Accepting request 182759 from home:AndreasStieger:branches:network:utilities

- verify source signatures

OBS-URL: https://build.opensuse.org/request/show/182759
OBS-URL: https://build.opensuse.org/package/show/network:utilities/whois?expand=0&rev=26

whois.spec

@@ -24,12 +24,18 @@ License:        GPL-2.0+
 Group:          Productivity/Networking/Other
 Url:            http://www.linux.it/~md/software/
 Source:         http://ftp.debian.org/debian/pool/main/w/whois/%{name}_%{version}.tar.xz
+Source2:        http://db.debian.org/fetchkey.cgi?fingerprint=1F2232EEE56FD048EAEFE47F1467F0D8E1EE3FB1#/%{name}.keyring
+# rename .dsc to not build the package in OBS
+Source3:        http://ftp.debian.org/debian/pool/main/w/whois/%{name}_%{version}.dsc#/%{name}.asc
 Patch1:         whois-5.0.25-nb.patch
 BuildRequires:  libidn-devel
 BuildRequires:  xz
 %if 0%{?suse_version} <= 1140
 BuildRequires:  libxcrypt-devel
 %endif
+%if 0%{?suse_version} >= 1230
+BuildRequires:  gpg-offline
+%endif
 Provides:       ripe-whois-tools
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 
@@ -43,7 +49,13 @@ The package also contains mkpasswd, a features-rich front end to the
 password encryption function crypt(3).
 
 %prep
-%setup -q -n whois-%{version}
+%{?gpg_verify: %gpg_verify %{S:3}}
+# the signature is on the Debian .dsc. Extract the checksums and verify against source
+echo "`grep -A1 "Files:" %{S:3} | grep %{name}_%{version}.tar.xz | cut -d\  -f2`  %{S:0}" | md5sum -c
+echo "`grep -A1 "Checksums-Sha1" %{S:3} | grep %{name}_%{version}.tar.xz | cut -d\  -f2`  %{S:0}" | sha1sum -c
+echo "`grep -A1 "Checksums-Sha256" %{S:3} | grep %{name}_%{version}.tar.xz | cut -d\  -f2`  %{S:0}" | sha256sum -c
+
+%setup -q
 %patch1 -p1
 rename no nb po/no.*