[rpms/wcd] epel9: Update URL to new homepage; verify source signature

[Benjamin A. Beasley <code@musicinmybrain.net>]

A new commit has been pushed.

Repo   : rpms/wcd
Branch : epel9
Commit : c620439e221211d85845bc06e0fabf8c5a6e9583
Author : Benjamin A. Beasley <code@musicinmybrain.net>
Date   : 2026-09-13T08:01:39+01:00
Stats  : +29/-2 in 4 file(s)
URL    : https://src.fedoraproject.org/rpms/wcd/c/c620439e221211d85845bc06e0fabf8c5a6e9583?branch=epel9

Log:
Update URL to new homepage; verify source signature

---
diff --git a/.gitignore b/.gitignore
index f2047d8..b9e5941 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 /wcd-*.tar.gz
+/wcd-6.0.5.tar.gz.asc

diff --git a/sources b/sources
index dec31c0..082b77d 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 SHA512 (wcd-6.0.5.tar.gz) = ac3fc0690e2011ab3a6863f075859a53887a7826b456f35b13421f8c3ed23e0a4665d9641163a2142ffae18b26379b2dbefab75a124c556bd0103522aaeb3d13
+SHA512 (wcd-6.0.5.tar.gz.asc) = 90cd6e7e66e63c9e2f420180dcf296c135f6d83965a453109cbae80e1fd37a9469607e8531a8b4bd870a4ed8d026de57a31606e5fb797a389c7b9f6a966965e0

diff --git a/wcd.gpg b/wcd.gpg
new file mode 100644
index 0000000..0fd58e3
Binary files /dev/null and b/wcd.gpg differ

diff --git a/wcd.spec b/wcd.spec
index acf6b2c..8ca2835 100644
--- a/wcd.spec
+++ b/wcd.spec
@@ -4,8 +4,32 @@ Version:        6.0.5
 Release:        %autorelease
 
 License:        GPL-2.0-or-later
-URL:            https://waterlan.home.xs4all.nl/wcd.html
-Source:         https://waterlan.home.xs4all.nl/wcd/wcd-%{version}.tar.gz
+URL:            https://waterlander.net/wcd
+Source0:        %{url}/files/wcd-%{version}.tar.gz
+Source1:        %{url}/files/wcd-%{version}.tar.gz.asc
+# Keyring created on 2026-09-12 with:
+#   workdir="$(mktemp --directory)"
+#   gpg2 --with-fingerprint wcd-6.0.5.tar.gz.asc 2>&1 |
+#     awk '$2 == "using" { print "0x" $NF }' |
+#     xargs gpg2 --homedir="${workdir}" \
+#         --keyserver=hkps://keyserver.ubuntu.com --recv-keys
+#   gpg2 --homedir="${workdir}" --export --export-options export-minimal \
+#       > wcd.gpg
+#   rm -rf "${workdir}"
+# Inspect keys using:
+#   gpg2 --show-keys wcd.gpg
+Source2:        wcd.gpg
+
+# “If the upstream tarball is signed using old keys depending on SHA1 digest or
+# otherwise incompatible with current OpenPGP standard, legacy %%{gpgverify}
+# macro can be used until this is resolved (it has the same API and could be
+# used as a drop-in replacement).”
+#
+# https://docs.fedoraproject.org/en-US/packaging-guidelines/#_verifying_signatures
+#
+# Please avoid using SHA1 to sign releases
+# https://sourceforge.net/p/wcd/feature-requests/16
+BuildRequires:  gpgverify
 
 BuildRequires:  make
 BuildRequires:  gcc
@@ -82,6 +106,7 @@ plain-text documentation files, changelogs, and so on.
 
 
 %prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %autosetup