== Source File Verification

  Fedora packages *SHOULD* verify that signature as part of the RPM build process.

  Although a checksum in the sources file certifies that a file retreived from the lookaside cache is the one that the packager uploaded,

  === Obtaining the Correct Keys

  with one or more public keys from the upstream project.

  The keyring shall contain all the keys that are trusted to certify the authenticity of the sources,

  You shall download that file

  and do everything you reasonably can to verify that it is authentic.

  Then you shall add it unmodified to the package SCM,

  When source file verification is done,

  it *MUST* be done first in the `%prep` section of the spec file,

  before any potentially compromised code is executed.

  which expands into a command

  whose parameters shall be the pathnames of the keyring, the signature and the signed file.

  Any detached signature file

  must be uploaded to the package lookaside cache alongside the source code,

  while the keyring must be committed directly to the package SCM.

  ....

  Source0: ftp://ftp.example.com/pub/foo/%{name}-%{version}.tar.gz

  %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'

  ....

  The first source is the actual tarball,

  the second one is the signature from upstream,

  === Exceptions

  If the upstream tarball of a package needs to be modified,

  for example because it contains forbidden items,

  then the tarball cannot be verified as part of the build process.

  and the instructions/script used to build the stripped-down tarball needs to verify the upstream source.

  (for example if they publish only a fingerprint on their website

  and refer to a keyserver network for downloading the key),

  then you may need to create a keyring after you have verified the key.