public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Benjamin A. Beasley <code@musicinmybrain.net>
To: git-commits@fedoraproject.org
Subject: [rpms/wcd] f43: Update URL to new homepage; verify source signature
Date: Sat, 12 Sep 2026 09:21:27 GMT	[thread overview]
Message-ID: <178920488730.1.5125994611229619901.rpms-wcd-1e48cebce617@fedoraproject.org> (raw)

A new commit has been pushed.

Repo   : rpms/wcd
Branch : f43
Commit : 1e48cebce617d07de89a7a700e78cf5227f97b59
Author : Benjamin A. Beasley <code@musicinmybrain.net>
Date   : 2026-09-12T09:45:51+01:00
Stats  : +29/-2 in 4 file(s)
URL    : https://src.fedoraproject.org/rpms/wcd/c/1e48cebce617d07de89a7a700e78cf5227f97b59?branch=f43

Log:
Update URL to new homepage; verify source signature

---
diff --git a/.gitignore b/.gitignore
index f2047d8..b9e5941 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 /wcd-*.tar.gz
+/wcd-6.0.5.tar.gz.asc

diff --git a/sources b/sources
index dec31c0..082b77d 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 SHA512 (wcd-6.0.5.tar.gz) = ac3fc0690e2011ab3a6863f075859a53887a7826b456f35b13421f8c3ed23e0a4665d9641163a2142ffae18b26379b2dbefab75a124c556bd0103522aaeb3d13
+SHA512 (wcd-6.0.5.tar.gz.asc) = 90cd6e7e66e63c9e2f420180dcf296c135f6d83965a453109cbae80e1fd37a9469607e8531a8b4bd870a4ed8d026de57a31606e5fb797a389c7b9f6a966965e0

diff --git a/wcd.gpg b/wcd.gpg
new file mode 100644
index 0000000..0fd58e3
Binary files /dev/null and b/wcd.gpg differ

diff --git a/wcd.spec b/wcd.spec
index 7941421..12ba68e 100644
--- a/wcd.spec
+++ b/wcd.spec
@@ -4,8 +4,32 @@ Version:        6.0.5
 Release:        %autorelease
 
 License:        GPL-2.0-or-later
-URL:            https://waterlan.home.xs4all.nl/wcd.html
-Source:         https://waterlan.home.xs4all.nl/wcd/wcd-%{version}.tar.gz
+URL:            https://waterlander.net/wcd
+Source0:        %{url}/files/wcd-%{version}.tar.gz
+Source1:        %{url}/files/wcd-%{version}.tar.gz.asc
+# Keyring created on 2026-09-12 with:
+#   workdir="$(mktemp --directory)"
+#   gpg2 --with-fingerprint wcd-6.0.5.tar.gz.asc 2>&1 |
+#     awk '$2 == "using" { print "0x" $NF }' |
+#     xargs gpg2 --homedir="${workdir}" \
+#         --keyserver=hkps://keyserver.ubuntu.com --recv-keys
+#   gpg2 --homedir="${workdir}" --export --export-options export-minimal \
+#       > wcd.gpg
+#   rm -rf "${workdir}"
+# Inspect keys using:
+#   gpg2 --show-keys wcd.gpg
+Source2:        wcd.gpg
+
+# “If the upstream tarball is signed using old keys depending on SHA1 digest or
+# otherwise incompatible with current OpenPGP standard, legacy %%{gpgverify}
+# macro can be used until this is resolved (it has the same API and could be
+# used as a drop-in replacement).”
+#
+# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_verifying_signatures
+#
+# Please avoid using SHA1 to sign releases
+# https://sourceforge.net/p/wcd/feature-requests/16
+BuildRequires:  gpgverify
 
 BuildRequires:  make
 BuildRequires:  gcc
@@ -82,6 +106,7 @@ plain-text documentation files, changelogs, and so on.
 
 
 %prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %autosetup
 
 

                 reply	other threads:[~2026-09-12  9:21 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=178920488730.1.5125994611229619901.rpms-wcd-1e48cebce617@fedoraproject.org \
    --to=code@musicinmybrain.net \
    --cc=git-commits@fedoraproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox