Verify upstream source signatures

Per the packaging guidelines¹.

While updating the git ignore rules, anchor the patterns to the
top-level and ignore expanded source directories.

¹ https://docs.fedoraproject.org/en-US/packaging-guidelines/#_verifying_signatures

.gitignore

@@ -1,2 +1,3 @@
-Mail-SpamAssassin-*.tar.bz2
+/Mail-SpamAssassin-*/
-Mail-SpamAssassin-rules-*.tgz
+/Mail-SpamAssassin-*.tar.bz2*
+/Mail-SpamAssassin-rules-*.tgz*

KEYS

@@ -0,0 +1,229 @@
+PREFACE: This file lives at https://spamassassin.apache.org/KEYS and 
+https://www.apache.org/dist/spamassassin/KEYS
+
+
+This file contains the GPG keys which Apache SpamAssassin's release and 
+update distributions are signed with.
+
+Please don't use these keys for email. They are only used for code signing.
+
+Please realize that this file itself, or the public key servers may be
+compromised.  You are encouraged to validate the authenticity of this key in an
+out-of-band manner.  For information about our validation and signing policies,
+please read http://httpd.apache.org/dev/verification.html .
+
+The following key is used to sign releases after, and including SA 3.3.0:
+
+pub   4096R/F7D39814 2009-12-02
+      Key fingerprint = D809 9BC7 9E17 D7E4 9BC2  1E31 FDE5 2F40 F7D3 9814
+uid                  SpamAssassin Project Management Committee <private@spamassassin.apache.org>
+uid                  SpamAssassin Signing Key (Code Signing Key, replacement for 1024D/265FA05B) <dev@spamassassin.apache.org>
+sub   4096R/7B3265A5 2009-12-02
+
+The PUBLIC KEY BLOCK Follows. [1]
+
+NOTE: The following key was used to sign releases before that point, but
+      will NEVER be used to sign later releases:
+
+      pub   1024D/265FA05B 2003-06-09
+            Key fingerprint = 26C9 00A4 6DD4 0CD5 AD24  F6D7 DEE0 1987 265F A05B
+      uid                  SpamAssassin Signing Key <release@spamassassin.org>
+      sub   1024D/FC51569B 2003-08-21
+
+The following key is used to sign rule updates:
+
+pub   4096R/5244EC45 2005-12-20
+      Key fingerprint = 5E54 1DC9 59CB 8BAC 7C78  DFDC 4056 A61A 5244 EC45
+uid                  updates.spamassassin.org Signing Key <release@spamassassin.org>
+sub   4096R/24F434CE 2005-12-20
+
+The PUBLIC KEY BLOCK Follows. [2]
+
+
+[1]
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v2.0.13 (FreeBSD)
+
+mQGiBD7k/bIRBADPcxP8CSNsr7zIH/UQPCJORDwmgUSDmnJmA+qDA6pYVHuaZ2lo
+TZRjVX1CkeSIXmyxA3bdmokhz6UW/B/g/We8mUwdpC0jJSSKHNsP1tyNzjq0NtWq
+N92WRmUe8eTF9MqfDk9FTEDl2WC2ma8vIeNqtjSbPy85yB2HkV2qfDYb3wCgvQEk
+R8nD2C6YhBqHWuxE55F5hVkD+wSz6PA7f7C5cY9/icOjpzkGcqMNevlWLlLMLGgN
+TIPHvNeBVZOWHGiuJpdtv8dzd/mTV7ASBzJF/JN9RcXfSSgjTTE33+Bi71w/0oVC
+9RNor9d9ot89skGMJOmZzcYur2vrI6HrS0pCw5BRUqSMvHKf3haEvPnWIscUHJwI
+meeNBADHWo3XneDXRoqMFqd6XJRA3DzXnN/bxoLvCxhIO8DPNHKd6Uq9UuKJATcn
+xVtzpgGx0sg2FQxKzsngFGk8fbjiOJLQF5k5RyH3x+qwMafiHtwvb3tWkgmNWweZ
+XvoDcjR+pEqBeuzs+3KdZq/iGTYKvsHhJG2UtY9xY3UVHjdyLrQzU3BhbUFzc2Fz
+c2luIFNpZ25pbmcgS2V5IDxyZWxlYXNlQHNwYW1hc3Nhc3Npbi5vcmc+iF8EExEC
+AB8CGwMECwcDAgMVAgMDFgIBAh4BAheAAhkBBQI/RTJXAAoJEN7gGYcmX6Bb/GoA
+oLbPk8h6v9mOtOvDk/xhQlD5ufweAKCtlk4jWgfsPyH9bduUKrP0BQNhnIhGBBMR
+AgAGBQI/RTHFAAoJEALjkFHlgLNjzrsAn1zO6xBL7FZFHNKUZf3xtV/JgvGqAJ4i
+dNA3CDlr+B22fX988bF07t5AA4hGBBMRAgAGBQJAnpDvAAoJEC27dr+t1MkzcUMA
+oJtKU6il0CSRPNsDnnvAC2i/yXvKAJ9eblF7XfeTVS7MMH/h57rIDOT4g4hGBBMR
+AgAGBQJBW4V/AAoJEBhZ0B9ne6HsCvkAnAjxd2FSODqdxdsdpbM/ButExpVjAJ90
+n7ByUFnFY5pjq0chG9XYVZN2NYhGBBMRAgAGBQJBW4X6AAoJEIHC9+viE7aSrXsA
+nA8BpKb5mWFpgysKJzr11XEQeto+AJ9rta6zjsL2RmiQDorCcrCsxNTrMYhGBBMR
+AgAGBQJBW4ZdAAoJEGtw7Nldw/RzO7kAoNLFcbP0tSSrb4Yj8q3jMojR3gPpAJ90
+zIq/kMaX1bgOpaojqtP0PAyEqYhGBBARAgAGBQJImrG9AAoJEDCReXIpi8fQ8QEA
+n1ktqEhfXFjGV9vKZ5WVS0WvK9LSAKCMC70d6eIdKZKVg8LLnxjiwVDufrRDU3Bh
+bUFzc2Fzc2luIFNpZ25pbmcgS2V5IDxzcGFtYXNzYXNzaW4tZGV2ZWxAbGlzdHMu
+c291cmNlZm9yZ2UubmV0PohxBDARAgAxBQJBIEsUKh0gc3BhbWFzc2Fzc2luLWRl
+dmVsIGxpc3Qgbm8gbG9uZ2VyIGV4aXN0cwAKCRDe4BmHJl+gW3AgAJ9ABAZxdTJu
+4ufA+rKwFxgqwtkTNACfffS1C2miFaCTjOIMprtwtg41H5iIWQQTEQIAGQUCPuT9
+sgQLBwMCAxUCAwMWAgECHgECF4AACgkQ3uAZhyZfoFtZCwCgnpu8rAt7MVZ+SNKc
+3JLh555Dl6UAn135v3YVEzDZ+6vEsgmmySxPdahPiEYEExECAAYFAj7k/k4ACgkQ
+AuOQUeWAs2NGZQCg9GZJ9vw/WtMvncxOgcVVFJg+FtkAoIA86oFXqs29FXVYnavQ
+61f6oPzoiEUEEBECAAYFAj7lBhUACgkQN/YdXIyAw18RfwCVEQ12eoTgCDvwYpJn
+mZ7gXwJ/lwCfRyZ1hu4IPQDnaLgdwUMVuq3CZ9OIRgQTEQIABgUCP0RKggAKCRBB
+NxtQbljvCvYBAKDcsZFa9+G9YCfg3ZCFUl8nVRnV1ACffxkt9TPey7VWGLVO30Od
+X828I5u5AaIEP0ROtREEAIx+lo30EOIFOYjWMuQcVDseMhMmO3Spn/zrGPZnpTNf
+PaxeNM5SNhVCnwBmsC4ymyrsFpddVI0tzvjKxqqpKWBk2v18uHLUS99qIsMdLrg8
+YN4SLXnl5fZr1nXjcDekXxpgSkewNIb72kZ4FRD9F+Q8T9nNi8z0HBBFjssUrl2D
+AKDYq2ewT3Y0LgeFGiuNwOT+XFcH+wP/bdR/0y2iE9CKpWViLlVyuHLDGsTdKM8i
+SOj05Y98x8ap8BrewEFLQKsXh6GsGUIk6HYbDTk870/o2vZ9oYNlR/DLnADJHbk6
+5A62iw6jr1O4JOO9cmERnjOkY1ZMYs3lXzzRr7tc2SSnviJ6laq5lyYGcPOII/AF
+n5hCXfwe2pwD/RZUKySbEQYhLqu92v2QmsvBwLbXg/u2zj74LoN8iIlNbebFufRD
+MjePLu287rHj/wcVqo1WXalZaNmjiHS/FF3UOJtln4WLTEsbg1E2zfcMNEf8TBPG
+4EakFh8/0uWboa9f4o9ZEQUAjRCio7uKYyXj5ldf2/d8E1+rQxxKa3A0iEYEGBEC
+AAYFAj9ETrUACgkQ3uAZhyZfoFvoBwCfT+3EftGFurI5UsdPTcqcZk4KVEEAoIYd
+cntspWaC0UjjeD7URevxKxW4mQINBEsW3ooBEACiKlghq7W/RoK6HUcy68+WjPqI
+oH7Q1pc816ATCY8yuAK6ageGRO6Or6I1Zm8/9na1YsJlGv/sQV3Yh4cSGoTtyX/K
+uvLihnLzCF7cytwdKcLM2lD2t4/2agyCylz/a9hmbpwFOCxClCbmn5AbRjOX0tp7
+QQjELWSX55xsyoPRX+3ngCEp+01nj7a5+rvcQ7RjxqgBWDvk4pmJN0Meaf1Agnhn
+OzOpbIYtZhUIYrt65sRkzrjIxif5l+563Ch+EGaRleJOV85FTzJP9HQgPrUkUiaK
+y3p/qbxTHAUBfTd6blUZLK/1KFfhcHRCpkMFHgRv1gweJ1RmCOOZTM/AxfPq0+zU
+CR63FNXhbKFl1k71tv4D3UYnj7pE+yskthspfqGKfb5sTqdh6AuBCtgRXKc9DD4t
+4h2k5CpoEv6KPVUYLj98aUB583lU6E09RqMTlUkqogoSdK6GoPHxxLSvEpai3HQS
+o1WZo3m1NgvgBDPBwru4Non9Ki1nhpj2b++KZDR5oZbuw09Hdwce39Qipnbf3xIy
+JMDBWx/M2tP/r6IJvlkN7sSqEGVOTliKyXgdJ/tIMTG7RiabnBtctG2K7kG5KxqU
+nUIGVCh0gkLH2ntAZ+Z9pJaCEVBpIfWyLlT+G9zeV7o2tb/0UDiLBFLyqXIklrfQ
+mSvoPIDCZ6/56MgSsQARAQABtGlTcGFtQXNzYXNzaW4gU2lnbmluZyBLZXkgKENv
+ZGUgU2lnbmluZyBLZXksIHJlcGxhY2VtZW50IGZvciAxMDI0RC8yNjVGQTA1Qikg
+PGRldkBzcGFtYXNzYXNzaW4uYXBhY2hlLm9yZz6JAjcEEwEKACEFAksW3ooCGwMF
+CwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQ/eUvQPfTmBTPyQ//WBnWvrvwWu46
+hWWFQ25CQvJmLp1ithWIt7leVngzUDzJUNgAsOhOdlaeXshVKSea0+hlsmX1ADt+
+hlzEudl4yaCF2lmzpax0POqAfqclX06P8Hl48KwdRlm8H6yGxBKKYZW1J/XNOGi7
+kgDT2Tit4WkJHMCuKb8H6EZdcCOBE3O8Bd8FP97tAi9KuMpNr58rLtAl7wbQgPhw
+qBSG3NqPXiykvi1sXzNUmYs9IYeCw0rqKQyVWkzjBHZruzZzr//zPnN9aMkPGCe9
+RRze3fMc8dkoKY0O8mdPkMOgo0+CD1CTV3tEJp+xbpZVcNFrpg9phgrevf4qRTdl
+EUJ9lShX3CVo8RraBEV8WiD75ZYOQz/hWX295nZjBsPNz+ysvd14gjHI7aF55eZ9
+JAHyNPv2g8e75VgojsTOIv6z/aN6f2CsT0v9fw921rTTo5h+Fx65iAue7bbkvI/J
+sr9qsZ9ODWNAGLwjapvtFlYXUXboYTYPUcULa1bc7n2Xrzyg9YnozbEECTcgt1ad
+G+pf0HywSTCPqGTuHK6ivhlfNuREDJsBk1ayA/Vaym4Yrhih4l3+QxmAr1yuQIV1
+bl9CbmCBzLGcIC8jL9/whnnI4DK5odty0aEY5E6Cr0c0K7LPx6bunhHwh2MIclCI
+axJy3X5y8nMpIaxhPIkObxpQQXKNS5GIRgQQEQoABgUCSxbfIgAKCRDe4BmHJl+g
+WzddAJ9u/3EqTBlEv+lohLZ31U6u9sNKZgCePKyrEFjXx+98wUjIJ+AveSVWi3y0
+S1NwYW1Bc3Nhc3NpbiBQcm9qZWN0IE1hbmFnZW1lbnQgQ29tbWl0dGVlIDxwcml2
+YXRlQHNwYW1hc3Nhc3Npbi5hcGFjaGUub3JnPokCNwQTAQoAIQUCSxbfgAIbAwUL
+CQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRD95S9A99OYFG9cD/42r/khRF8ViiKi
+QH94gIZB/1hUg1TEjY23ZHl+an1DImM0ZgtQuazfXIyoDUAwdBrgyh9R18K9MCj1
+3Jzqfwpw1nr17F9SHGV20VbK8ge31TM+UoDceE25NWyje90Nxgw4ZBV04yHpq2IO
+ZRg7Y8p/bRn+RNfF/7OQQUZQTdd2DtP6bCao12d1+yvT8PXQ4PeFiYhTY8KRSa3z
+cCvGb4l5kQJ0rZ7VneN8R/iHUHBfAHORUzxiecZSY4zTLambMKvxzZ3NSTOyxxgg
+YfaG2PYkcQQtz82/Ll2dU7cq3cjilYuEyrDpXDDhMYIcsIW3emybRt+VSdzeHRPo
+NAxjil2b5vfGSx0O62nRsiXycuaG6UFoKltIXDzSI8WQoRgz+24FgdfIkpbhRLCe
+Uu9U1wyykqUXeFmaK/e+Zqxb+QGdfq8u32c0NNAuNEg+bZkKylLKXzcRuRqftHQ8
+CXcXCMTE/rRLpIPefIhdmYl9FTW2WjhL03tqAe8IuCnJNVUas3atVvQh9jFyd/3r
+99dlpvwW5Sdqnr3QVWvJiJxHBBj/RhUq/dwLFTrVecX0Lcq67t0o1U2X7VeeSygh
+5V5/aElfdWUqBkN9kntsveBkRS7klUakTKfO/1GlxpSNzFtNcD8JfvVQDrYKh4R5
+yWQj7qCkjrTMzEY8HnZIc3d7WrqJPbkCDQRLFt6KARAAq2W8eG2MlAF+GJBjIzfL
+6iqBOeH7TlboLsGseOonZFETqsqH/LgpaBdMt3YY2/HXsZb23fK04Qx0H+sjuyUp
+UuJP2+S3//6KqrJAzMUEAU5vVjLt/YXuD2oWaRHjaV0EJpwa+LKD6BoViWw6K214
+ypY3dPNy61XRA1N4ejh6gZNsvnbN5x75VliyMGQ++p4RC4JulFQiuonkL428RPIw
+zujLGdO3rL3cRLJidaMAd/y1sNqGPc83tE1pky1Sm8Dl319MEgB1aieuqj4jLGKA
+uQA7n2zaUC7M7WuMCiHzg2lNNQLGNWDE/6FyfHKrF3MoEh8FMW2/NzvkOBpUh54T
+i1Q7ot/Rf52hH2Sw3sb19OT03invGna3nld9xKI7HUAb6fTSQDqFPjl2Gmc9b8dy
+tmwWrB1K+DsgK9yaAN5ZoWAYpmCYdFYeiL3L/0H/QrmUHrMlm+M1qrRpM0zst1rZ
+Tx/pEub45oQXv9r8eeET2QLBPwh/6OXttCxzkSqHYGQGv+w8a6VpaGUsC6RWZBpE
+wjJP+DoLdMZXx1IxDgSWWHY7p3U9HL5J1iAVOKKcOOZss9nu7Ellz0txkwixioUJ
+RfvcbTcqP0D22YC2AlCCfqFXjVT6KZOF13STqJ00c+oewebZcuuwbR1RZqTkjatS
+JuDQp/4cYMtIwr+K2mq2WWcAEQEAAYkCHwQYAQoACQUCSxbeigIbDAAKCRD95S9A
+99OYFG11D/9Z3Qfcib80ArUu9U0LDJJSjvwisHagINebPyXyNjBHgkkDNXd7g3WY
+FSSnT9C+Sef1Qbeol2yuCs8qa3YRIiD0jsmfsv/AykfobNCNf8UuCs13QnCPcqa5
+GlGilUYSirOO40IXO21DcdYBgtzKrabTeq5aPe5u4C7Q9ag6CVC4b9RgPHALG+qH
+qEK//OgLRV5YWaXlLUO++xlBYSkDLi+gBgI0pdGCSZOHF7Uo8xolDnc/v7OO6nG2
+hZ872TIgUOWiGYwSF51ymJwfMOLRbfuBn4GSlHMrB7wAWljhed9Oa5T1gAMm5Ixc
+QuMVLZ01QIk0X5UdV9CQ+OWn9rZs3AOmw1S+o/CHk/760zokAYR8TUzsvsmbAdL2
+Nf6CPai4U/Q/OFt3SqVxCkw2ID9id2GsdDSmHiIb7B+eZ7y96ALaXIREFLyMMhRW
+Z3X6ecBxKDPsEGiyej1La8V1PW9hjTDNobcCJxd8bm2GE0wQ86jm+tNs6UExt2ZZ
+KNO9cvi5KUpo+oV3X6RfXFEz/xZOmu9pXeDab7rP4cDqSvC4m42491oTrzn3ljgg
+/qlbmnyWb7lWRV3qyNwOYetpkUybmT0IiGcfQP24Exr1jDDxwpFpmvutbGPIa6C+
+5Y2x0yvuw5VZfndWASdUK9f4qA8N227/JrWMyVFbSHgqClMg4gHA5Q==
+=VQsP
+-----END PGP PUBLIC KEY BLOCK-----
+
+[2]
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQILBEOnbDQBEADBfda+hU8cGXD/2WYrIHsZ5CmvC2eCYKgQ87W706tzwmxoZWQS
+JfnRpkZnBqS5WDhXhNBOhk9CgF5/e9yHnDQCusNYfRstKd+t0XTFvq30/tacrJNe
+67zgq+DtWqIK9C7akfElc+2M5NkX6mF4cjaMXZoW17ltPy0XSSeirf584nvK3pXf
+oEFLYQ/0AUV9EBpo9+i2DkMUd8d5tz7A6O5foB3ijYPzIcVtVJ1eyCg6gO1I4cIA
+YbIZCH0WIVx5MQjydfKyCR4D7VFPpZgwcZ1PmyZSsy3lrigGVvYEoUS2fWTt2jUO
+pB3wg5pgzuu9hN5CpChZGvq65t4PGtAeShnBkddIH4l+iDC6sAc6W06KidSaUCW1
+BKvNMa39lyEkO4bfLblZRjoZbj7Tjq3wQV/PLpPyKDa8ZZ88GfWaeRDUNRgZG6Qq
+e6UKlFGfrw2RXOImUje7Sjy/eG4Ud/BOeGkV913yWBm9CHsPNtaVDK+iQI6vkAWS
+3QkiPjBkXGTZFHsUx9/i3k5Iga6d4Gq2cBIVBur3sDxjKuuSazLwA9OAybpzQe2s
+PvTzbGc/f1P7plT++HBFlBHwFtl/v68Q8pkbMWlEc5M9nYJ6yXHATHZzFfThxBwt
+OYfF25XGaclUMkOMX++RiRkmjaEaT7Whv5aPbeb3+H3v6Omjvnebge24lQAGKbQ/
+dXBkYXRlcy5zcGFtYXNzYXNzaW4ub3JnIFNpZ25pbmcgS2V5IDxyZWxlYXNlQHNw
+YW1hc3Nhc3Npbi5vcmc+iQI2BBMBAgAgBQJDp2w0AhsDBgsJCAcDAgQVAggDBBYC
+AwECHgECF4AACgkQQFamGlJE7EVkfg//ZjBQ6UXDizX9UPsEmogWXIqbBsyP5DJH
+uToaFa6OzCbOJqcYnXNfOjovYdDOTje+x3ZEkwbx+y6MSfhmDuHPDPqBU7hXenxx
+oRktC68mJasKo0wXym2YfyWFnhSZMlXXFQ9We48zNGcVRckzaxLzM67BFJuRUfOM
+EV6Lf3HxMvoUK3/Xzq9YPEq2sqFO1Eu+qPC3nq726Tj/aYBBFHgHmbjDrZTaQNyV
+fHvEjDzPcDRjlJI+vZw1UEuXG+BKATPpiT7U7I1OGLDa2ExDIxh0+eJnsmA3YyHG
+VweE7nDN2GmkXMVfa5vXHH49Ae9Ee8jIIRipfgMgZWnkZ0XYDvLj2ueH0Ixu4o9R
+D2zJIwqzRh1sytG+1YOfHrOMUCplImJaY/ARgOM324ZdBvhkgIi1XvT7Sy/ZmGWd
+DKFo+GjX0r2cujR8Pd4i7VlKsF9wRypk+n/aupXiaz5GY44EIVbnweyS5IlCNrwn
+4UtqcB9/9uk1tmUNIcC5xjbq5ud/Y+iMIqCKCH0C9WUwSNSdsg+K+9xoZuvlaXY0
+JeXWNcDdq+tMir+x+/o0U4ENVYBkSFesnotmHwN6jZj4lSMRmvcFHPBljXqLqzM+
+y5wZxnCo1N7T+erZaI7BUrpJYm8JxcJ2VCWV0JFoO1Ec//B6XYB0pckbRuSTX/Zw
+pKEkNqOdmjm5AgsEQ6dsigEQAKvdggbwqJgfDbRE2Lcy2gsn4j7haqu3IVBbyUDn
+kGuuDuEtSeoRjCZXEb5DaKibIpEy5vzvRGvCFFkrBs4KXk/uamkgCpGnQZFnoz/S
+rNZ8U7+e1pecEePpIkhQyafUKox9+p43UVoq4UybdPRDvE9SmQ1qaNUhyQY2FP9S
+WT1a63u5GA73aH4puGO0BuZ9R3MNaDYZe/MOlRRjmlAsbY4oqWOudlNVaZ71EV3O
+FFmOH4pnpxdO0X0l6sF6nvqvO5/gdZ3dI5iqrJjUneVgVOmPkREq7tQ5qHS/2pny
+rDrH8NZCDNT5TXciBxBrt53bxxL/V/HWaolmtJi8gK82uXt8YlmT6zuEsofufDmu
+P/HMDZ+BhGI+ggNzY2AVwERTRD6ecHDOI3iIuCP4Ck26YNHRCLyocL3CSlIpjQPu
+tb3qfdAcqKLJ/fVyLtGkXr24crel6IeJY7/AGjYBrfh47DWnK7Xds8bAqJ8VCjOc
+/q1usFTHgGkYocvtv0gmcjbu8YypzuG8HxOg9Yk9qRLQgg1fNhzXE2lqEPyMlBfj
+eLmMNRvKP70fH8CK8adinPIegaRrS6gZ/iIdv8+YV+1rlEt28qzzGJxnmzUEmW6X
+Xj44u91umg9WOsLxTOCQWdjGHonytHqj/xIsf45N2JIGLhU0lF04hYfEo5p65AyM
+PpYhAAYpiQIfBBgBAgAJBQJDp2yKAhsCAAoJEEBWphpSROxFungP/iWKe7o8szOz
+VmXkj89xDVFZ69nthVKkbgSYIZYQC+QLF8P1MWRnNWO/8TY+XsaCT3SrqxDFQ/R/
+9mlAPGUM1ySVihOPmP/DPiOlWLCsc0mb6OzYF2olcOR33s05MqvJlqXSmIrdB+hI
+KkC7G5byZ+XZwPXVj4XlxIEOzs18+0YJqy0IPZPXTiMet4k2KyWyWkJpJYUCb19G
+R6QC8hZQD97EYTbkbr5Ss26jjY/9AqLofW5F1/98pLDo+ron7pI2k8Ymn5DngEsa
+XoGsQuyvPfTAjS4p9q/XwExJcX3gvQesdw18mpoSaGAOgDISolBPRqpHpy7v7vuw
+3UMnsefKOX3F0Rossevw+c2/JCulnGmJDlgz6nHSR6FhHsbrDKF8oBeYPfGW/Kjw
+NvzB1i9yubAMrsTQVu1Q8e5LsnL/MNYKb6oEJbBywdeHxBkehGWFXVdSoFvVSih/
+VNqX9f7jlybpLZW/n8cQ2r1ax19v7FleO/xSGvkYm7B1+4BW0mjy6A5dta5+e5WG
+D5R06Uya3/xRAPGdmV6t4Mw8fFsuyCvs+vC73PR3+eS1UvCYsDpcQD8KpVBnsHaA
+duWRKKhjuFL0vdOWAr25tFOTKAj5Ywas47PBukO0isov2WBCA1rVqOr6FUvdP76y
+mqHv/0E6/vnTLxFoNsu4Ce42nAQ/A/jRiQQ+BBgBAgAJAhsCBQJHhbheAinBXSAE
+GQECAAYFAkOnbIoACgkQbFU5eCT0NM68MQ/8DvYqxRm3vP0Gwnr+63kzET8S+6vf
+gxOghnU+eMlqUeUu/ajqnVDMzoAIRDw9QgQc9ZZoklOSJQwOuloAbdpL4TwQ2XfJ
+MLU60JkZWnEOXJwClb0qG1GqtcBPbMEUPfZcQfphdRL3jpWZlaexFiJRSD+A0riw
+7q3NZKPDt4FrF7F3GY9krFy+P0nRt5f462DeDhCYZgguBQH+oGtjc5Hx+kOVWDsS
+txo5xkt4/0DG50ZklPkTlCohmJwRLACy+NswdQ9q83eWAhzKOPgkal7xF6a+LyE+
+ytVYy2EgEU74r2gVw5iizy92FDj//Z2QAUyf/c4BMuAhvfwVIHd8n2DPHvpMP15L
+6fwoymh0OjzmhwK94Z2u1YqNC1CK27/hfB6okQ/Tct7/Ik61dBjtiYdUC9tTA5Ze
+W8X5ouSmttS1QFixx+Z4hiXV7Qj12lgVKuJohjrVshfcbVzTHljjAo3YkOZIHIoA
+IJTUMRNzTIx9k4hrPVbxbVQhKjKTwFNtBuxvmptGTcLEIv9THpqlq8jkcStJ2Zrd
+hhofPCWRT/Kzo+WE+Kgefv88T5Li7Ku12U/UpiK85+6nRspXj3rnkfDOUbLZjGM+
+1NET0xQTPuyxN6CXF7MMxfGCpszCudYxMANDQqNXu9brcPN/+EIxGRjqin4E7q+h
+kYUaY7Ki8mXtJ8cJEEBWphpSROxFktcQALWQv996bFq1iFcGuQ0ITxNDlOWCsses
+bgEM5zR10DH+6s2bXEO8xyDHQJtrvdCPetRDosnuOToBMnGMXTYVytnWzwwAzwq1
+YM+bGAeTHaIX+2UmxwFyX4GMOdqsNB+xDZ8pmRKjamJSgUQt6e18YpZlg1Y4QkxS
+Vptq7OZBjiKeLUhLhGJ6GWgEIedLcoCtFzKCfz3zwn0Oxl+1EnVu8yqN+quWTf8P
+7EZn+0ztqZY059BrcK2jmOyXvtOZBcAHXCUknh/uPHwAJV2WFWSNid2kNiLOrV+J
+3eLTs5sF9wNhxWRhl6/10cwTzjy0Onv5cJh2tjdwksigMRMwz4c839zXORni/tnY
++IY22kNTKu84gB8rBuqUq8MQXNdS3bbROwwNUzpC0D1C1z1fBvyXDL1EwJdz70Wc
+2m/Sw6tIid5g98+XMW+Ibt43Jk2XbK71JLhbVbePbAcHVh/UXEtnjhRfX7oyWlwS
+a+lkKMiJd/6CQ6bvYsgklE7uEzTpRskpkkOcCk1O+8jfl+DsDwKrvVaNu8tpx45k
+TtV4JDA6iEHKakD/zZdVTR79W2CFqBvRfRikc5INOl1OfMQ4ODmjkMl3yI9wrHwS
+SQQxdq2XsS7xbU9HDFBEguQDu0rfzILZ9DuKIVHyr/CsRoJ5joj+JvKaUQC81ywQ
+aB8EKy5bg4U6
+=IbYW
+-----END PGP PUBLIC KEY BLOCK-----

sources

@@ -1,2 +1,4 @@
 SHA512 (Mail-SpamAssassin-4.0.0.tar.bz2) = a0fe5f6953c9df355bfa011e8a617101687eb156831a057504656921fe76c2a4eb37b5383861aac579e66a20c4454068e81a39826a35eb0266148771567bad5f
+SHA512 (Mail-SpamAssassin-4.0.0.tar.bz2.asc) = b87a80d2b0b802f52df75e485878c53cc4fad52935ca2b14b1b06e46d334b52c673e66d61cc2155b5e812fa6a486f8e61f6a87794be2524acea1fd8ac42e7d6a
 SHA512 (Mail-SpamAssassin-rules-4.0.0.r1905950.tgz) = 8ff0e68e18dc52a88fec83239bb9dc3a1d34f2dcb4c03cd6c566b97fa91242e3c8d006612aeb4df0acf43929eaaa59d542eb5cf904498343adf5eadefcb89255
+SHA512 (Mail-SpamAssassin-rules-4.0.0.r1905950.tgz.asc) = 517dbf83b4cf984036cb7cbf92a290ea0c8eea1da87f80d202275e71d2823b7b2eed4efff2f71742ca28090d355a690346f1bf97cfc15a3ea26a6d52792b1882

spamassassin.spec

@@ -60,7 +60,7 @@ Summary: Spam filter for email which can be invoked from mail delivery agents
 Name: spamassassin
 Version: 4.0.0
 #Release: 0.8.%%{prerev}%%{?dist}
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: ASL 2.0
 URL: https://spamassassin.apache.org/
 Source0: https://www.apache.org/dist/%{name}/source/%{real_name}-%{version}.tar.bz2
@@ -85,6 +85,11 @@ Source15: spamassassin.sysconfig.el
 Source16: sa-update.service
 Source17: sa-update.timer
 
+# GPG Keys and source signatures
+Source100: https://www.apache.org/dist/%{name}/source/%{real_name}-%{version}.tar.bz2.asc
+Source101: https://www.apache.org/dist/%{name}/source/%{real_name}-rules-%{version}.r1905950.tgz.asc
+Source102: https://www.apache.org/dist/spamassassin/KEYS
+
 # Patches 0-99 are RH specific
 # https://bugzilla.redhat.com/show_bug.cgi?id=1055593
 # Switch to using gnupg2 instead of gnupg1
@@ -99,6 +104,7 @@ Requires(post): diffutils
 
 BuildRequires: make
 BuildRequires: gcc
+BuildRequires: gnupg2
 BuildRequires: perl-interpreter >= 2:5.8.0
 BuildRequires: perl-generators
 BuildRequires: perl(Net::DNS)
@@ -205,6 +211,8 @@ To filter spam for all users, add that line to /etc/procmailrc
 (creating if necessary).
 
 %prep
+%{gpgverify} --keyring='%{SOURCE102}' --signature='%{SOURCE100}' --data='%{SOURCE0}'
+%{gpgverify} --keyring='%{SOURCE102}' --signature='%{SOURCE101}' --data='%{SOURCE1}'
 %setup -q -n Mail-SpamAssassin-%{version}
 # Patches 0-99 are RH specific
 %patch0 -p1
@@ -389,6 +397,9 @@ exit 0
 %endif
 
 %changelog
+* Sun Apr 02 2023 Todd Zullinger <tmz@pobox.com> - 4.0.0-4
+- Verify upstream source signatures
+
 * Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.0.0-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild