RFE: check GPG signatures

[jasontibbitts]

There's currently a discussion about how to best check GPG signatures on tarballs in packages. Some think the keys should be checked into git and verified as part of the package build process, but there's some disagreement that this is the correct place.

One other possibility is that new-hotness checks signatures somehow when a new version is detected. Obviously something (either the package or anitya) would have to grow the ability to store the data necessary for something to actually verity the signature. I guess it could all be in anitya and thus this is the wrong place to file that ticket, but maybe not. Or maybe you'll think that this isn't a good place to do that, and we'll look to the other possibilities.

[tyll]

For Fedora IMHO the best approach is to store the information in dist-git as proposed here:
https://fedoraproject.org/wiki/PackagingDrafts:GPGSignatures

Then the-new-hotness can check the signature easily by running "fedpkg prep" or running the gpgv command from %setup.

[scfc]

Note that the approach proposed by https://fedoraproject.org/wiki/PackagingDrafts:GPGSignatures is incompatible with the current the-new-hotness because it requires "local" sources à la:

Source0:        http://downloads.sourceforge.net/libhx/libHX-%{version}.tar.xz
Source1:        http://downloads.sourceforge.net/libhx/libHX-%{version}.tar.asc
Source2:        gpgkey-B56B8B9D9915AA8796EDC013DFFF2CDB19FC338D.gpg

gpgkey-B56B8B9D9915AA8796EDC013DFFF2CDB19FC338D.gpg will trigger a failure:

One or more of the specfile's Sources is not a valid URL so we cannot automatically build the new version for you. Please use a URL in your Source declarations if possible.

[tyll]

The error is triggered in this code:
https://github.com/fedora-infra/the-new-hotness/blob/develop/hotness/buildsys.py#L253

I would suggest that the check should be changed to verify that at least one Source-Tag contains a URL instead of requiring that all Source-Tags need to contain URLs. This is also required when we ship custom config files or a README.Fedora file. I might be able to provide a PR if this change would be ok with you.

[jeremycline]

@tyll, yeah, that's definitely a better approach.