On 07/04/2011 10:53 PM, Paul Wouters wrote:
It would be nice if we could upload/commit the .asc or .sig file, and
have the rpmbuild script
automatically check the tar ball.
Hm, yes. It would be nice to see Koji support checking source sigs. OBS
already does so. Seeing as Debian has done this for years with the
source .deb including a signature file, RPM >4.9 could support sigs for
the Source0 file.
In the mean time, perhaps AutoQA could have a check added against the
source checksum?