Add gpg verification of spice-server tarballs

.gitignore

@@ -20,3 +20,4 @@ spice-0.5.3.tar.bz2
 /spice-0.12.5.tar.bz2
 /spice-0.12.6.tar.bz2
 /spice-0.13.1.tar.bz2
+/spice-0.13.1.tar.bz2.sign

sources

@@ -1 +1,2 @@
 af410820e4f56e7cf0824127f4a06edf  spice-0.13.1.tar.bz2
+0f0b414562d5539f5546a2fc7d386f0c  spice-0.13.1.tar.bz2.sign

spice.spec

@@ -6,6 +6,8 @@ Group:          User Interface/Desktops
 License:        LGPLv2+
 URL:            http://www.spice-space.org/
 Source0:        http://www.spice-space.org/download/releases/%{name}-%{version}.tar.bz2
+Source1:        http://www.spice-space.org/download/releases/%{name}-%{version}.tar.bz2.sign
+Source2:        cfergeau-29AC6C82.keyring
 
 # https://bugzilla.redhat.com/show_bug.cgi?id=613529
 %if 0%{?rhel}
@@ -23,6 +25,7 @@ BuildRequires:  pixman-devel alsa-lib-devel openssl-devel libjpeg-devel
 BuildRequires:  libcacard-devel cyrus-sasl-devel
 BuildRequires:  pyparsing
 BuildRequires:  python-six
+BuildRequires:  gnupg2
 
 %description
 The Simple Protocol for Independent Computing Environments (SPICE) is
@@ -62,6 +65,10 @@ using spice-server, you will need to install spice-server-devel.
 
 %prep
 %setup -q
+gpg --homedir . --no-permission-warning \
+    --no-default-keyring --keyring %{SOURCE2} \
+    --trusted-key A9D8C21429AC6C82 \
+    --verify %{SOURCE1}
 
 
 %build