diff --git a/.gitignore b/.gitignore
index 0ceead8..10d1a6c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,4 +3,5 @@ TODO
 *.md
 php-5.*.xz
 php-7.*.xz
+php-7.*.xz.asc
 /opcache-default.blacklist
diff --git a/php-keyring.gpg b/php-keyring.gpg
new file mode 100644
index 0000000..fa42e3d
Binary files /dev/null and b/php-keyring.gpg differ
diff --git a/php.spec b/php.spec
index da5d287..5f3b21a 100644
--- a/php.spec
+++ b/php.spec
@@ -65,7 +65,7 @@
 Summary: PHP scripting language for creating dynamic web sites
 Name: php
 Version: %{upver}%{?rcver:~%{rcver}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 # All files licensed under PHP version 3.01, except
 # Zend is licensed under Zend
 # TSRM is licensed under BSD
@@ -88,6 +88,12 @@ Source10: php.ztsmodconf
 Source12: php-fpm.wants
 Source13: nginx-fpm.conf
 Source14: nginx-php.conf
+# See https://secure.php.net/gpg-keys.php
+# With Derick, Peter, Christoph, Stanislav, Sara, and Remi keys
+# Release managers for 7.2, 7.3 and 7.4
+Source20: php-keyring.gpg
+Source21: http://www.php.net/distributions/php-%{upver}%{?rcver}.tar.xz.asc
+
 # Configuration files for some extensions
 Source50: 10-opcache.ini
 Source51: opcache-default.blacklist
@@ -121,6 +127,7 @@ Patch100: php-bug78297.patch
 Patch300: php-5.6.3-datetests.patch
 
 
+BuildRequires: gnupg2
 BuildRequires: bzip2-devel, curl-devel >= 7.9
 BuildRequires: httpd-devel >= 2.0.46-1, pam-devel
 # to ensure we are using httpd with filesystem feature (see #1081453)
@@ -714,6 +721,8 @@ low-level PHP extension for the libsodium cryptographic library.
 
 
 %prep
+%{gpgverify} --keyring='%{SOURCE20}' --signature='%{SOURCE21}' --data='%{SOURCE0}'
+
 %setup -q -n php-%{upver}%{?rcver}
 
 %patch1 -p1 -b .mpmcheck
@@ -1573,6 +1582,9 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || :
 
 
 %changelog
+* Thu Jul 25 2019 Remi Collet <remi@remirepo.net> - 7.3.8~RC1-2
+- add tarball signature check
+
 * Tue Jul 16 2019 Remi Collet <remi@remirepo.net> - 7.3.8~RC1-1
 - update to 7.3.8RC1
 - add upstream patch for #78297
diff --git a/sources b/sources
index a9d3542..22b0174 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 SHA512 (php-7.3.8RC1.tar.xz) = 83cf25160c925cebabbd743db40f000427a77fb93740fa6221c96339ca492c99f71221ba3e750d7a02b4aa6f65249565fe3dcdaab2f789e5abfac5a6a4bbb1a3
+SHA512 (php-7.3.8RC1.tar.xz.asc) = 94f59f064b2c850f59e0af2079d44756246191f13e79e032cd4d726427f9e299def590a3068c156f4bae0dba0cbe33ad2b3aa64b77b993aad0ea8e1f7571af61