From 0eccf8779709f5f761656be8712c8e031b9c60a2 Mon Sep 17 00:00:00 2001
From: Pavel Sanda <sanda@lyx.org>
Date: Tue, 19 Jun 2018 23:53:36 +0200
Subject: [PATCH] lyx-build: check sig in case one really uses download instead
 of local tarball.

---
 development/tools/lyx-build | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/development/tools/lyx-build b/development/tools/lyx-build
index 27b72d5b6b..644cf10464 100755
--- a/development/tools/lyx-build
+++ b/development/tools/lyx-build
@@ -97,6 +97,13 @@ if [ ! -d $BASE/lyx-patch/lyx-$LAST ]; then
     echo "Will try to download from LyX site....";
     pushd $BASE/lyx-patch/;
     wget ftp://ftp.lyx.org/pub/lyx/stable/${FIRST}x/lyx-$LAST.tar.gz;
+    wget ftp://ftp.lyx.org/pub/lyx/stable/${FIRST}x/lyx-$LAST.tar.gz.sig
+    gpg -q --verify lyx-$LAST.tar.gz.sig
+    if ! [ $? == 0 ]; then
+      echo "Signature wrong!"
+      exit 1;
+    fi
+    rm lyx-$LAST.tar.gz.sig
     tar -zxvf lyx-$LAST.tar.gz;
     if [ ! -f lyx-$LAST.tar.gz ]; then
       echo "Still unable to find directory for last version $LAST.";
-- 
2.39.5