libports: Verify signatures of 3rd-party code

This patch adds integrity checks for the packages of the libports repository. Issue #748
2013-05-25 14:50:46 +02:00 · 2013-05-25 14:50:46 +02:00 · 056e0792e5
parent a140f134c7
commit 056e0792e5
18 changed files with 173 additions and 42 deletions
--- a/libports/ports/curl.mk
+++ b/libports/ports/curl.mk
@ -1,7 +1,11 @@
 include ports/curl.inc

-CURL_TGZ = $(CURL).tar.gz
-CURL_URL = http://curl.haxx.se/download/$(CURL_TGZ)
+CURL_TGZ      = $(CURL).tar.gz
+CURL_SIG      = $(CURL_TGZ).asc
+CURL_BASE_URL = http://curl.haxx.se/download
+CURL_URL      = $(CURL_BASE_URL)/$(CURL_TGZ)
+CURL_URL_SIG  = $(CURL_BASE_URL)/$(CURL_SIG)
+CURL_KEY      = daniel@haxx.se

 #
 # Interface to top-level prepare Makefile
@ -17,6 +21,8 @@ $(CONTRIB_DIR)/$(CURL): clean-curl
 #
 $(DOWNLOAD_DIR)/$(CURL_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(CURL_URL) && touch $@
+	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(CURL_URL_SIG) && touch $@
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(CURL_TGZ) $(DOWNLOAD_DIR)/$(CURL_SIG) $(CURL_KEY)

 $(CONTRIB_DIR)/$(CURL): $(DOWNLOAD_DIR)/$(CURL_TGZ)
 	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
--- a/libports/ports/freetype.mk
+++ b/libports/ports/freetype.mk
@ -1,6 +1,10 @@
-FREETYPE     = freetype-2.3.9
-FREETYPE_TGZ = $(FREETYPE).tar.gz
-FREETYPE_URL = http://mirrors.zerg.biz/nongnu/freetype/freetype-old/$(FREETYPE_TGZ)
+FREETYPE          = freetype-2.3.9
+FREETYPE_TGZ      = $(FREETYPE).tar.gz
+FREETYPE_SIG      = $(FREETYPE_TGZ).sig
+FREETYPE_BASE_URL = http://mirrors.zerg.biz/nongnu/freetype/freetype-old
+FREETYPE_URL      = $(FREETYPE_BASE_URL)/$(FREETYPE_TGZ)
+FREETYPE_URL_SIG  = $(FREETYPE_BASE_URL)/$(FREETYPE_SIG)
+FREETYPE_KEY      = wl@gnu.org

 #
 # Interface to top-level prepare Makefile
@ -16,6 +20,8 @@ $(CONTRIB_DIR)/$(FREETYPE): clean-freetype
 #
 $(DOWNLOAD_DIR)/$(FREETYPE_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(FREETYPE_URL) && touch $@
+	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(FREETYPE_URL_SIG) && touch $@
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(FREETYPE_TGZ) $(DOWNLOAD_DIR)/$(FREETYPE_SIG) $(FREETYPE_KEY)

 $(CONTRIB_DIR)/$(FREETYPE): $(DOWNLOAD_DIR)/$(FREETYPE_TGZ)
 	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
--- a/libports/ports/fribidi.mk
+++ b/libports/ports/fribidi.mk
@ -1,7 +1,13 @@
 include ports/fribidi.inc

-FRIBIDI_TBZ2 = $(FRIBIDI).tar.bz2
-FRIBIDI_URL  = http://fribidi.org/download/$(FRIBIDI_TBZ2)
+FRIBIDI_TBZ2     = $(FRIBIDI).tar.bz2
+FRIBIDI_SHA      = $(FRIBIDI_TBZ2).sha256
+FRIBIDI_SHA_SIG  = $(FRIBIDI_TBZ2).sha256.asc
+FRIBIDI_BASE_URL = http://fribidi.org/download
+FRIBIDI_URL      = $(FRIBIDI_BASE_URL)/$(FRIBIDI_TBZ2)
+FRIBIDI_URL_SHA  = $(FRIBIDI_BASE_URL)/$(FRIBIDI_SHA)
+FRIBIDI_URL_SIG  = $(FRIBIDI_BASE_URL)/$(FRIBIDI_SHA_SIG)
+FRIBIDI_KEY      = D3531115

 #
 # Interface to top-level prepare Makefile
@ -17,6 +23,13 @@ $(CONTRIB_DIR)/$(FRIBIDI):clean-fribidi
 #
 $(DOWNLOAD_DIR)/$(FRIBIDI_TBZ2):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(FRIBIDI_URL) && touch $@
+	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(FRIBIDI_URL_SHA) && touch $@
+	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(FRIBIDI_URL_SIG) && touch $@
+	# XXX fribidi does NOT create a detached signature and thus the signature
+	# checking is useless !!! -- somebody should inform them
+	# see http://blog.terryburton.co.uk/2006/11/falling-into-trap-with-gpg.html
+	#$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(FRIBIDI_SHA) $(DOWNLOAD_DIR)/$(FRIBIDI_SHA_SIG) $(FRIBIDI_KEY)
+	$(VERBOSE)$(HASHVERIFIER) $(DOWNLOAD_DIR)/$(FRIBIDI_TBZ2) $(DOWNLOAD_DIR)/$(FRIBIDI_SHA) sha256

 $(CONTRIB_DIR)/$(FRIBIDI): $(DOWNLOAD_DIR)/$(FRIBIDI_TBZ2)
 	$(VERBOSE)tar xfj $< -C $(CONTRIB_DIR) && touch $@
--- a/libports/ports/gmp.mk
+++ b/libports/ports/gmp.mk
@ -1,6 +1,10 @@
-GMP      = gmp-4.3.2
-GMP_TBZ2 = $(GMP).tar.bz2
-GMP_URL  = ftp://ftp.gmplib.org/pub/$(GMP)/$(GMP_TBZ2)
+GMP          = gmp-4.3.2
+GMP_TBZ2     = $(GMP).tar.bz2
+GMP_SIG      = $(GMP_TBZ2).sig
+GMP_BASE_URL = ftp://ftp.gmplib.org/pub/$(GMP)
+GMP_URL      = $(GMP_BASE_URL)/$(GMP_TBZ2)
+GMP_URL_SIG  = $(GMP_BASE_URL)/$(GMP_SIG)
+GMP_KEY      = "73D46C3667461E4BD93972495D6D47DFDB899F46 343C2FF0FBEE5EC2EDBEF399F3599FF828C67298"

 #
 # Interface to top-level prepare Makefile
@ -30,6 +34,8 @@ $(CONTRIB_DIR)/$(GMP): clean-gmp
 #
 $(DOWNLOAD_DIR)/$(GMP_TBZ2):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(GMP_URL) && touch $@
+	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(GMP_URL_SIG) && touch $@
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(GMP_TBZ2) $(DOWNLOAD_DIR)/$(GMP_SIG) $(GMP_KEY)

 $(CONTRIB_DIR)/$(GMP): $(DOWNLOAD_DIR)/$(GMP_TBZ2)
 	$(VERBOSE)tar xfj $< -C $(CONTRIB_DIR) && touch $@
--- a/libports/ports/libav.mk
+++ b/libports/ports/libav.mk
@ -1,7 +1,20 @@
 include lib/import/import-av.inc

-LIBAV_TGZ = $(LIBAV).tar.gz
-LIBAV_URL = http://www.libav.org/releases/$(LIBAV_TGZ)
+LIBAV_TGZ      = $(LIBAV).tar.gz
+LIBAV_SIG      = $(LIBAV_TGZ).asc
+LIBAV_SHA      = $(LIBAV_TGZ).sha1
+LIBAV_BASE_URL = http://www.libav.org/releases
+LIBAV_URL      = $(LIBAV_BASE_URL)/$(LIBAV_TGZ)
+LIBAV_URL_SIG  = $(LIBAV_BASE_URL)/$(LIBAV_SIG)
+LIBAV_URL_SHA  = $(LIBAV_BASE_URL)/$(LIBAV_SHA)
+
+#
+# XXX Add hash verification for libav downloads. Note: signatures are provided
+#     for newer versions. Therefore, all is prepared in the make file for
+#     enabling the signature check. However, the signature check is yet
+#     commented out.
+#
+#LIBAV_KEY     = UNCLEAR WHAT GOES IN HERE

 #
 # Interface to top-level prepare Makefile
@ -17,6 +30,10 @@ $(CONTRIB_DIR)/$(LIBAV): clean-libav
 #
 $(DOWNLOAD_DIR)/$(LIBAV_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(LIBAV_URL) && touch $@
+	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(LIBAV_URL_SHA) && touch $@
+	#$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(LIBAV_URL_SIG) && touch $@
+	# XXX The following hash verification does not ensure authenticity
+	$(VERBOSE)$(HASHVERIFIER) $(DOWNLOAD_DIR)/$(LIBAV_TGZ) $(DOWNLOAD_DIR)/$(LIBAV_SHA) sha1

 $(CONTRIB_DIR)/$(LIBAV): $(DOWNLOAD_DIR)/$(LIBAV_TGZ)
 	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
--- a/libports/ports/libiconv.mk
+++ b/libports/ports/libiconv.mk
@ -1,6 +1,10 @@
-LIBICONV     = libiconv-1.14
-LIBICONV_TGZ = $(LIBICONV).tar.gz
-LIBICONV_URL = http://ftp.gnu.org/pub/gnu/libiconv/$(LIBICONV_TGZ)
+LIBICONV          = libiconv-1.14
+LIBICONV_TGZ      = $(LIBICONV).tar.gz
+LIBICONV_SIG      = $(LIBICONV_TGZ).sig
+LIBICONV_BASE_URL = http://ftp.gnu.org/pub/gnu/libiconv
+LIBICONV_URL      = $(LIBICONV_BASE_URL)//$(LIBICONV_TGZ)
+LIBICONV_URL_SIG  = $(LIBICONV_BASE_URL)//$(LIBICONV_SIG)
+LIBICONV_KEY      = GNU

 #
 # Interface to top-level prepare Makefile
@ -14,6 +18,8 @@ prepare-libiconv: $(CONTRIB_DIR)/$(LIBICONV) include/iconv
 #
 $(DOWNLOAD_DIR)/$(LIBICONV_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(LIBICONV_URL) && touch $@
+	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(LIBICONV_URL_SIG) && touch $@
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(LIBICONV_TGZ) $(DOWNLOAD_DIR)/$(LIBICONV_SIG) $(LIBICONV_KEY)

 $(CONTRIB_DIR)/$(LIBICONV): $(DOWNLOAD_DIR)/$(LIBICONV_TGZ)
 	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
--- a/libports/ports/libssh.mk
+++ b/libports/ports/libssh.mk
@ -1,7 +1,16 @@
 include ports/libssh.inc

-LIBSSH_TGZ = $(LIBSSH).tar.gz
-LIBSSH_URL = https://red.libssh.org/attachments/download/41/$(LIBSSH_TGZ)
+LIBSSH_TGZ     = $(LIBSSH).tar.gz
+LIBSSH_SIG     = $(LIBSSH).tar.asc
+LIBSSH_URL     = https://red.libssh.org/attachments/download/41/$(LIBSSH_TGZ)
+LIBSSH_URL_SIG = https://red.libssh.org/attachments/download/42/$(LIBSSH_SIG)
+
+#
+# XXX The signature check for libssh is prepared but yet disabled. The source
+#     for the verification PGP key is yet unknown. If the PGP key becomes
+#     known, just add it to the _KEY variable.
+#
+LIBSSH_KEY = FIXME

 #
 # Interface to top-level prepare Makefile
@ -17,6 +26,9 @@ $(CONTRIB_DIR)/$(LIBSSH): clean-libssh
 #
 $(DOWNLOAD_DIR)/$(LIBSSH_TGZ):
 	$(VERBOSE)wget --no-check-certificate -c -P $(DOWNLOAD_DIR) $(LIBSSH_URL) && touch $@
+	$(VERBOSE)wget --no-check-certificate -c -P $(DOWNLOAD_DIR) $(LIBSSH_URL_SIG) && touch $@
+	# We have no key at the moment
+	#$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(LIBSSH_TGZ) $(DOWNLOAD_DIR)/$(LIBSSH_SIG) $(LIBSSH_KEY)

 $(CONTRIB_DIR)/$(LIBSSH): $(DOWNLOAD_DIR)/$(LIBSSH_TGZ)
 	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
--- a/libports/ports/lua.mk
+++ b/libports/ports/lua.mk
@ -1,6 +1,7 @@
 LUA     = lua-5.1.5
 LUA_TGZ = $(LUA).tar.gz
 LUA_URL = http://www.lua.org/ftp/$(LUA_TGZ)
+LUA_SHA = b3882111ad02ecc6b972f8c1241647905cb2e3fc

 #
 # Interface to top-level prepare Makefile
@ -18,6 +19,7 @@ $(CONTRIB_DIR)/$(LUA): clean-lua
 #
 $(DOWNLOAD_DIR)/$(LUA_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(LUA_URL) && touch $@
+	$(VERBOSE)$(HASHVERIFIER) $(DOWNLOAD_DIR)/$(LUA_TGZ) $(LUA_SHA) sha1

 $(CONTRIB_DIR)/$(LUA): $(DOWNLOAD_DIR)/$(LUA_TGZ)
 	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
--- a/libports/ports/mpc.mk
+++ b/libports/ports/mpc.mk
@ -1,7 +1,13 @@
 include lib/import/import-mpc.mk

-MPC_TGZ = $(MPC).tar.gz
-MPC_URL = http://www.multiprecision.org/mpc/download/$(MPC_TGZ)
+MPC_TGZ      = $(MPC).tar.gz
+MPC_SIG      = $(MPC_TGZ).asc
+MPC_BASE_URL = http://www.multiprecision.org/mpc/download
+MPC_URL      = $(MPC_BASE_URL)/$(MPC_TGZ)
+MPC_URL_SIG  = $(MPC_BASE_URL)/$(MPC_SIG)
+# see http://www.multiprecision.org/index.php?prog=mpc&page=download
+MPC_KEY      = AD17A21EF8AED8F1CC02DBD9F7D5C9BF765C61E3
+

 #
 # Interface to top-level prepare Makefile
@ -19,6 +25,8 @@ $(CONTRIB_DIR)/$(MPC): clean-mpc
 #
 $(DOWNLOAD_DIR)/$(MPC_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(MPC_URL) && touch $@
+	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(MPC_URL_SIG) && touch $@
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(MPC_TGZ) $(DOWNLOAD_DIR)/$(MPC_SIG) $(MPC_KEY)

 $(CONTRIB_DIR)/$(MPC): $(DOWNLOAD_DIR)/$(MPC_TGZ)
 	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
--- a/libports/ports/mpfr.mk
+++ b/libports/ports/mpfr.mk
@ -1,6 +1,10 @@
-MPFR     = mpfr-3.0.0
-MPFR_TGZ = $(MPFR).tar.gz
-MPFR_URL = http://www.mpfr.org/$(MPFR)/$(MPFR_TGZ)
+MPFR          = mpfr-3.0.0
+MPFR_TGZ      = $(MPFR).tar.gz
+MPFR_SIG      = $(MPFR_TGZ).asc
+MPFR_BASE_URL = http://www.mpfr.org/$(MPFR)
+MPFR_URL      = $(MPFR_BASE_URL)/$(MPFR_TGZ)
+MPFR_URL_SIG  = $(MPFR_BASE_URL)/$(MPFR_SIG)
+MPFR_KEY      = GNU

 #
 # Interface to top-level prepare Makefile
@ -18,6 +22,8 @@ $(CONTRIB_DIR)/$(MPFR): clean-mpfr
 #
 $(DOWNLOAD_DIR)/$(MPFR_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(MPFR_URL) && touch $@
+	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(MPFR_URL_SIG) && touch $@
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(MPFR_TGZ) $(DOWNLOAD_DIR)/$(MPFR_SIG) $(MPFR_KEY)

 $(CONTRIB_DIR)/$(MPFR): $(DOWNLOAD_DIR)/$(MPFR_TGZ)
 	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
--- a/libports/ports/ncurses.mk
+++ b/libports/ports/ncurses.mk
@ -1,6 +1,10 @@
-NCURSES     := ncurses-5.9
-NCURSES_TGZ := $(NCURSES).tar.gz
-NCURSES_URL := http://ftp.gnu.org/pub/gnu/ncurses/$(NCURSES_TGZ)
+NCURSES          := ncurses-5.9
+NCURSES_TGZ      := $(NCURSES).tar.gz
+NCURSES_SIG      := $(NCURSES_TGZ).sig
+NCURSES_BASE_URL := http://ftp.gnu.org/pub/gnu/ncurses
+NCURSES_URL      := $(NCURSES_BASE_URL)/$(NCURSES_TGZ)
+NCURSES_URL_SIG  := $(NCURSES_BASE_URL)/$(NCURSES_SIG)
+NCURSES_KEY      := GNU

 #
 # Interface to top-level prepare Makefile
@ -38,6 +42,8 @@ $(NCURSES_GEN_SYMLINKS) $(NCURSES_GEN_FILES): $(CONTRIB_DIR)/$(NCURSES) src/lib/
 #
 $(DOWNLOAD_DIR)/$(NCURSES_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(NCURSES_URL) && touch $@
+	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(NCURSES_URL_SIG) && touch $@
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(NCURSES_TGZ) $(DOWNLOAD_DIR)/$(NCURSES_SIG) $(NCURSES_KEY)

 $(CONTRIB_DIR)/$(NCURSES): $(DOWNLOAD_DIR)/$(NCURSES_TGZ)
 	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
--- a/libports/ports/openssl.mk
+++ b/libports/ports/openssl.mk
@ -1,10 +1,14 @@
-OPENSSL_VERSION = 1.0.1c
-OPENSSL         = openssl-$(OPENSSL_VERSION)
-OPENSSL_TGZ     = $(OPENSSL).tar.gz
-OPENSSL_URL     = https://www.openssl.org/source/$(OPENSSL_TGZ)
+OPENSSL_VERSION  = 1.0.1c
+OPENSSL          = openssl-$(OPENSSL_VERSION)
+OPENSSL_TGZ      = $(OPENSSL).tar.gz
+OPENSSL_SIG      = $(OPENSSL_TGZ).asc
+OPENSSL_BASE_URL = https://www.openssl.org/source
+OPENSSL_URL      = $(OPENSSL_BASE_URL)/$(OPENSSL_TGZ)
+OPENSSL_URL_SIG  = $(OPENSSL_BASE_URL)/$(OPENSSL_SIG)
+OPENSSL_KEY      = "49A563D9 26BB437D F295C759 9C58A66D 2118CF83 F709453B 5A6A9B85"

 # local openssl src
-OPENSSL_SRC     = src/lib/openssl
+OPENSSL_SRC      = src/lib/openssl

 #
 # Interface to top-level prepare Makefile
@ -20,6 +24,8 @@ prepare-openssl: $(CONTRIB_DIR)/$(OPENSSL) include/openssl generate_asm
 #
 $(DOWNLOAD_DIR)/$(OPENSSL_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(OPENSSL_URL) && touch $@
+	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(OPENSSL_URL_SIG) && touch $@
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(OPENSSL_TGZ) $(DOWNLOAD_DIR)/$(OPENSSL_SIG) $(OPENSSL_KEY)

 $(CONTRIB_DIR)/$(OPENSSL): $(DOWNLOAD_DIR)/$(OPENSSL_TGZ)
 	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
--- a/libports/ports/pcre.mk
+++ b/libports/ports/pcre.mk
@ -1,7 +1,11 @@
 include ports/pcre.inc

-PCRE_TBZ = $(PCRE).tar.bz2
-PCRE_URL = ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/$(PCRE_TBZ)
+PCRE_TBZ      = $(PCRE).tar.bz2
+PCRE_SIG      = $(PCRE_TBZ).sig
+PCRE_BASE_URL = ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre
+PCRE_URL      = $(PCRE_BASE_URL)/$(PCRE_TBZ)
+PCRE_URL_SIG  = $(PCRE_BASE_URL)/$(PCRE_SIG)
+PCRE_KEY      = ph10@cam.ac.uk

 #
 # Interface to top-level prepare Makefile
@ -17,6 +21,8 @@ $(CONTRIB_DIR)/$(PCRE): clean-pcre
 #
 $(DOWNLOAD_DIR)/$(PCRE_TBZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(PCRE_URL) && touch $@
+	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(PCRE_URL_SIG) && touch $@
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(PCRE_TBZ) $(DOWNLOAD_DIR)/$(PCRE_SIG) $(PCRE_KEY)

 $(CONTRIB_DIR)/$(PCRE): $(DOWNLOAD_DIR)/$(PCRE_TBZ)
 	$(VERBOSE)tar xfj $< -C $(CONTRIB_DIR) && touch $@
--- a/libports/ports/python.mk
+++ b/libports/ports/python.mk
@ -1,6 +1,10 @@
-PYTHON     = python-2.6.4
-PYTHON_TGZ = Python-2.6.4.tgz
-PYTHON_URL = http://www.python.org/ftp/python/2.6.4/$(PYTHON_TGZ)
+PYTHON          = python-2.6.4
+PYTHON_TGZ      = Python-2.6.4.tgz
+PYTHON_SIG      = $(PYTHON_TGZ).asc
+PYTHON_BASE_URL = http://www.python.org/ftp/python/2.6.4
+PYTHON_URL      = $(PYTHON_BASE_URL)/$(PYTHON_TGZ)
+PYTHON_URL_SIG  = $(PYTHON_BASE_URL)/$(PYTHON_SIG)
+PYTHON_KEY      = 12EF3DC38047DA382D18A5B999CDEA9DA4135B38

 #
 # Interface to top-level prepare Makefile
@ -16,6 +20,13 @@ $(CONTRIB_DIR)/$(PYTHON): clean-python
 #
 $(DOWNLOAD_DIR)/$(PYTHON_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(PYTHON_URL) && touch $@
+	#
+	# As signatures are only provided for versions 2.7.3 and newer, the check
+	# is yet disabled. Just remove the comment sign once the newer version is
+	# used.
+	#
+	#$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(PYTHON_URL_SIG) && touch $@
+	#$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(PYTHON_TGZ) $(DOWNLOAD_DIR)/$(PYTHON_SIG) $(PYTHON_KEY)

 $(CONTRIB_DIR)/$(PYTHON): $(DOWNLOAD_DIR)/$(PYTHON_TGZ)
 	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR)
--- a/libports/ports/readline.mk
+++ b/libports/ports/readline.mk
@ -1,6 +1,10 @@
-READLINE     = readline-6.0
-READLINE_TGZ = $(READLINE).tar.gz
-READLINE_URL = ftp://ftp.gnu.org/gnu/readline/$(READLINE_TGZ)
+READLINE          = readline-6.0
+READLINE_TGZ      = $(READLINE).tar.gz
+READLINE_SIG      = $(READLINE_TGZ).sig
+READLINE_BASE_URL = ftp://ftp.gnu.org/gnu/readline
+READLINE_URL      = $(READLINE_BASE_URL)/$(READLINE_TGZ)
+READLINE_URL_SIG  = $(READLINE_BASE_URL)/$(READLINE_SIG)
+READLINE_KEY      = GNU

 #
 # Interface to top-level prepare Makefile
@ -16,6 +20,8 @@ $(CONTRIB_DIR)/$(READLINE): clean-readline
 #
 $(DOWNLOAD_DIR)/$(READLINE_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(READLINE_URL) && touch $@
+	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(READLINE_URL_SIG) && touch $@
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(READLINE_TGZ) $(DOWNLOAD_DIR)/$(READLINE_SIG) $(READLINE_KEY)

 READLINE_HEADERS := rlstdc.h rltypedefs.h keymaps.h tilde.h

--- a/libports/ports/sdl.mk
+++ b/libports/ports/sdl.mk
@ -1,7 +1,11 @@
 include ports/sdl.inc

-SDL_TGZ = $(SDL).tar.gz
-SDL_URL = http://www.libsdl.org/release/$(SDL_TGZ)
+SDL_TGZ      = $(SDL).tar.gz
+SDL_SIG      = $(SDL_TGZ).sig
+SDL_BASE_URL = http://www.libsdl.org/release
+SDL_URL      = $(SDL_BASE_URL)/$(SDL_TGZ)
+SDL_URL_SIG  = $(SDL_BASE_URL)/$(SDL_SIG)
+SDL_KEY      = 1528635D8053A57F77D1E08630A59377A7763BE6

 #
 # Interface to top-level prepare Makefile
@ -20,6 +24,8 @@ $(CONTRIB_DIR)/$(SDL): clean-sdl
 #
 $(DOWNLOAD_DIR)/$(SDL_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(SDL_URL) && touch $@
+	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(SDL_URL_SIG) && touch $@
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(SDL_TGZ) $(DOWNLOAD_DIR)/$(SDL_SIG) $(SDL_KEY)

 $(CONTRIB_DIR)/$(SDL): $(DOWNLOAD_DIR)/$(SDL_TGZ)
 	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
--- a/libports/ports/stdcxx.mk
+++ b/libports/ports/stdcxx.mk
@ -1,7 +1,11 @@
 include ports/stdcxx.inc

-STDCXX_TBZ2 = $(STDCXX).tar.bz2
-STDCXX_URL  = ftp://ftp.fu-berlin.de/gnu/gcc/gcc-$(STDCXX_VERSION)/gcc-$(STDCXX_VERSION).tar.bz2
+STDCXX_TBZ2     = $(STDCXX).tar.bz2
+STDCXX_SIG      = gcc-$(STDCXX_VERSION).tar.bz2.sig
+STDCXX_BASE_URL = ftp://ftp.fu-berlin.de/gnu/gcc/gcc-$(STDCXX_VERSION)
+STDCXX_URL      = $(STDCXX_BASE_URL)/gcc-$(STDCXX_VERSION).tar.bz2
+STDCXX_URL_SIG  = $(STDCXX_BASE_URL)/$(STDCXX_SIG)
+STDCXX_KEY      = GNU

 #
 # Interface to top-level prepare Makefile
@ -40,6 +44,8 @@ $(CONTRIB_DIR)/$(STDCXX): clean-stdcxx
 #
 $(DOWNLOAD_DIR)/$(STDCXX_TBZ2):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) -O$@ $(STDCXX_URL) && touch $@
+	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(STDCXX_URL_SIG) && touch $@
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(STDCXX_TBZ2) $(DOWNLOAD_DIR)/$(STDCXX_SIG) $(STDCXX_KEY)

 $(CONTRIB_DIR)/$(STDCXX): $(DOWNLOAD_DIR)/$(STDCXX_TBZ2)
 	@#$(VERBOSE)tar xfj $< --transform "s/nova-userland/vancouver/" -C $(CONTRIB_DIR)
--- a/libports/ports/zlib.mk
+++ b/libports/ports/zlib.mk
@ -2,6 +2,7 @@ ZLIB_VERSION = 1.2.8
 ZLIB         = zlib-$(ZLIB_VERSION)
 ZLIB_TGZ     = $(ZLIB).tar.gz
 ZLIB_URL     = http://downloads.sourceforge.net/project/libpng/zlib/$(ZLIB_VERSION)/$(ZLIB_TGZ)
+ZLIB_MD5     = 44d667c142d7cda120332623eab69f40

 #
 # Interface to top-level prepare Makefile
@ -17,6 +18,7 @@ $(CONTRIB_DIR)/$(ZLIB):clean-zlib
 #
 $(DOWNLOAD_DIR)/$(ZLIB_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(ZLIB_URL) && touch $@
+	$(VERBOSE)$(HASHVERIFIER) $(DOWNLOAD_DIR)/$(ZLIB_TGZ) $(ZLIB_MD5) md5

 $(CONTRIB_DIR)/$(ZLIB): $(DOWNLOAD_DIR)/$(ZLIB_TGZ)
 	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@