From a19280b340fbcad18d3d36c2226741ab4f5c5bd1 Mon Sep 17 00:00:00 2001
From: Björn Persson <Bjorn@Rombobjörn.se>
Date: May 10 2025 06:44:40 +0000
Subject: updated for the separate GPGverify package


---

diff --git a/guidelines/modules/ROOT/pages/index.adoc b/guidelines/modules/ROOT/pages/index.adoc
index 4eb42fa..f8c60e8 100644
--- a/guidelines/modules/ROOT/pages/index.adoc
+++ b/guidelines/modules/ROOT/pages/index.adoc
@@ -290,9 +290,9 @@ that packagers don't forget to verify it.
 
 === Obtaining the Correct Keys
 
-The verification method requires an OpenPGP keyring file
-with one or more public keys from the upstream project.
-The keyring shall contain all the keys that are trusted
+The verification method requires one or more OpenPGP keyring files
+with public keys from the upstream project.
+The keyrings shall together contain all the keys that are trusted
 to certify the authenticity of the sources,
 and *MUST NOT* contain any other keys.
 
@@ -321,7 +321,7 @@ The verification *MUST* be done with the macro `+%{gpgverify}+`,
 which expands into a command
 whose parameters shall be the pathnames of the keyring,
 the signature and the signed file.
-`BuildRequires: gnupg2` is necessary for the verification to work.
+`BuildRequires: gpgverify` is necessary for the verification to work.
 
 Any detached signature file
 (e.g. foo.tar.gz.asc or foo.tar.gz.sig)
@@ -336,7 +336,7 @@ Source0: ftp://ftp.example.com/pub/foo/%{name}-%{version}.tar.gz
 Source1: ftp://ftp.example.com/pub/foo/%{name}-%{version}.tar.gz.asc
 Source2: https://www.example.com/gpgkey-0123456789ABCDEF0123456789ABCDEF.gpg
 …
-BuildRequires: gnupg2
+BuildRequires: gpgverify
 …
 %prep
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
@@ -382,15 +382,23 @@ Source0: ftp://ftp.example.com/pub/foo/%{name}-%{version}.tar.xz
 Source1: ftp://ftp.example.com/pub/foo/%{name}-%{version}.tar.asc
 Source2: https://www.example.com/gpgkey-0123456789ABCDEF0123456789ABCDEF.gpg
 …
-BuildRequires: gnupg2 xz
+BuildRequires: gpgverify xz
 …
 %prep
 xzcat '%{SOURCE0}' | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data=-
 ----
 
+If the data and the signature are combined in a single file,
+then the signed data must be written to an output file:
+
+[source, rpm-spec]
+----
+%{gpgverify} --keyring='%{SOURCE1}' --data='%{SOURCE0}' --output=<pathname>
+----
+
 Packages that are vital during bootstrapping of Fedora
 may use a <<bootstrapping,bootstrap flag>>
-to skip the verification before GnuPG has been built.
+to skip the verification before GPGverify and GnuPG have been built.
 
 === Help