diff --git a/.gitignore b/.gitignore
index ab37f1a..4bd7ec0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,3 @@
 /clog
 /nbdkit-*.tar.gz
-/nbdkit-1.2.4.tar.gz.sig
+/nbdkit-*.tar.gz.sig
diff --git a/libguestfs.keyring b/libguestfs.keyring
new file mode 100644
index 0000000..bb3eb55
Binary files /dev/null and b/libguestfs.keyring differ
diff --git a/nbdkit.spec b/nbdkit.spec
index e8e10c5..2fdfe05 100644
--- a/nbdkit.spec
+++ b/nbdkit.spec
@@ -16,6 +16,9 @@
 %global have_python3 1
 %endif
 
+# If we should verify tarball signature with GPGv2.
+%global verify_tarball_signature 1
+
 Name:           nbdkit
 Version:        1.2.4
 Release:        1%{?dist}
@@ -25,6 +28,11 @@ License:        BSD
 URL:            https://github.com/libguestfs/nbdkit
 
 Source0:        http://libguestfs.org/download/nbdkit/%{name}-%{version}.tar.gz
+%if 0%{verify_tarball_signature}
+Source1:        http://libguestfs.org/download/nbdkit/%{name}-%{version}.tar.gz.sig
+# Keyring used to verify tarball signature.
+Source2:       libguestfs.keyring
+%endif
 
 %if 0%{?rhel} == 7
 # On RHEL 7, nothing in the virt stack is shipped on aarch64 and
@@ -59,6 +67,9 @@ BuildRequires:  python3-devel
 BuildRequires:  ocaml >= 4.02.2
 %endif
 BuildRequires:  ruby-devel
+%if 0%{verify_tarball_signature}
+BuildRequires: gnupg2
+%endif
 
 # Only for running the test suite:
 BuildRequires:  /usr/bin/certtool
@@ -364,6 +375,10 @@ plugins for %{name}.
 
 
 %prep
+%if 0%{verify_tarball_signature}
+tmphome="$(mktemp -d)"
+gpgv2 --homedir "$tmphome" --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0}
+%endif
 %setup -q
 %autopatch -p1
 
@@ -621,6 +636,7 @@ popd
 * Sat Jun  9 2018 Richard W.M. Jones <rjones@redhat.com> - 1.2.4-1
 - New stable version 1.2.4.
 - Remove upstream patches.
+- Enable tarball signatures.
 
 * Wed Jun  6 2018 Richard W.M. Jones <rjones@redhat.com> - 1.2.3-1
 - New stable version 1.2.3.