From e50441f17b8cfd671e99f4e42e67d60b7c69e9b7 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Tue, 18 Oct 2022 14:09:32 +0100
Subject: [PATCH] Check tarball signature

---
 libguestfs.keyring | Bin 0 -> 2823 bytes
 virt-top.spec      |  19 ++++++++++++++-----
 2 files changed, 14 insertions(+), 5 deletions(-)
 create mode 100644 libguestfs.keyring

diff --git a/libguestfs.keyring b/libguestfs.keyring
new file mode 100644
index 0000000000000000000000000000000000000000..bb3eb5537b7c398a10b7e2b26ca00af011d1a73e
GIT binary patch
literal 2823
zcma*o_cI%g0s!zNh@cv+7)4sDC~4KE_7;1u)D}doT2(9drl?iaDypbGOYOv{*;+Ne
z_NqOjH0s^=-MxG7-Mt^)|M0o{WP+$kwNm-IfHZ)i6Laf8iDHZe#RnxvK!O)6rq(SO
z@nx&>aN10t6koV0fbtX7ACWsLI0FyJ@Pfu|=B(A~m#PuweNW!6ZNw+iE3ku-=2jTl
z-R1Kp&IJO$u+0}F)tr1faEy{Y7^AhU)R~C@f;L|U(;bZA7XFYV$_df=Lk(rcmOkB;
z)S!`^x0lVz=h?HQMv1soy+K~IC@;3ib@n&WJo)^vM=e&012y5w5lC{1Vr$%-f)DP%
zG8>+0I6T|x0-c17DN0oD5G)GJ#Tv0QA`_&1YxON$_gR+nsxWeR@+*U|;ZLu`<~ZZL
zb}lAl0+}{y9KH#`dC0F=fKw4mK4tiq#hTXnNO|A2&LnCbl}J*`J=P6P2w)t%_#~Ni
z<5CX?FlaaK45s4fc+`zxL=1ZQlr;uF8MB%kfJe&QF}FT<xowro@4(Dy{Cm>U2GrLW
zqJoL`^QF5~7La|K*qp<&i|iiuwuG5-c+Y`9hLqVU0-*=rT}zW^h4{n!24-?!w5B5L
zJDHd~YR;~9RmRo6SXRVZTVuupiWE+tcT#U?Vt3D|Yd`JQml+mOs0ksk06veG>Pp2z
z#$gwujCGqx!3oGYFjf5`VZ%40WH@#DMU8px4r`anayTMxVa8S98{78$W{Y!;Tf&rt
zSzNbt%vP(LA0kH72+RFIT%0S@6L1R%0M>KpIoe{ZJ<zPiyqdhMYHqG}o~)7{j<y(C
zYgbphSB}=aZXOQOF(5HgS|A8;pA7W39uPALn2G{IP67hcK|mCgRHXDE5+LX<5X2A+
zproKl_Du9#Zo=eyF+zzHysCQW`3yF<a^`H9>&?|OTt7orQ0hH2yK~J}8JshZ@W!LI
z-M4NO3G6uuXK5#0R%+aih%MZ^WFL9}_K$Qbehiq7*6e-`(+o69#+mu^SL`>(PjE?$
z9v&ppPtvAeurx2;DNmz|ZRT#yC%{HfUf3#G4T^=Mjr9Px1o2T4n<Ytniq4Qx^sH>R
zZ1pdjh{60h=v?i`kcvw;`D)ye0%1PQ9?@pTf4x9Uy*qWbcDF?m^#|U=sZiOQBTv2Y
z(~KQ*e#|T6$(d4Ts2j0br{Rses!aL;(crmXCLY4B&~}|^F%LvR>xZ{aykw4w)kp)G
z4Osxb<}R=Iv!|oBc|z)k#uVLs?9`AhKe_lhLRpA)6F3r*Zqo3lPHe9ol81_qi|G6E
z4o8p3JOnWhHo?+waZ$Tpb-(8=hsu=04#-d2e^N!szo*8Pi~oqA#cCE_@*SO{6sje$
z@TI6RMbo~Lb#1F(g%6Q&6{<mn1ENq?rgtP=MR`X#m3(H9br{2A@yh%Qo^Cz1pWRw>
zGhr{7C@+l6doz=%hN^mxA)?LclnP^x9TpX)wspTkY{ZP}b>$Zd6`^l+ApCE`-U~Y0
z8dQ_!`=HxQOf%|&`*eUUp8m%S1qlC9x|sX|LVV>m!3iJpL3q~u?Yr_&_bqw@GMgtb
zN3h@AXg%lu6!!dYX|f)6XpFTNudSQQe-nF3_5TuMQ>Fowak8uAJT7I5#M21UX135g
zGs~4Rv<`522?`g~<~erUc;O#Fw;!L^bk+?M%vhK)dA(f}R;1HN;I3iF(sri&RGg#@
zmLH6Hvl@qcHG3<o(%-y6xLy|>@}a7PDlc*>8}W{`e__2>^mdZUqS>0?4cjI;Dtk!{
zw(y-Wq;TG}(Orqzk!Z%c%|qPg+y}T~ejB&}4bg}GSaRBuhJ5&ZtU(q$-2TO%x?bKn
zU1C)(Zk#(Ue^|~mKr$>J`z}2l$uKQrztdude9E`_5nY=j(7beJO!_Lu=p~Umx*Bbe
zaaXv_>XI}z5OKTqMuad$__xSPg7-(2T1z6Buf*FzTSBfhvZQ;&s%lAiRiC1qU!;#{
z?a-99*ww>gj$}coPZCZ=kn2x>W_Sm-wW8Tnxif_54<1wj?Yww`ghQ!<%2;(ex~CZS
zA?P=)tdq7Dkzqb|PG;C0ai!-2Q}RaDC$I}%efl;L=XIxts=E7olcp#We%A3nmv>An
zB(K#6d`=!EO{bI5n@^pN{57JI|8!|wis(l^Y83K&k&{mbs*Sg0F_LnBTp6U0nhVFs
zKNtCW5Kw~{od{S8=fq-k&tLtin0=hH{bySx^qNerUuEu@8K=ce1h<!XZIfdnUQH2o
zkisz;vaJE-Q4hIA==iKYt6~(P-Z&Tn2>l}X`QND>DbTX&E$#Fqr>x8dD+%_ia%sA&
z-@-E*k_;lOcEc%6!hgZXyKo9HW@$loJcll?W#7v3av>4)xk)$5uW9Xl12{vPP#z`m
zs2LrYwcDJ&HuK}b>kIRTnf*>e6iy|jj4e6UTDs}z{H{%;>o`28AchP`#1vkm9%H*S
zoU>DWN;;Bf(C({v%Oa!+`GzIYlq}nbB@yDgTO{;r`S7a>(eUJc9dp#8x&m$~?E>Xu
zQZmBuyhnH{K?-A&Xb*XP+gLf1SLt4Z^c%7G#xO1hI(zGmafx@1gQYru<*%)iZ_dBb
z|Bb1aek<TxI<KEl$mZP~LQz=kyr}w<#qp*E05eZ?*$*A?=cbaL*5jpU@+9lG!e>=H
z10)q1$4)>Do*ODQWg)QV#uOR!W%mWq@$ijmO%<)Dw`_}VtiAD7H5t~=RB~bQs5ra`
z{QU>p<x$&YL*k8pAW-dx$chMT$90)t*!v1NK<&Ou-SK81&?DdiM*yc;`sFv+Zg#EN
z8b?=xA<Av)V<$1B$fiOj8OCoHld~t+(D<SFAsVJ-oIJepBbS=U&zN78Qnc&cb~*%A
zkfID++-o{&ytionDQp4@kph%6@xxq|IQPlb7@*2^n>G`sAB!wj<-$;hilBy>4_~OJ
z%0_>c24yng<lo6M#*#62%^4k@-}+~2F`#>-j6e{8;$K_c_|KG(_0Vgl=ucn~i1=x;
zm1?xq_{fi_!ESgT8TSC6zV8=KU~}{8(Uba&{@Aa*HUiPNuMfwx8iMynCX$p_SHS1q
z?H$wO+UHHDDFVH{JO$}0dbDQ~KlwK(d(_iUCGf`Lc9V*IhQhxeD>9vpy|`)~+um=D
zg<8_$!w*H}5~0!TlT&@NLjHT=7oM!nTRWd6X`@!!wmnL&U!>jUUx&4}yFY={wB8Nh
zA0w#m_%Uc5ra3z_s6d+}gYQb!bB$suWZS)^%eRI~!J$G4-{nibYcoyw$8F-)9GhwL
zf^`wukA9opp_kHg$rT81yy?ZwxKcCuY&Q-Tgt#e|=%fp}c+1aw|3(R~opy=CE+z?b
z(>ZkYs>9)myz%Pn7-DP|f|$$RG@K;3*Nl@9ueJ1h%e-Y|PoG^3Zj$gJ#i&h}JG=F9
zm>>;qK4MTXwg%V0Aa!hzB$@>;3Lj>+*kFFI<>e{edDH)+`)Mn$^g1(hKL{1kC+A_C
zjW|_`i^xn9b9DCEvrOrD6cpeXE)tMl%g%g8133|+O&aU#Vo9Kcq<WViNMrGY<8E2D
zk@HXw)%n{qt|eW{H*AG^oC;~$*CoZ9k0Rg|KXO+9eJn!o&Pj*4O-(B!*ip6p*_wj8
mAr~0KYkj!ddXR=vhyG!WGpK}Pa+L{K-LdU)InmXx_WuA;2Rga{

literal 0
HcmV?d00001

diff --git a/virt-top.spec b/virt-top.spec
index 7fbd2e3..5e3ad72 100644
--- a/virt-top.spec
+++ b/virt-top.spec
@@ -1,7 +1,7 @@
 %undefine _package_note_flags
 Name:           virt-top
 Version:        1.1.1
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        Utility like top(1) for displaying virtualization stats
 License:        GPLv2+
 
@@ -12,10 +12,14 @@ ExcludeArch:    %{power64}
 
 URL:            http://people.redhat.com/~rjones/virt-top/
 Source0:        http://people.redhat.com/~rjones/virt-top/files/%{name}-%{version}.tar.gz
+Source1:        http://people.redhat.com/~rjones/virt-top/files/%{name}-%{version}.tar.gz.sig
 
 # Post-process output of CSV file (RHBZ#665817, RHBZ#912020).
-Source1:        processcsv.py
-Source2:        processcsv.py.pod
+Source2:        processcsv.py
+Source3:        processcsv.py.pod
+
+# Keyring used to verify tarball signature.
+Source4:        libguestfs.keyring
 
 # Adds a link to processcsv to the man page.  This patch is only
 # included in RHEL builds.
@@ -41,6 +45,7 @@ BuildRequires:  libxml2-devel
 BuildRequires:  perl-interpreter
 BuildRequires:  perl(Pod::Perldoc)
 BuildRequires:  gawk
+BuildRequires:  gnupg2
 
 
 %description
@@ -53,6 +58,7 @@ different virtualization systems.
 
 
 %prep
+%{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q
 
 %if 0%{?rhel} >= 6
@@ -72,7 +78,7 @@ make -C src virt-top.1
 %if 0%{?rhel} >= 6
 # Build processcsv.py.1.
 pod2man -c "Virtualization Support" --release "%{name}-%{version}" \
-  %{SOURCE2} > processcsv.py.1
+  %{SOURCE3} > processcsv.py.1
 %endif
 
 
@@ -88,7 +94,7 @@ install -m 0644 src/virt-top.1 $RPM_BUILD_ROOT%{_mandir}/man1
 
 %if 0%{?rhel} >= 6
 # Install processcsv.py.
-install -m 0755 %{SOURCE1} $RPM_BUILD_ROOT%{_bindir}
+install -m 0755 %{SOURCE2} $RPM_BUILD_ROOT%{_bindir}
 
 # Install processcsv.py(1).
 install -m 0644 processcsv.py.1 $RPM_BUILD_ROOT%{_mandir}/man1/
@@ -106,6 +112,9 @@ install -m 0644 processcsv.py.1 $RPM_BUILD_ROOT%{_mandir}/man1/
 
 
 %changelog
+* Tue Oct 18 2022 Richard W.M. Jones <rjones@redhat.com> - 1.1.1-6
+- Check tarball signature
+
 * Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.1-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild