Use PGP the right way.

2 files changed, 14 insertions, 14 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 8ec603c49693..9df1e69e9bc0 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -22,13 +22,22 @@ pkgbase = firefox-nightly-fr
 	source = firefox-nightly.desktop
 	source = firefox-nightly-safe.desktop
 	source = vendor.js
+	validpgpkeys = 14F26682D0916CDD81E37B6D61B7B526D98F0353
 	sha512sums = 725babc1365e02a30f50aafbc069b04a97cd247f76240b99b0a734dcce0e560f30cfd441efe9b0b9edcc48f327c8adad34e1ae45c2ba047205c84921d5e43e59
 	sha512sums = 2df6b84978ec459ffad3e0d285c816da07a890db30284d3b2bec250472c10e08003edf705278cb97e02a52fb5f1325d962c08d5fbcf98f484e982a97e381407b
 	sha512sums = bae5a952d9b92e7a0ccc82f2caac3578e0368ea6676f0a4bc69d3ce276ef4f70802888f882dda53f9eb8e52911fb31e09ef497188bcd630762e1c0f5293cc010
 	source_i686 = https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla-central-l10n/firefox-49.0a1.fr.linux-i686.tar.bz2
+	source_i686 = https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla-central-l10n/firefox-49.0a1.fr.linux-i686.checksums
+	source_i686 = https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla-central-l10n/firefox-49.0a1.fr.linux-i686.checksums.asc
 	sha512sums_i686 = 8cf53aaee0e3f5a2f6e0dc0f5ab4de19a28a069cac9efed1fd9672cd8e01e12beb5f9da52d112b955f67021dbae1125bf6128d28e91c7ef57e239c75505c36e4
+	sha512sums_i686 = SKIP
+	sha512sums_i686 = SKIP
 	source_x86_64 = https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla-central-l10n/firefox-49.0a1.fr.linux-x86_64.tar.bz2
+	source_x86_64 = https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla-central-l10n/firefox-49.0a1.fr.linux-x86_64.checksums
+	source_x86_64 = https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla-central-l10n/firefox-49.0a1.fr.linux-x86_64.checksums.asc
 	sha512sums_x86_64 = a1f5a2bfbe840fc48c5ba6fc236cad2feeb4b408f840a16cdb118aa0c55e67b7c237a2f91bd0ead1f268902f60422c6d6bc20ab879c38894f26b1549319941d3
+	sha512sums_x86_64 = SKIP
+	sha512sums_x86_64 = SKIP
 
 pkgname = firefox-nightly-fr
 
diff --git a/PKGBUILD b/PKGBUILD
index 2b985f421f71..295bcfa4aa93 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -37,8 +37,8 @@ source=(
     'firefox-nightly-safe.desktop'
     'vendor.js'
 )
-source_i686=("${_url_l10n}/${_file_i686}")
-source_x86_64=("${_url_l10n}/${_file_x86_64}")
+source_i686=("${_url_l10n}/${_file_i686}" "${_url_l10n}/${_sums_i686}"{,.asc})
+source_x86_64=("${_url_l10n}/${_file_x86_64}" "${_url_l10n}/${_sums_x86_64}"{,.asc})
 sha512sums=(
     '725babc1365e02a30f50aafbc069b04a97cd247f76240b99b0a734dcce0e560f30cfd441efe9b0b9edcc48f327c8adad34e1ae45c2ba047205c84921d5e43e59'
     '2df6b84978ec459ffad3e0d285c816da07a890db30284d3b2bec250472c10e08003edf705278cb97e02a52fb5f1325d962c08d5fbcf98f484e982a97e381407b'
@@ -46,8 +46,9 @@ sha512sums=(
 )
 _srcsum_i686="$(curl -s "${_url_l10n}/${_sums_i686}" | grep "${_file_i686}" | grep sha512 | cut -d " " -f1)"
 _srcsum_x86_64="$(curl -s "${_url_l10n}/${_sums_x86_64}" | grep "${_file_x86_64}" | grep sha512 | cut -d " " -f1)"
-sha512sums_i686=("${_srcsum_i686}")
-sha512sums_x86_64=("${_srcsum_x86_64}")
+sha512sums_i686=("${_srcsum_i686}" 'SKIP' 'SKIP')
+sha512sums_x86_64=("${_srcsum_x86_64}" 'SKIP' 'SKIP')
+validpgpkeys=('14F26682D0916CDD81E37B6D61B7B526D98F0353') # Mozilla’s GnuPG release key
 
 pkgver() {
   SRC_VER="${_name}-${_version}.en-US.linux-${CARCH}.txt"
@@ -55,16 +56,6 @@ pkgver() {
   echo "${_version}.$(head -n1 ${SRC_VER} | cut -c -8)"
 }
 
-# Uncomment check() to enable GnuPG signature verification. You’ll need Mozilla’s GnuPG release key.
-# Their current fingerprint is 14F2 6682 D091 6CDD 81E3 7B6D 61B7 B526 D98F 0353
-#check() {
-#  CHECKSUM="${_src}-${CARCH}.checksums"
-#  CHECKSIG="${CHECKSUM}.asc"
-#  curl -OR "${_url_l10n}/${CHECKSUM}"
-#  curl -OR "${_url_l10n}/${CHECKSIG}"
-#  gpg --verify ${CHECKSIG} ${CHECKSUM}
-#}
-
 package() {
   OPT_PATH="/opt/${_name}-${_version}"