feat: verify package signature

agilebits now signs Appimage releases with 3FEF9748469ADBE15DA7CA80AC2D62742012EA22
https://discussions.agilebits.com/discussion/comment/573282#Comment_573282

2 files changed, 15 insertions, 6 deletions

diff --git a/.SRCINFO b/.SRCINFO
index b84cd424ea64..3d3bb2850fec 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,7 +1,7 @@
 pkgbase = 1password
 	pkgdesc = The world's most-loved password manager - read-only development preview
 	pkgver = 0.8.7.26947
-	pkgrel = 2
+	pkgrel = 3
 	url = https://1password.com/
 	arch = x86_64
 	license = unknown
@@ -10,8 +10,11 @@ pkgbase = 1password
 	depends = hicolor-icon-theme
 	noextract = 1password-0.8.7.26947.AppImage
 	options = !strip
-	source = 1password-0.8.7.26947.AppImage::https://onepassword.s3.amazonaws.com/linux/appimage/1password-latest.AppImage
+	source = 1password-0.8.7.26947.AppImage::https://onepassword.s3.amazonaws.com/linux/appimage/1password-0.8.7-1.AppImage
+	source = 1password-0.8.7.26947.AppImage.sig::https://onepassword.s3.amazonaws.com/linux/appimage/1password-0.8.7-1.AppImage.sig
+	validpgpkeys = 3FEF9748469ADBE15DA7CA80AC2D62742012EA22
 	sha256sums = e98de64e42a25172569c7303b253450c831fe011eb1e7a7152b770ef0caae224
+	sha256sums = SKIP
 
 pkgname = 1password
 
diff --git a/PKGBUILD b/PKGBUILD
index 6a492cc3742d..332ed07c2e0e 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -2,17 +2,23 @@
 
 pkgname=1password
 pkgver=0.8.7.26947
-pkgrel=2
+pkgrel=3
+_appimagver=0.8.7-1
+_appimage="${pkgname}-${pkgver}.AppImage"
 pkgdesc="The world's most-loved password manager - read-only development preview"
 arch=('x86_64')
 url='https://1password.com/'
 license=('unknown')
 depends=('fuse2' 'zlib' 'hicolor-icon-theme')
 options=(!strip)
-_appimage="${pkgname}-${pkgver}.AppImage"
-source=("${_appimage}::https://onepassword.s3.amazonaws.com/linux/appimage/1password-latest.AppImage")
+source=("${_appimage}::https://onepassword.s3.amazonaws.com/linux/appimage/1password-${_appimagver}.AppImage"
+        "${_appimage}.sig::https://onepassword.s3.amazonaws.com/linux/appimage/1password-${_appimagver}.AppImage.sig"
+)
 noextract=("${_appimage}")
-sha256sums=('e98de64e42a25172569c7303b253450c831fe011eb1e7a7152b770ef0caae224')
+sha256sums=('e98de64e42a25172569c7303b253450c831fe011eb1e7a7152b770ef0caae224'
+            'SKIP'
+)
+validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')
 
 prepare() {
     chmod +x "${_appimage}"