Verify source signature

.gitignore

@@ -15,3 +15,4 @@
 /pcre2-10.32.tar.bz2
 /pcre2-10.33-RC1.tar.bz2
 /pcre2-10.33.tar.bz2
+/pcre2-10.33.tar.bz2.sig

Public-Key

@@ -0,0 +1,39 @@
+This is Philip Hazel's public GPG key.
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1.2.0 (SunOS)
+
+mQEMBD2z9g0BCACpGWJ4K2mjR6K9nv7/K+HLjJtDO0E0ckudeNjg2JvnuUU7m1bK
+87nSklHTSMNiqmuVU5hFAuGiMGBMj31GPpce3VbABdm6TmAJB8ZndvJXyf8lC7Ko
+5iZX/gCYU6817UI5pFwYR3MTIUSSxTGqk1y62pYLKUq9keSU5Cew4q1KMwl46Bn3
+SwlfQeST4WGwL2w9b8mWNltBBY23bgzwYu7vFBD4GQnfzJsvMC9lj825wob2nKy5
+CL4bY6tiYUqALzDYaIVCBqJ1Ky1rpPzRcDZUeeF8Ta3njh18Y0KzPEj+Xu5Ksexg
+7LUy/2wFzVRtJgqvAFZo43KIOptsj/63zxJjAAkBAbQhUGhpbGlwIEhhemVsIDxw
+aDEwQGN1cy5jYW0uYWMudWs+iQEyBBMBAgAcBQI9s/YNAhsDBAsHAwIDFQIDAxYC
+AQIeAQIXgAAKCRCXZuCE+w9D2JbrCACBHrxybV+9t3TGR3+uk2QnUuct90a+udcB
+cbWgKQgX345ZgwIfyoPKAbG84mN/+SFUN/Ie4ZHZxVsbN//l2P/Osx0CNQBfem4e
+HUWegkFGzC5DxQhN5nsJ/GR6pnxG1l/DbNhupNY73oTajWFdi7K8jYfamU/zS/Da
+VCwUKxWtGqyEqOxvbdqcjsnTMmLVfXtefx7CbKyhaClPP8Pe4FL+eqyfHJF7uywK
+VWlUNmQa4E+ZAK8tkoK9sZAc0ImWwZMumiKZDEpr2D8Ty+Gg2umTS2OMIcbY8QF1
+r6DeubFabdPIe1kn0BGXtdAurhbdJCIbcAEQS0eEeWC4A4LiDprntB1QaGlsaXAg
+SGF6ZWwgPHBoMTBAY2FtLmFjLnVrPokBMgQTAQIAHAUCPbaC8QIbAwQLBwMCAxUC
+AwMWAgECHgECF4AACgkQl2bghPsPQ9ho5Qf+I2HUhZeXOUneeqSa+cITsIELJMrZ
+UWcydY1z+L68yOqURVHB1jF4aC6QSlq0pLjozwF6KfZO5AfN9FvkRQ0DzCEXH48W
+OXqzbjzgNxRMdaP5+49Axl0UQuhupGJg66T4FiGnSVBhK8kTURPCSpLLgkCJqNcY
+t5zuNwk3e7JvleT59EVpk/kw3a5p9oeKYBln57pHwq+HdPLSCdkedQBKdsbNrazy
+qduYEXen4ogsIoTpA9lLH1Xsi9wL+soLAlWXtl/GNa1h7Jpwn41zp1hqIZe1ebIM
+dSGbtMEaGJlqgDauYJSl0lkVgaPtZCTmfAf57TsGfD0IckN2XNGLuwb6DLkBCwQ9
+s/eJAQgAuXq2I1VTDB108O0NAB6QKfA2gMHafoj3OcwEUHnJgXrHqjYOpFr0r5lC
+YjwMRMvHO7r4jgtwKjGACI/1IE2hiGXkKFOWZFkCf7Qjoi13a78myC/VRwe4uEIs
+xdz++w8WfzuC1sYw8d/rlybVzHTfTsKfmFOQamuyLCTm3Kdx/wZyGM7JMmgVn2zF
+HWasdID0n7QJFZGR3yEfqis5zq1t3w28AaXlTZG7QtFj9V0cWIhZRjjjVe1biPA8
+Btp+eFkmcat79N9hHbiEiAY3u2qmQCcn1fiBBC0Og09cY4dRyX0/bXUo4n8lHysp
+JcL/sIZ7Ahd1LOfg9h+yQfoaey78LQAGKYkBHwQYAQIACQUCPbP3iQIbDAAKCRCX
+ZuCE+w9D2P0BCACXsbwFerd4wlnt8PxxQlRGXi1t4EGBFf2zSdgQvIXJ3ntPzcDU
++8hnIWQJhCTZ3PfVmoqB6ZOM1RWI/IcP6b4qVb6vJGI/VxRICraAczw+4bdFxFiB
+n2+SyD4MxZg8t66FcH3fHugQqsApHTmtKmahv5BXB+0dPmP/BRUmzxYUv8hdnhHl
+91S4R4BDu84DvKYyJK9jlqUl06pvqXrBSNsbWKgAJnmnDe8FaLUk+p0IXeMSavUn
+T5E26MRIioxAz/G4FZI8IdO92GHTz82O7/mQMhveAdpspDvpV3M4wnldU425GlxZ
+nmq1bbjAU4QVuIS9nkk2GrGx5+N6cYMy8JqG
+=EHsz
+-----END PGP PUBLIC KEY BLOCK-----

pcre2.spec

@@ -46,7 +46,9 @@ Summary:    Perl-compatible regular expression library
 # testdata:                             Public Domain
 License:    BSD
 URL:        http://www.pcre.org/
-Source:     ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/%{?rcversion:Testing/}%{name}-%{myversion}.tar.bz2
+Source0:    ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/%{?rcversion:Testing/}%{name}-%{myversion}.tar.bz2
+Source1:    ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/%{?rcversion:Testing/}%{name}-%{myversion}.tar.bz2.sig
+Source2:    https://ftp.pcre.org/pub/pcre/Public-Key
 # Do no set RPATH if libdir is not /usr/lib
 Patch0:     pcre2-10.10-Fix-multilib.patch
 # Validate number of capturing parentheses, in upstream after 10.33
@@ -90,6 +92,7 @@ BuildRequires:  autoconf
 BuildRequires:  automake
 BuildRequires:  coreutils
 BuildRequires:  gcc
+BuildRequires:  gnupg2
 BuildRequires:  libtool
 BuildRequires:  make
 %if %{with pcre2_enables_readline}
@@ -160,6 +163,7 @@ Requires:   %{name}%{_isa} = %{version}-%{release}
 Utilities demonstrating PCRE2 capabilities like pcre2grep or pcre2test.
 
 %prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q -n %{name}-%{myversion}
 %patch0 -p1
 %patch1 -p1

sources

@@ -1 +1,2 @@
 SHA512 (pcre2-10.33.tar.bz2) = c6aa52cdbb0c906b02e9a9f255697a1b9b99d9c7dccdaa484ffdb04fe3582d232ba3cb3c421d6df589a387b415dedb0817f58ec5391488b25b4e7bd9da6bab8f
+SHA512 (pcre2-10.33.tar.bz2.sig) = e5bf3e7d6df4f5f9d2975b1cf97d47d82863637e9caeeb5677c81eba488063f4d9a161acf5738e104c3f71f2cef10aa9639601080f0fd60ec41dfbbc3c99e5dd