Add source file signature verification

wdiff-1.2.2.tar.gz.sig

@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.22 (GNU/Linux)
+
+iEYEABECAAYFAlNMQlQACgkQRhp6o4m9dFslzgCgmQOsyG7Cya4BUpRwoog+TrEs
+faEAn0Qw7vmPRvN9aQJ8LWL+xh5YKNmX
+=mDRK
+-----END PGP SIGNATURE-----

wdiff.spec

@@ -6,6 +6,8 @@ Summary:        A front-end to GNU diff
 License:        GPLv3+
 URL:            https://www.gnu.org/software/%{name}/
 Source0:        https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.gz
+Source1:        https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.gz.sig
+Source2:        https://ftp.gnu.org/gnu/gnu-keyring.gpg
 
 BuildRequires: make
 BuildRequires:  automake
@@ -13,6 +15,8 @@ BuildRequires:  gettext-devel
 BuildRequires:  libtool  
 BuildRequires:  texinfo  
 
+BuildRequires:  gnupg2
+
 #https://fedorahosted.org/fpc/ticket/174
 Provides: bundled(gnulib) = 30.5.2012
 
@@ -25,6 +29,7 @@ useful when two texts differ only by a few words and paragraphs have
 been refilled.
 
 %prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q -n %{name}-%{version}
 iconv --from=ISO-8859-1 --to=UTF-8 ChangeLog > ChangeLog.new && \
 touch -r ChangeLog ChangeLog.new && \
@@ -52,6 +57,7 @@ find $RPM_BUILD_ROOT -type f -name '*gnulib.mo' -exec rm -f {} ';'
 %changelog
 * Sun Feb 07 2021 Benjamin A. Beasley <code@musicinmybrain.net> - 1.2.2-17
 - Change URLs from HTTP to HTTPS
+- Add source file signature verification
 
 * Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.2-16
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild