  meson
 BuildRequires:  pkgconfig(egl)
 BuildRequires:  pkgconfig(xkbcommon)
@@ -26,6 +32,7 @@ The %{name}-devel package contains libraries, build data, and header
 files for developing applications that use %{name}.
 
 %prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %autosetup -p1 -n libwpe-%{version}
 
 %build
@@ -47,6 +54,9 @@ files for developing applications that use %{name}.
 %{_libdir}/pkgconfig/wpe-1.0.pc
 
 %changelog
+* Fri Mar 26 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 1.10.0-2
+- Add GPG verification of source tarball
+
 * Fri Mar 26 2021 Michael Catanzaro <mcatanzaro@redhat.com> - 1.10.0-1
 - Update to 1.10.0
 
diff --git a/sources b/sources
index 99531c1..6067191 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 SHA512 (libwpe-1.10.0.tar.xz) = b5634dd71cca70eb960f3c045ad109346ab6ce6b01aa8c8bc8f326d232eb16ac1600757896a4b99720af3c77084351ea4f69e2e2c81b9c32cc8bc12a5c66ba3c
+SHA512 (libwpe-1.10.0.tar.xz.asc) = 8fe0b1523805745a5874c14e11b799ef7ce003052b1985c641ec3915d959c3601cc83de830e9334d5355779412ccb84c8cc3af538324e4ce950c7e857ee371f6