verify upstream signatures

.gitignore

@@ -1 +1,2 @@
 /ncurses-6.1-20190803.tgz
+/ncurses-6.1-20190803.tgz.asc

dickey-invisible-island.txt

@@ -0,0 +1,32 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.4.12 (GNU/Linux)
+
+mQGiBD/4r7IRBADFuacEqf9fye+NQSm7xjNP705aq75VrUd2hJyPmSiFUIyQEfc4
+4GQXGdFg+/Apq4iq/50/8pR8YXOKwP5OE69emEp7IxjST41orGUk5ZwcnlSkaruN
+WLTe/lN3e0oOIVbYig1lUbU5IxZu03KfNg2DZ9JiZdNBlzlqx1+oFlWFLwCg3awg
+EfOUfbe4kVxNrsnxaCJYJ38EAMRVyUOfhkm9l0YuiC4ebOHrdmn9jFVW+XZPZDeb
+8DcyTBNrgvVTnEmrNzVJgOyZIW+uraBVitak+No1kwXvC/i0kZEzYqfG87EdJSfe
+OV7axIRisiTrcbZdRJ3CBDtGvLqJ9OuGFHPQmntnZfhiwJTR79hepndEQYyV5eQb
+oQ+aA/0bI+/odyRDefc9HF1EhOcz8E76QP+VlvUfIDUJrmwv/3gLZ968HACOe0DE
++bcUockLJxoNwQFwCQPjm5S2+Ba2uY4hRhOA+MResZWlPouoosay2ADfiU7pdBCx
+nbcLAuezgnZg4jcXvLl1QiAihxaEI2jqgZBnnierWzqRzRZM4LQrVGhvbWFzIERp
+Y2tleSA8ZGlja2V5QGludmlzaWJsZS1pc2xhbmQubmV0PokBIgQQAQIADAUCTZ7Q
+ZQUDABJ1AAAKCRCXELibyletfLKrB/sEVLsrCjFTwevbgKSzgCwLf6EhkifktlFB
+w7/4n9Do1n7/LpgjdMH06YD9RjfSap4tdvEiHpzkpUtCGuzkGc/u4qTMdnWNgFhh
+oHLhjVh4u72B/NtlgrpDEDrn1bnuZpzWxru4uDJGSgL00jV5b3kf1P07eQaguMC6
+VeuzFmukv8LiDFhZcCl492nMZxz7vSRgSi8Ce+/Oc4Q+XTWmF5ZMKd5xNLjBdj2P
+zOABHmDP1aA75grY30vVViPJve+W0h7A3PP9GuugNDkqmdCvTxYeMqiF6Vtv19/N
+EW4jIvmN7GLOBo5F4RYcE9Fv4lV0xXlfpYwCqY7iAx9jyXgCbKXxiF4EExECAB4F
+Aj/4r7ICGwMGCwkIBwMCAxUCAwMWAgECHgECF4AACgkQcCNT4Pfkjtt6MQCeKZHo
+SgACIQk95rWefzSLULcpjxoAnjVet8e1/1indwT/wDDnObDDfM2UiEYEExECAAYF
+AlZ3yw8ACgkQXd+Pt2iOMaZ0bACfVCFh+GzDCNXmZ3RcmDKjJxW7v4YAn0ApCgiS
+8tZC2X2ZOs84WwJBIF7vuQENBD/4r7QQBACNOXUR5S3kRSry2IYGr4q0WjdPEh0k
+oG1UVDhu0RN0Xbd2RnWjXrjYaYXskmCfo8pRwkNSUeFQ7ggRykcAECJTgfB6haHz
+JP/JoD0BepEpwmkxDlsQaiigcEiDRSHxqEbpDVwfOCwY5o4r1jMVK9IhFevIyWuH
+WghPO/ASRdF85wADBwP+JFo20ZhpLTkXBppW+bQR7GGHDYnNJpE/o9jev8EaaA9U
+b1ST2G6T5iT+l1b09rcpGPfsA0ray9/AfH0DTvsxr0ai6ln+uM/TVY7S6vy3MLsq
+yoJ6n2bfcr2R0B4lnRR34DCycATL9DVdmKf+NRTkvWXOSjTXQtdj0Kp2uYJeFqqI
+SQQYEQIACQUCP/ivtAIbDAAKCRBwI1Pg9+SO266eAKDZ6zjUkRhpqsJxP6AWnIzR
+YKoBTwCfcvSmQ7jC1nxJ6OkdrtZJH0znjF0=
+=0vnF
+-----END PGP PUBLIC KEY BLOCK-----

ncurses.spec

@@ -6,12 +6,14 @@ Release: 11.%{revision}%{?dist}
 License: MIT
 URL: https://invisible-island.net/ncurses/ncurses.html
 Source0: https://invisible-mirror.net/archives/ncurses/current/ncurses-%{version}-%{revision}.tgz
+Source1: https://invisible-mirror.net/archives/ncurses/current/ncurses-%{version}-%{revision}.tgz.asc
+Source2: https://invisible-island.net/public/dickey-invisible-island.txt
 
 Patch8: ncurses-config.patch
 Patch9: ncurses-libs.patch
 Patch11: ncurses-urxvt.patch
 Patch12: ncurses-kbs.patch
-BuildRequires: gcc gcc-c++ gpm-devel pkgconfig
+BuildRequires: gcc gcc-c++ gpm-devel pkgconfig gnupg2
 
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 
@@ -111,6 +113,8 @@ Requires: %{name}-devel%{?_isa} = %{version}-%{release}
 The ncurses-static package includes static libraries of the ncurses library.
 
 %prep
+%{gpgverify} --keyring=%{SOURCE2} --signature=%{SOURCE1} --data=%{SOURCE0}
+
 %setup -q -n %{name}-%{version}-%{revision}
 
 %patch8 -p1 -b .config

sources

@@ -1 +1,2 @@
 SHA512 (ncurses-6.1-20190803.tgz) = a7aff48283ecec2ef3bf4441a0c3bdf3e2a89efa38edba5a1447d0978db4b72ff8ec6bb61e02eb368930771035bb3a3730837d9a22312ad2b6c856300c604887
+SHA512 (ncurses-6.1-20190803.tgz.asc) = 088737e727e1e7320e94c9ffda4bd214300eea64b793b26aec174cc2405fb7de861ba5f153b70d8c97236d6ce45251bb048b3a0e50b53562febf6ce3ee1fe8aa