add GPG verification where possible

.gitignore

@@ -18,3 +18,9 @@
 *.run
 /tests
 Twoliter.override
+packages/*/*.asc
+packages/*/*-asc.txt
+packages/*/*.sig
+packages/*/*-sig.txt
+packages/*/*.sign
+!packages/*/gpgkey-*.asc

packages/amazon-ecs-cni-plugins/Cargo.toml

@@ -8,6 +8,10 @@ build = "../build.rs"
 [lib]
 path = "../packages.rs"
 
+[package.metadata.build-package]
+# Use the Git submodule commit from aws/amazon-ecs-agent rather than an upstream release.
+releases-url = "https://github.com/aws/amazon-ecs-agent/commits/master/amazon-ecs-cni-plugins"
+
 [[package.metadata.build-package.external-files]]
 # This is locked against the version shipped in ecs-agent
 # Verify that the ecs-agent version shipped in bottlerocket tracks the same one here

packages/amazon-ssm-agent/Cargo.toml

@@ -8,6 +8,9 @@ build = "../build.rs"
 [lib]
 path = "../packages.rs"
 
+[package.metadata.build-package]
+releases-url = "https://github.com/aws/amazon-ssm-agent/releases"
+
 [[package.metadata.build-package.external-files]]
 url = "https://github.com/aws/amazon-ssm-agent/archive/3.3.1345.0/amazon-ssm-agent-3.3.1345.0.tar.gz"
 sha512 = "c147a59509db081c5bc8d7aeca6870fb1e907b252e62513164935549a11d4276dda7c214d349af9d9e7cf136058e0cd9cd77e15088b5fd38ae14c0472a064923"

packages/amazon-vpc-cni-plugins/Cargo.toml

@@ -8,6 +8,10 @@ build = "../build.rs"
 [lib]
 path = "../packages.rs"
 
+[package.metadata.build-package]
+# Use the Git submodule commit from aws/amazon-ecs-agent rather than an upstream release.
+releases-url = "https://github.com/aws/amazon-ecs-agent/commits/master/amazon-vpc-cni-plugins"
+
 [[package.metadata.build-package.external-files]]
 url = "https://github.com/aws/amazon-vpc-cni-plugins/archive/be5214353252f8315a1341f4df9ffbd8cf69000c/amazon-vpc-cni-plugins.tar.gz"
 sha512 = "b1aa61d0000ff732dae67213cea2eac49363c048416716e27f36b2b43f6227db8b15ead27c43c5fd623569a49572cb6b2149c86d69363f75cec4620ddc9ef47b"

packages/aws-otel-collector/Cargo.toml

@@ -8,6 +8,9 @@ build = "../build.rs"
 [lib]
 path = "../packages.rs"
 
+[package.metadata.build-package]
+releases-url = "https://github.com/aws-observability/aws-otel-collector/releases"
+
 [[package.metadata.build-package.external-files]]
 url = "https://github.com/aws-observability/aws-otel-collector/archive/v0.41.1/aws-otel-collector-v0.41.1.tar.gz"
 sha512 = "8e6436e4cec7d4f02468ad69fd6b26c97a9b592083da2725daa0b4c4777c34b2127dadc217c13be7c8de53bde021165aacbc1e5fecbd9ae0cae26d9fea8327e4"

packages/bash/Cargo.toml

@@ -15,6 +15,10 @@ releases-url = "https://ftp.gnu.org/gnu/bash"
 url = "https://ftp.gnu.org/gnu/bash/bash-5.2.37.tar.gz"
 sha512 = "c07e2715cca7c3c8435fcb13aaf2968671f10f9e1fe5edd7c63d7e34fb821c159087b70386e17bdda723d8223057b53810e75eb249b03ebfc847147b06a8101f"
 
+[[package.metadata.build-package.external-files]]
+url = "https://ftp.gnu.org/gnu/bash/bash-5.2.37.tar.gz.sig"
+sha512 = "5700135e0f6ddb86e577445eeead7ee07df80d00b751ef2c3332b7af76a1f0d7c69be5f72790ce37249d0652532232d1bc8e1e7cb73c105da7337fc5f5c1f539"
+
 [build-dependencies]
 glibc = { path = "../glibc" }
 libncurses = { path = "../libncurses" }

packages/bash/bash.spec

@@ -5,6 +5,8 @@ Summary: The GNU Bourne Again shell
 License: GPL-3.0-or-later
 URL: https://www.gnu.org/software/bash
 Source0: https://ftp.gnu.org/gnu/bash/bash-%{version}.tar.gz
+Source1: https://ftp.gnu.org/gnu/bash/bash-%{version}.tar.gz.sig
+Source2: gpgkey-7C0135FB088AAF6C66C650B9BB5869F064EA74AB.asc
 
 # Disable loadable builtin examples
 Patch127: bash-4.4-no-loadable-builtins.patch
@@ -26,6 +28,7 @@ Requires: %{name}
 %{summary}.
 
 %prep
+%{gpgverify} --data=%{S:0} --signature=%{S:1} --keyring=%{S:2}
 %autosetup -n bash-%{version} -p1
 
 echo %{version} > _distribution

packages/bash/gpgkey-7C0135FB088AAF6C66C650B9BB5869F064EA74AB.asc

@@ -0,0 +1,23 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQGiBEEOsGwRBACFa0A1oa71HSZLWxAx0svXzhOZNQZOzqHmSuGOG92jIpQpr8Dp
+vgRh40YpAwdcXb8QG1J5yGAKeevNE1zCFaA725vGSdHUyypHouV0xoWwukYO6qly
+yX+2BZU+okBUqoWQkoWxiYaCSfzB2Ln7pmdys1fJhcgBKf3VjWCjd2XJTwCgoFJO
+wyBFJdugjfwjSoRSwDOIMf0D/iQKqlWhIO1LGpMrGX0il0/x4zj0NAcSwAk7LaPZ
+bN4UPjn5pqGEHBlf1+xDDQCkAoZ/VqESGZragl4VqJfxBr29Ag0UDvNbUbXoxQsA
+Rdero1M8GiAIRc50hj7HXFoERwenbNDJL86GPLAQOTGOCa4W2o29nFfFjQrsrrYH
+zVtyA/9oyKvTeEMJ7NA3VJdWcmn7gOu0FxEmSNhSoV1T4vP21Wf7f5niCCRKQLNy
+Uy0wEApQi4tSysdz+AbgAc0b/bHYVzIf2uO2lIEZQNNt+3g2bmXgloWmW5fsm/di
+50Gm1l1Na63d3RZ00SeFQos6WEwLUHEB0yp6KXluXLLIZitEJLQaQ2hldCBSYW1l
+eSA8Y2hldEBjd3J1LmVkdT6IZgQTEQIAHgUCQQ6wbAIbAwYLCQgHAwIDFQIDAxYC
+AQIeAQIXgAASCRC7WGnwZOp0qwdlR1BHAAEBzs0An30UTMW8N1jOoJzNcXoopeLt
+g3k4AJ9pwNiyhlyeezLsSMFkvTPAbBv+wbkBDQRBDrBvEAQAkK6TAOKBEM+EC4j6
+V/7o/riVZqcgU5cid2qG9TXdwNtD9a3kvA/ObZBO93sX59wc6Bnwo4VJxsOmMlpG
+rAjJsxNwg3QHakEtf8LXRbVpj5xStdmBdQZUhIQyalo/2/TZq5OijtddUQcL5cs7
+0hTv/FpT3wUvr2Xr8rjF41IFEz8AAwcD/A0CZEGlzIrT5WCBnl6xBog/8vKiUCba
+rByat3d1mL6DbizvKNXQRTC9E/vEdENAWCQCjr75Bu55xT8n3SXGtWdDC5xmZ/P3
+OBYORP8yl8H8I1FIosWOFirbIeYdZPq8SPD1HL+EXo9zSiHVrrZRJ19ooCKKbSdX
+HFCY+aJG+0KZiFEEGBECAAkFAkEOsG8CGwwAEgkQu1hp8GTqdKsHZUdQRwABAeNw
+AJ9mWRUIPBrP81M71zLe3r2halU83ACdHB7SqT9Yv+B+EffjrGHkHccVsU0=
+=X3tm
+-----END PGP PUBLIC KEY BLOCK-----

packages/binutils/Cargo.toml

@@ -8,10 +8,17 @@ build = "../build.rs"
 [lib]
 path = "../packages.rs"
 
+[package.metadata.build-package]
+releases-url = "https://mirrors.kernel.org/gnu/binutils/"
+
 [[package.metadata.build-package.external-files]]
 url = "https://mirrors.kernel.org/gnu/binutils/binutils-2.41.tar.xz"
 sha512 = "5df45d0bd6ddabdce4f35878c041e46a92deef01e7dea5facc97fd65cc06b59abc6fba0eb454b68e571c7e14038dc823fe7f2263843e6e627b7444eaf0fe9374"
 
+[[package.metadata.build-package.external-files]]
+url = "https://mirrors.kernel.org/gnu/binutils/binutils-2.41.tar.xz.sig"
+sha512 = "e86b940a1fa73775236fe8e7cf824625c6add59072fe7948a7de8f613bb1bbbbb7108e4f9651cb0f606007f4180a0fe13911d84c70149e82242169e4ce5892e2"
+
 [build-dependencies]
 glibc = { path = "../glibc" }
 libz = { path = "../libz" }

packages/binutils/binutils.spec

@@ -6,6 +6,8 @@ Summary: Tools for working with binaries
 URL: https://sourceware.org/binutils
 License: GPL-2.0-or-later AND LGPL-2.0-or-later AND GPL-3.0-or-later
 Source0: https://ftp.gnu.org/gnu/binutils/binutils-%{version}.tar.xz
+Source1: https://ftp.gnu.org/gnu/binutils/binutils-%{version}.tar.xz.sig
+Source2: gpgkey-3A24BC1E8FB409FA9F14371813FCEF89DD9E3C4F.asc
 Requires: %{_cross_os}libz
 BuildRequires: %{_cross_os}glibc-devel
 BuildRequires: %{_cross_os}libz-devel
@@ -21,6 +23,7 @@ Requires: %{name}
 %{summary}.
 
 %prep
+%{gpgverify} --data=%{S:0} --signature=%{S:1} --keyring=%{S:2}
 %autosetup -n binutils-%{version} -p1
 
 %build

packages/binutils/gpgkey-3A24BC1E8FB409FA9F14371813FCEF89DD9E3C4F.asc

@@ -0,0 +1,51 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFm/2cUBEADkvRqMWfAryJ52T4J/640Av5cam9ojdFih9MjcX7QWFxIzJfTF
+Yq2z+nb4omdfZosdCJL2zGcn6C0AxpHNvxR9HMDkEyFHKrjDh4xWU+pH4z9azQEq
+Jh331X7UzbZldqQo16VkuVavgsTJaHcXm+nGIBTcUbl2oiTtHhmuaYxx6JTMcFjC
+7vyO5mLBw78wt52HBYweJ0NjHBvvH/JxbAAULSPRUC61K0exlO49VFbFETQNG1hZ
+TKEji95fPbre7PpXQ0ewQShUgttEE/J3UA4jYaF9lOcZgUzbA27xTV//KomP0D30
+yr4e4EJEJYYNKa3hofTEHDXeeNgM25tprhBUMdbVRZpf2Keuk2uDVwc+EiOVri48
+rb1NU+60sOXvoGO6Ks81+mhAGmrBrlgLhAp8K1HPHI4MG4gHnrMqX2rEGUGRPFjC
+3qqVVlPm8H05PnosNqDLQ1Pf7C0pVgsCx6hKQB7Y1qBui7aoj9zeFaQgpYef+CEE
+RIKEcWwrjaOJwK3pi9HFdxS0NNWYZj8HPzz/AsgTTQdsbulPlVq2SsctmOnL42CZ
+OCTppGYwl53CG/EqVY+UQBzFzJBaY8TJRFFYVEy5/HH4H11rMoZwqIkk71EOGU3X
+6mWlANRikR3M4GhVITRzuaV69Fed+OeXcCmP94ASLfuhBR2uynmcHpBKpwARAQAB
+tDtOaWNrIENsaWZ0b24gKENoaWVmIEJpbnV0aWxzIE1haW50YWluZXIpIDxuaWNr
+Y0ByZWRoYXQuY29tPokCOAQTAQIAIgUCWb/ZxQIbAwYLCQgHAwIGFQgCCQoLBBYC
+AwECHgECF4AACgkQE/zvid2ePE9cOxAA3cX1bdDaTFttTqukdPXLCtD2aNwJos4v
+B4LYPSgugLkYaHIQH9d1NQPhS0TlUeovnFNESLaVsoihv0YmBUCyL4jE52FRoTjE
+6fUhYkFNqIWN2HYwkVrSap2UUJFquRVoVbPkbSup8P+D8eydBbdxsY6f+5E8Rtz5
+ibVnPZTib7CyqnFokJITWjzGdIP0Gn+JWVa6jtHTImWx1MtqiuVRDapUhrIoUIjf
+98HQn9/N5ylEFYQTw7tzaJNWeGUoGYS8+8n/0sNbuYQUU/zwMVY9wpJcrXaas6yZ
+XGpF/tua59t9LFCct+07YAUSWyaBXqBW3PKQz7QP+oE8yje91XrhOQam04eJhPIB
+LO88g6/UrdKaY7evBB8bJ76Zpn1yqsYOXwAxifD0gDcRTQcB2s5MYXYmizn2GoUm
+1MnCJeAfQCi/YMobR+c8xEEkRU83Tnnw3pmAbRU6OcPihEFuK/+SOMKIuV1QWmjk
+bAr4g9XeXvaN+TRJ9Hl/k1k/sj+uOfyGIaFzM/fpaLmFk8vHeej4i2/C6cL4mnah
+wYBDHAfHO65ZUIBAssdA6AeJ+PGsYeYhqs6zkpaA2b0wT4f9s7BPSqi0Veky8bUY
+YY7WpjzDcHnj1gEeIU55EhOQ42dnEfv7WrIAXanOP8SjhgqAUkb3R88azZCpEMTH
+iCE4bFxzOmi5Ag0EWb/ZxQEQALaJE/3u23rTvPLkitaTJFqKkwPVylzkwmKdvd2q
+eEFk1qys2J3tACTMyYVnYTSXy5EJH2zJyhUfLnhLp8jJZF4oU5QehOaJPcMmzI/C
+ZS1AmH+jnm6pukdZAowTzJyt4IKSapr+7mxcxX1YQ2XewMnFYpLkAA2dHaChLSU/
+EHJXe3+O4DgEURTFMa3SRN/J4GNMBacKXnMSSYylI5DcIOZ/v0IGa5MAXHrP1Hwm
+1rBmloIcgmzexczBf+IcWgCLThyFPffv+2pfLK1XaS82OzBC7fS01pB/eDOkjQuK
+y16sKZX6Rt57vud40uE5a0lpyItC2P7u7QWL4yT5pMF+oS8bm3YWgEntV380RyZp
+qgJGZTZLNq2T4ZgfiaueEV4JzOnG2/QRGjOUrNQaYzKy5V127CTnRg4BYF/uLEmi
+zLcI3O3U1+mEz6h48wkAojO1B6AZ8Lm+JuxOW5ouGcrkTEuIG56GcDwMWS/Pw/vN
+sDyNmOCjy9eEKWJgmMmLaq59HpfTd8IOeaYyuAQHAsYt/zzKy0giMgjhCQtuc99E
+4nQE9KZ44DKsnqRabK9s3zYE3PIkCFIEZcUiJXSXWWOIdJ43j+YyFHU5hqXfECM6
+rzKGBeBUGTzyWcOX6YwRM4LzQDVJwYG8cVfth+v4/ImcXR43D4WVxxBEAjKag02b
++1yfABEBAAGJAh8EGAECAAkFAlm/2cUCGwwACgkQE/zvid2ePE/dqQ/6ApUwgsZz
+tps0MOdRddjPwz44pWXS5MG45irMQXELGQyxkrafc8lwHeABYstoK8dpopTcJGE3
+dZGL3JNz1YWxQ5AV4uyqBn5N8RubcA8NzR6DQP+OGPIwzMketvVC/cbbKDZqf0uT
+Dy3jP65OFhSkTEIynYv1Mb4JJl3Sq+haUbfWLAV5nboSuHmiZE6Bz2+TjdoVkNwH
+Bfpqxu6MlWka+P98SUcmY8iVhPy9QC1XFOGdFDFf1kYgHW27mFwds35NQhNARgft
+AVz9FZXruW6tFIIfisjr3rVjD9R8VgL7l5vMr9ylOFpepnI6+wd2X1566HW7F1Zw
+1DIrY2NHL7kL5635bHrJY4n7o/n7Elk/Ca/MAqzdIZxz6orfXeImsqZ6ODn4Y47P
+ToS3Tr3bMNN9N6tmOPQZkJGHDBExbhAi/Jp8fpWxMmpVCUl6c85cOBCR4s8tZsvG
+YOjR3CvqKrX4bb8GElrhOvAJa6DdmZXc7AyoVMaTvhpq3gJYKmC64oqt7zwIHwaC
+xTbP6C6oUp9ENRV7nHnXN3BlvIgCo4QEs6HkDzkmgYlCEOKBiDyVMSkPDZdsspa+
+K4GlU2Swi/BDJMjtDxyo+K0M81LXXxOeRfEIfPtZ3ddxBKPva1uSsuz+pbN9d1JY
+8Ko5T/h16susi2ReUyNJEJaSnjO5z13TQ1U=
+=93P0
+-----END PGP PUBLIC KEY BLOCK-----

packages/conntrack-tools/Cargo.toml

@@ -15,6 +15,10 @@ releases-url = "https://www.netfilter.org/projects/conntrack-tools/files"
 url = "https://www.netfilter.org/projects/conntrack-tools/files/conntrack-tools-1.4.8.tar.xz"
 sha512 = "95d8f6f068c1342ad7e767537e722272a4f5bd8b46b952713ade053a1043aa9ababbe5ce658ede9c77b6de5221b97ad8833777caffd69b67dd70a99f2b45afdf"
 
+[[package.metadata.build-package.external-files]]
+url = "https://www.netfilter.org/projects/conntrack-tools/files/conntrack-tools-1.4.8.tar.xz.sig"
+sha512 = "8cd229d2e980ab1788e90fc8f53827fe1e4b21801cad6cddf6a9ff537501c40c52242cc964005b2889ad0a4548c772304db8696d4644611ecf9f091aca5c14ee"
+
 [build-dependencies]
 glibc = { path = "../glibc" }
 libmnl = { path = "../libmnl" }

packages/conntrack-tools/conntrack-tools.spec

@@ -7,6 +7,8 @@ Summary: Tools for managing Linux kernel connection tracking
 License: GPL-2.0-or-later AND GPL-2.0-only
 URL: http://conntrack-tools.netfilter.org/
 Source0: https://www.netfilter.org/projects/conntrack-tools/files/conntrack-tools-%{version}.tar.xz
+Source1: https://www.netfilter.org/projects/conntrack-tools/files/conntrack-tools-%{version}.tar.xz.sig
+Source2: gpgkey-37D964ACC04981C75500FB9BD55D978A8A1420E4.asc
 Patch1: 0001-disable-RPC-helper.patch
 
 BuildRequires: %{_cross_os}glibc-devel
@@ -34,6 +36,7 @@ Requires: %{name}
 %{summary}.
 
 %prep
+%{gpgverify} --data=%{S:0} --signature=%{S:1} --keyring=%{S:2}
 %autosetup -n conntrack-tools-%{version} -p1
 
 %build

packages/conntrack-tools/gpgkey-37D964ACC04981C75500FB9BD55D978A8A1420E4.asc

@@ -0,0 +1,29 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBF+HdQgBEACzteJUJGtj3N6u5mcGh4Nu/9GQfwrrphZuI7jto2N6+ZoURded
+660mFLnax7wgIE8ugAa085jwFWbFY3FzGutUs/kDmnqy9WneYNBLIAF3ZTFfY+oi
+V1C09bBlHKDj9gSEM2TZ/qU14exKdSloqcMKSdIqLQX27w/D6WmO1crDjOKKN9F2
+zjc3uLjo1gIPrY+Kdld29aI0W4gYvNLOo+ewhVC5Q6ymWOdR3eKaP2HIAt8CYf0t
+Sx8ChHdBvXQITDmXoGPLTTiCHBoUzaJ/N8m4AZTuSUTr9g3jUNFmL48OrJjFPhHh
+KDY0V59id5nPu4RX3fa/XW+4FNlrthA5V9dQSIPh7r7uHynDtkcCHT5m4mn0NqG3
+dsUqeYQlrWKCVDTfX/WQB3Rq1tgmOssFG9kZkXcVTmis3KFP1ZAahBRB33OJgSfi
+WKc/mWLMEQcljbysbJzq74Vrjg44DNK7vhAXGoR35kjj5saduxTywdb3iZhGXEsg
+9zqV0uOIfMQsQJQCZTlkqvZibdB3xlRyiCwqlf1eHB2Vo7efWbRIizX2da4c5xUj
++IL1eSPmTV+52x1dYXpn/cSVKJAROtcSmwvMRyjuGOcTNtir0XHCxC5YYBow6tKR
+U1hrFiulCMH80HeS+u/g4SpT4lcv+x0DlN5BfWQuN5k5ZzwKb6EQs092qQARAQAB
+tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC
+VAQTAQoAPhYhBDfZZKzASYHHVQD7m9Vdl4qKFCDkBQJfh3UIAhsDBQkHhM4ABQsJ
+CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENVdl4qKFCDk0msQAJTIK8TLHw2IJDc6
++ZfUJc+znSNwskO+A4lwvb1vRY5qFV+CA2S1eUS4HGDWDT0sPKie6Nx4+FBczkWd
+RA+eaKDqQeS5Vzc2f0bl74un91h7yE8O2NsVnpL166MnAAk3/ACjHsZX2PzF12F6
+4stvGQFpjZRWItj0I6bvPY6CTtqVPB98a6RpdbS9kGxCCMrL3CFGDXGSjXes5KwN
+IvngmVB36wjb3QgEtQIv13jrWFfiXeuieqMRyC6Z3KNYVcvis34eGxPFD9MHrK+w
+bdw3KzMBJd7hMoVRl32Q13T/PX8H3pqWMqKaL41wHUswRt0IQjNZnRvRnlJ0VDFf
+Wep/3dFK+uQbdABuiwCiRli5mWeOMCP+qJodP1OZSGqg0VwZWUGdCGG5+qIhngOj
+QVomvJ7N4eRLU3xuPVjLoBeHzvViUPpYtWQ/YiZK5rWTJHhu88xZaysFJRaV+Uz3
+wPkeqdArRRXl1Tpy+cKy7D5BZAr7OjT1wboon23IM2DJRurbaHD8blMsjZ07pbvb
+4hdpiE6mqq7CYskDz2UGTaFfEW4bFnKtvKTXEnmcqc4mWcr2z9BBYouGmcFczgET
+tE02XejmExXV2RPUtXfLuNIbVpuXG1qhzNuXAfm+S/68XDSFrwyK8/Dgq5ga0iIP
+n8Uvz12Xu/Qde+NicogLNWF90QJ2
+=z7om
+-----END PGP PUBLIC KEY BLOCK-----

packages/coreutils/Cargo.toml

@@ -15,6 +15,10 @@ releases-url = "https://ftp.gnu.org/gnu/coreutils"
 url = "https://ftp.gnu.org/gnu/coreutils/coreutils-9.5.tar.xz"
 sha512 = "2ca0deac4dc10a80fd0c6fd131252e99d457fd03b7bd626a6bc74fe5a0529c0a3d48ce1f5da1d3b3a7a150a1ce44f0fbb6b68a6ac543dfd5baa3e71f5d65401c"
 
+[[package.metadata.build-package.external-files]]
+url = "https://ftp.gnu.org/gnu/coreutils/coreutils-9.5.tar.xz.sig"
+sha512 = "029997e0f4ee64e561853cff7c8a124f58cc891598595b44c4a46f9813b4b71c9d677464bc8a26d294e9971832f4b87c23777fea4fac6e8e30f06ad93b9957d5"
+
 [build-dependencies]
 glibc = { path = "../glibc" }
 libacl = { path = "../libacl" }

packages/coreutils/coreutils.spec

@@ -5,6 +5,8 @@ Summary: A set of basic GNU tools
 License: GPL-3.0-or-later
 URL: https://www.gnu.org/software/coreutils/
 Source0: https://ftp.gnu.org/gnu/coreutils/coreutils-%{version}.tar.xz
+Source1: https://ftp.gnu.org/gnu/coreutils/coreutils-%{version}.tar.xz.sig
+Source2: gpgkey-6C37DC12121A5006BC1DB804DF6FD971306037D9.asc
 BuildRequires: %{_cross_os}glibc-devel
 BuildRequires: %{_cross_os}libacl-devel
 BuildRequires: %{_cross_os}libattr-devel
@@ -21,6 +23,7 @@ Requires: %{_cross_os}libxcrypt
 %{summary}.
 
 %prep
+%{gpgverify} --data=%{S:0} --signature=%{S:1} --keyring=%{S:2}
 %autosetup -n coreutils-%{version} -p1
 
 %build

packages/coreutils/gpgkey-6C37DC12121A5006BC1DB804DF6FD971306037D9.asc

@@ -0,0 +1,75 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBE58fE4BEADGS6VzDkx2OOQMPQedsmBtRs3S5sz9tzO51EwkS779js3Sjt96
+KlQM0SbwtbUxOFor42LRXJKUU9T/Jl3v3+onASvoHAUcuAL15WAhnY9cuQeFOvZP
+/iy0I1+bV0CILrz364T6vL614obnBBdTg8ZqSZM+csRlpGwXJiuY6mkrsPLXakxA
+35n/nAgQOcQPj36CuuvpCH4JKPkzklwUMqueDzXkYMNSdWmVnI+ZSfDmeiwzAbFY
+tE5uGW+c3DzD98RGCLt3FLr86n24IDlaTZSsaWbTJVsur9s4sbp6rST3pspDSQYF
+ShhJ5aqqEYIvPp5kXj2CZJjOFBnIkn+0aDSps+XrnZjJn/f8f9lIAg0/0JjmytHY
+yopo6HFZMdtOvklmnsIuJ/fdyk7761+necYHf5dopVuv29PSu62+A/gnKGfGaqtY
+AjXFfsiLp/+iTQ+LNV4hWFbFKHHZOn4G194pWl6nY1gArwQKPZ5p6uy5EXgiNPRs
+C1CcuVZNJp1RiayhTI68uuI+cldBU6N7+yZKGhjDUQKjIZ3eDB8X7vsCC9S1GgvX
+Hcv8mjcMcHtnoC0w0FiW35JYtAu9mY4+uQhoRPTyPHh+ufX+OdKf7q5BKCppY1r7
+HF1VRFKjSybhEwMeGBdj1EEY413/A8ynpgpHLosPT36n8HtAWUGu+TadZQARAQAB
+tCFQw6FkcmFpZyBCcmFkeSA8UEBkcmFpZ0JyYWR5LmNvbT6JAjsEEwECACUCGwMG
+CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheABQJOfIDXAhkBAAoJEN9v2XEwYDfZ4AEP
+/jr6zmXUVhNiVCtqiHqc4jOs1OPC51iEcMUwpeaEEWHq17uMMIqz+nd8B7CAyjzw
+FJIW4gtwPS3uTsXR2+KOl1VnMS5O/M9suyG5eM+fpCWkzyTC1He/1M9iaRMGY8u2
+wOjZoeY40QFN5fvL/BuC8GLBefI0rTzMaYO0WFlVWTpaemj4pL1Z4JoQdmR49H6O
+qI155jfsXuv2VWjN1NoYT8w3FEugc7rdNWe4dmscU5H54JEQMuFd34X7Ja2S9YnQ
+OdqO/nVQGm3te2X6ElOBoA68HyuXcEozf0KgKkcPrBEV/tjQrzn5Mc7jOgeCDDV3
+7MFwBZUi+z69jjOc85tNYf/FHRfUFnBLPC1HrOIlrraaqydPfvHBRTybTJVhXlQW
+b9kqfrT1HU8UGfwP+5cwTy2WjZecxvozZakYBO4cdcmsSNE5jM8Tp7EU7ktxPXg1
+IQwZ8sEFJN6HRhRVmhK1FyR1hrwdcvfYrFmoYbyWUCW1RNuGw3RXdjXjGSl6VxzC
+vrWXjeiMyLQQ7l7IneFaIPV22quPi/NVJbNeT5DqKa58kYgEVASfZVZkL7S3PJvj
+fEqhw5jTi3l84AHtYNNo95UXWQQCWhpYjZ3q61satme++Eth552VAGP+JK4634mj
+vVViYmWAnjs0efSN9yCOWKDKBONviW5WGZwi7MVtgF6utCJQw6FkcmFpZyBCcmFk
+eSA8cGl4ZWxiZWF0QGdudS5vcmc+iQI4BBMBAgAiBQJOfIC0AhsDBgsJCAcDAgYV
+CAIJCgsEFgIDAQIeAQIXgAAKCRDfb9lxMGA32ageD/4yOr87VGc2DuR1SNErXA5+
+XKbuK2ATySrgbnkQm8tLGjrAiB3tkpSP5y9f6JdCkZFzduJyk1OwpxboSMO3KD5U
+JJYPuoncS3DFV/2Y3dsipZJXA/STyRzU362n4v7/2O976Hsd/utdmg2j6X2HT8Ag
+iv1jIzavVW2ICww0J8P9Ky9zljHh9kdH7ZWQ4t5VvaWp1hV7tmtcO3yqR0EcwK3G
+b72NpjellUMUqTX014jvhXOv36ZifQjQ5lLRxqlS4bv5r4UYjUPHaOfy4v7Hh4sN
+0je++v+8ZalquKQETEarWkApabmAEXXQIM/ifH37mHOM+Km8K5B6tGeMvcVDJdro
+T8akKngyTtJ0HjMwvUKadhTPPifRNxXloWLJoxA+TlMHLHNhdZSqMUnMXCZTTPw7
+L93rhkwYvIDEKXLqAFz8CZfOxSGDaEkHecbclHDZaak4h451ifpLeid8AVPW0aju
+RY0hZjFfl9PuoAdWWcCaCPP7O98HwfCr8HQUNk/ODBhfgt5EwKP1UOymgJWdox3i
+tapsfaUpRT+TRIVG3eICqO9PpY9skgO0QXSJ9TZHv2VppllTmtthZkLnYB87s10s
+/7u7DG09jI50//izQdLR7xYO7KR1ltNoL0odsiIoxb1hdAlGjpi6lYlY6kWk+S/H
+221xBDsLmzxgWNVH/3p1grQiUMOhZHJhaWcgQnJhZHkgPHBicmFkeUByZWRoYXQu
+Y29tPokCHwQwAQIACQUCVp+cpgIdIAAKCRDfb9lxMGA32UftD/9jYqsCfNAzb0vh
+DOaU1AchzaQa1pIKEjoL6d4AMeXFSBpMi4nYJpN+rmM8DAzcbenBcSoIqecdfENp
+3mY+hI8mYdnMiVpldsroEAl/SDxY6//pPd0Dnmoe6sNodBB2uwHxhQi9ubz72iWX
+5WiKP8+OUAj91cLMl9nKIYfcHy3iinSRqT02JP33DGDwsHCoAMmp59g6AHnf0sjC
+tZEtK79MtKiKTkUdMazPVGs81x1jCO2kvvmy0fDZxkGuyso0inae2hsaMSqqoga5
+lC0jQanFIXSEkLZgJgljLmiWPO0IGHPFth/e//51atGUmpdd2ufQ/QVoxSnQKRFQ
+98eO/SQ75bO5vbE8dGv8oX9S3M9NjKOY9VnXC/JDyMXt2aMDs9tqSo22lJuT2Wq2
+0wM5hlszxKI7c9QphnuHyPNtszzXo1+5/UEuCNIQoe59MoscGmx7GN5WvlENaixG
+g7tzpZ+wdftN7BUcpJfCgsEQurHzPEIomlszp3xraX0G84plClas13Ie8CIVM7UP
+bF0Cwx6XwhryjaDTkq3f+mjQXtNJQk487q8cc9dxplslXiDqBYVngV+oDKOjrqc5
+PXSQm2M8EYRn9SXuFnT8iF5SkuFYtgOEj3KNZ04ZB1I7AQebylS2LGwWan8yWJSA
+s22eR9urWBVpmre6GUGZfo7YBdOvbLkCDQROfHxOARAA5hb6RwSG2oH8LMWk6rmP
+thWH5IBE8yw4InTPpsA8V7LyFlNUOH+BuHI8mTpTHk4aRfg3h8wxqw9VfnncWN/H
+69Y6bhgYp8XZ37esQjPrkujaQ7QaLp9EB++96AvF+5pTvf1eBlkhprMXUolw/D3U
+pGnC6uXW2iCjKEjt4HGUG/nJQum9U9fcmZJWrtKFOW8NK/DVJ3iIdh2RmR+DceBD
+XUJF2qL9DEQvhEDAO5uYglC8CwYdHwbdQaWjgLyDMWjr65SQZGbYJ1e+ZxPGGpuc
+fQR89lylNaZwIg/HkFgUbIvGnezleSwfO93ayQ34HVtpecr14TMG/jouh85xCsbs
+X7znnTLtCKzti+EkWRXaNV0D+FvaPKo4jv440vgQZajcPzD9tbYWUfylpg83URVa
+QqZZglg1gLPU166vkB4V/ov6nBjQ+Z6YxJsGvgPVhfBZth8IrckFUINyH5JKAAcw
+PZBtKR0QfUSHW+SxHer4DMLHpsjO39wHO9CIk4EcbLYUJwoEYlFpcnNWNYBwjLqA
+WXuMA+mE2fX/+NoMY1/crOZ46y3dLq0zJfD+LBgORx10j1fFaAj9j36pg43DUewZ
+SwLtBhlYJ/SExW0Rz0xUMU+C/4EJjy7+3ycLV+M8gnJGVwp2+z1H1ESe5bH6hSgA
+RqQ4pOfP9sbM7sNX/y17KMEAEQEAAYkCHwQYAQIACQUCTnx8TgIbDAAKCRDfb9lx
+MGA32aBIEADAGhbCehSjWv8SEw9gUpN+slmIDBnZ7uqQgXjWO5OnG2TrSJyPNAwf
+k6ESY6JeoGuiASL3EpqDvRTVsIvDzzqhNBwVa+mi/q3lof9yNs74dmJYsH0P20+9
+lVzNfWATWUDA4cVYBvONBloCK1cVvn9zqFvfjFBcRbZskcvMBVPxO2Fv4xAzX+om
+PDfCnweY8G7i71Z8Nnl/HVkSZMI9uXrtcde00oISHf5xUebJdx96dxnUCDLPUwPi
+IxxYN44KvIl3cnIB5qwuBV8F2XXUtBdxZDJexqsCIoAD3rhRoWq6E2fRJKeqt/4T
+mxwjsJ8ZODp+ilXhqRe/shHttoOvbo5QBZNZMujxkqxXeu+j2E3Ry5mSiGX1Seww
+bT1iUppwGI15UwhthhrcPwbtWxxIyzPBU6awwlrTrYxNTB1n7WM99gcQctLWZpWn
+EaoAnEmIEcPjnM+c2NRwUJmE/C5h9intY4fOa2a8hpUPx6UbMkfPl0bkIA2cduvQ
+tAFKy/G/Jm4H+0trSmrDc+o+rl7v9sMJ9wKkMUdAcqUgNP0TEHzDPbzvztcKBCLn
+NLoUTKNIN4eNJjMGk8Si/OgiN1NKkuVz7I3i916mVxxlFjKEyLYU4tYYXsbB+ZJy
+4dTP/YWHbQulJYLgju6ZELphkzjc6eM3CaOZ73u4GVXotheeUabUHQ==
+=HaQo
+-----END PGP PUBLIC KEY BLOCK-----

packages/dbus-broker/Cargo.toml

@@ -15,6 +15,10 @@ releases-url = "https://github.com/bus1/dbus-broker/releases/"
 url = "https://github.com/bus1/dbus-broker/releases/download/v36/dbus-broker-36.tar.xz"
 sha512 = "47ff345e27ae2ba41f43a4a6eb09b813583ef43392d1dfa2fc1805578c0ed3a1e414c3eae63f78ca3806904dc017a138e283aa32ba973de51ed613050b244a0f"
 
+[[package.metadata.build-package.external-files]]
+url = "https://github.com/bus1/dbus-broker/releases/download/v36/dbus-broker-36.tar.xz.asc"
+sha512 = "711e3db030cd8d3953e966c11d2afa4c543548f882d3364fc0b79b7cfb3b8d5ecb65b1148429acf80b5ee803305f27f80538bd2f4b30e98da97fd05eb6dc0344"
+
 [build-dependencies]
 glibc = { path = "../glibc" }
 libexpat = { path = "../libexpat" }