From: Pavel Sanda <sanda@lyx.org>
Date: Tue, 19 Jun 2018 21:53:36 +0000 (+0200)
Subject: lyx-build: check sig in case one really uses download instead of local tarball.
X-Git-Tag: 2.3.1~69
X-Git-Url: https://git.lyx.org/gitweb/?a=commitdiff_plain;h=0eccf8779709f5f761656be8712c8e031b9c60a2;p=features.git

lyx-build: check sig in case one really uses download instead of local tarball.
---

diff --git a/development/tools/lyx-build b/development/tools/lyx-build
index 27b72d5b6b..644cf10464 100755
--- a/development/tools/lyx-build
+++ b/development/tools/lyx-build
@@ -97,6 +97,13 @@ if [ ! -d $BASE/lyx-patch/lyx-$LAST ]; then
     echo "Will try to download from LyX site....";
     pushd $BASE/lyx-patch/;
     wget ftp://ftp.lyx.org/pub/lyx/stable/${FIRST}x/lyx-$LAST.tar.gz;
+    wget ftp://ftp.lyx.org/pub/lyx/stable/${FIRST}x/lyx-$LAST.tar.gz.sig
+    gpg -q --verify lyx-$LAST.tar.gz.sig
+    if ! [ $? == 0 ]; then
+      echo "Signature wrong!"
+      exit 1;
+    fi
+    rm lyx-$LAST.tar.gz.sig
     tar -zxvf lyx-$LAST.tar.gz;
     if [ ! -f lyx-$LAST.tar.gz ]; then
       echo "Still unable to find directory for last version $LAST.";