From 5743f55290501dc5772e8a00c41658aa710f84db Mon Sep 17 00:00:00 2001
From: Dominik 'Rathann' Mierzejewski <dominik@greysector.net>
Date: Feb 21 2018 10:31:04 +0000
Subject: Merge branch 'f27' into f28


---

diff --git a/587979573442684E.gpg b/587979573442684E.gpg
new file mode 100644
index 0000000..6aba9c2
Binary files /dev/null and b/587979573442684E.gpg differ
diff --git a/abcde.spec b/abcde.spec
index e03f3e4..124b602 100644
--- a/abcde.spec
+++ b/abcde.spec
@@ -7,10 +7,15 @@ Summary:        A Better CD Encoder
 License:        GPLv2+ and Public Domain
 URL:            https://abcde.einval.com/
 Source0:        https://abcde.einval.com/download/%{name}-%{version}.tar.gz
+Source1:        https://abcde.einval.com/download/%{name}-%{version}.tar.gz.sign
+# gpg2 --recv-key 0x587979573442684E
+# gpg2 --export --export-options export-minimal 0x587979573442684E > 587979573442684E.gpg
+Source2:        587979573442684E.gpg
 Patch0:         %{name}-2.7-normalize.patch
 Patch1:         %{name}-cddbmethod.patch
 
 BuildArch:      noarch
+BuildRequires:  %{_bindir}/gpgv2
 Requires:       cd-discid
 Requires:       wget
 Requires:       which
@@ -42,6 +47,7 @@ tags them, all in one go.
 
 
 %prep
+%{_bindir}/gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0}
 %setup -q
 %patch0 -p1 -F2
 %patch1 -p1
@@ -75,6 +81,7 @@ rm $RPM_BUILD_ROOT%{_bindir}/abcde-musicbrainz-tool # optional, missing perl(Mus
 %changelog
 * Wed Feb 21 2018 Dominik Mierzejewski <rpm@greysector.net> - 2.8.1-6
 - add Suggests for twolame, now that's included in Fedora 27+ (#1534297)
+- verify GPG signature for the source tarball
 
 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.1-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
diff --git a/sources b/sources
index 59c1a61..8fa1f91 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 SHA512 (abcde-2.8.1.tar.gz) = 18e9e46ec69d0b99fc5e2b71ec549e3961e5f6d7f88cef1a6c8da154689554a70cc8bc748c1ef78f81583a510f8b03906b8a4fec454aa0b06f0169d0bc4a7b36
+SHA512 (abcde-2.8.1.tar.gz.sign) = c3e6a922ad895b15f41c0b89162c66bb65dce5d822fa0935afcca1def0057a25e14cb25af478d42bbc49dc94c6f62f68dc10ac1989e9dd5e7ae7923af352b2c9