diff --git a/diffutils-3.3.tar.xz.sig b/diffutils-3.3.tar.xz.sig
new file mode 100644
index 0000000..7d990ff
--- /dev/null
+++ b/diffutils-3.3.tar.xz.sig
@@ -0,0 +1,19 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1.4.13 (GNU/Linux)
+
+iQJ8BAABCgBmBQJRT0IHXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
+ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxNTVEM0ZDNTAwQzgzNDQ4NkQxRUVBNjc3
+RkQ5RkNDQjAwMEJFRUVFAAoJEH/Z/MsAC+7uEJ0QAKLo6rArnNmg5XL/MTRQyzq4
+4FZgJiPsFnsB0Erd7WFlcLUho+w4R9IjgLdp8QoDwKvc8bnK19e4iJtdtgBEtwPj
+IfjTslTTHA6OiUZvGOCh+5OFudMx00QUi0MRHE/zxbZzVui9TRGJzevdLT0xJnIF
+vPwiz/cafUojIvWtABpsp+7hH8jadIkQYOBGdzG50fDl6ZudvUoNmnnWZ1+hqi3e
+Q+Qu6xawe6LBvyR6ZeTdHVOJ+6pcDM4up65XZXJXQCB5Z7OBlcRB1mVHyHlh9HsE
+Ycp2sukZkqrsB+746J9RQqWcMRSrper1rJv+oPsXqHW+rkWOKe+jI0TMo+sPhRmM
+47YynCrBLsDgfovWwGHTJ5zds7mZdtqPhoE6Xgj1f7cel6n7kSsgIpXiSIiK/+yI
+aBg6CMEl+VqHD8IQCZXkz/wVvzMyJQJF0hIWp/W7ynbYccdsnb/0gCkr13fgR50/
+iogjp9h07dMpt556ByfE2OVQcocjpnT+Nqws+n6RassWiD1+UNiF/6ND97D5m0pn
+G9t/qLaxo+hkPM3OcoZ/Y8gP0O95gNZMHWWShDDX21nKx4Lo3ymOXY40n18T4WK2
+0eercgJNCepSAFwuenQn3NODQ/em2bNr54JscGeyn1h6sEqlNNrXz3ZgRfV7O9Y5
+9z0vaNoBjswNhlbaI/OF
+=oSVM
+-----END PGP SIGNATURE-----
diff --git a/diffutils.changes b/diffutils.changes
index b9b3298..93fba8e 100644
--- a/diffutils.changes
+++ b/diffutils.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Fri Apr  5 11:22:33 UTC 2013 - meissner@suse.com
+
+- add gpg key checking, keyring from savannah
+
 -------------------------------------------------------------------
 Fri Apr  5 08:01:12 UTC 2013 - jslaby@suse.com
 
diff --git a/diffutils.keyring b/diffutils.keyring
new file mode 100644
index 0000000..fbe58db
Binary files /dev/null and b/diffutils.keyring differ
diff --git a/diffutils.spec b/diffutils.spec
index b51692e..78d55f6 100644
--- a/diffutils.spec
+++ b/diffutils.spec
@@ -27,7 +27,13 @@ Summary:        GNU diff Utilities
 License:        GFDL-1.2 and GPL-3.0+
 Group:          Productivity/Text/Utilities
 Source:         http://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz
+Source1:        http://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz.sig
+# http://savannah.gnu.org/project/memberlist-gpgkeys.php?group=diffutils
+Source2:        %name.keyring
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
+%if 0%{?suse_version} > 1220
+BuildRequires:  gpg-offline
+%endif
 BuildRequires:  xz
 
 %description
@@ -35,6 +41,9 @@ The GNU diff utilities find differences between files. diff is used to
 make source code patches, for instance.
 
 %prep
+%if 0%{?suse_version} > 1220
+%gpg_verify %{S:1}
+%endif
 %setup -q
 
 %build