Verify upstream sources with GPG
This is now a recommended thing to do: https://docs.fedoraproject.org/en-US/packaging-guidelines/#_source_file_verification Regardless if it adds actual security, it should prevent problems like this one: https://mail.python.org/archives/list/python-dev@python.org/message/OYNQS2BZYABXACBRHBHV4RCEPQU5R6EP/
This commit is contained in:
parent
502df2cc30
commit
606c85efb2
|
@ -9,3 +9,4 @@ Python-3.5.1.tar.xz
|
|||
/Python-3.5.8rc1.tar.xz
|
||||
/Python-3.5.8rc2.tar.xz
|
||||
/Python-3.5.8.tar.xz
|
||||
/Python-3.5.8.tar.xz.asc
|
||||
|
|
File diff suppressed because it is too large
Load Diff
|
@ -79,8 +79,10 @@
|
|||
# ==================
|
||||
# Top-level metadata
|
||||
# ==================
|
||||
Summary: Version 3.5 of the Python programming language
|
||||
Name: python%{pyshortver}
|
||||
Summary: Version %{pybasever} of the Python programming language
|
||||
URL: https://www.python.org/
|
||||
|
||||
%global general_version %{pybasever}.8
|
||||
#global prerel ...
|
||||
%global upstream_version %{general_version}%{?prerel}
|
||||
|
@ -115,6 +117,7 @@ BuildRequires: gdbm-devel
|
|||
BuildRequires: glibc-all-langpacks
|
||||
BuildRequires: glibc-devel
|
||||
BuildRequires: gmp-devel
|
||||
BuildRequires: gnupg2
|
||||
BuildRequires: libffi-devel
|
||||
BuildRequires: libGL-devel
|
||||
BuildRequires: libX11-devel
|
||||
|
@ -164,7 +167,9 @@ Provides: python%{pybasever} = %{version}-%{release}
|
|||
# Source code and patches
|
||||
# =======================
|
||||
|
||||
Source: http://www.python.org/ftp/python/%{general_version}/Python-%{upstream_version}.tar.xz
|
||||
Source0: %{url}ftp/python/%{general_version}/Python-%{upstream_version}.tar.xz
|
||||
Source1: %{url}ftp/python/%{general_version}/Python-%{upstream_version}.tar.xz.asc
|
||||
Source2: %{url}static/files/pubkeys.txt
|
||||
|
||||
# Supply an RPM macro "py_byte_compile" for the python3-devel subpackage
|
||||
# to enable specfiles to selectively byte-compile individual files and paths
|
||||
|
@ -421,8 +426,6 @@ Patch5001: python3-powerppc-arch.patch
|
|||
# Additional metadata, and subpackages
|
||||
# ======================================================
|
||||
|
||||
URL: http://www.python.org/
|
||||
|
||||
# We'll not provide this, on purpose
|
||||
# No package in Fedora shall ever depend on this
|
||||
# Provides: python(abi) = %%{pybasever}
|
||||
|
@ -452,6 +455,7 @@ or older Fedora releases.
|
|||
# ======================================================
|
||||
|
||||
%prep
|
||||
%gpgverify -k2 -s1 -d0
|
||||
%setup -q -n Python-%{upstream_version}
|
||||
|
||||
%if 0%{?with_systemtap}
|
||||
|
|
1
sources
1
sources
|
@ -1 +1,2 @@
|
|||
SHA512 (Python-3.5.8.tar.xz) = ef36b234786a15592f69b0cd38421373e4713e314de847ebe6da4249fb09c467ba2a8d713dde355330ea0be995be4528912f71774e9418dee285ed891d2d2bd5
|
||||
SHA512 (Python-3.5.8.tar.xz.asc) = 9181d8e9fdb71eda72458b52cdf97d613c09bd58cd8dc46e3a749cffbbed28e3792d104a5234a60d0f454c8b73df7b989f4984e95a28155fa7186e6dadae8554
|
||||
|
|
Loading…
Reference in New Issue