ports/libports: Handle failed integrity checks

This patch makes the handling of failed integrity checks of 3rd-party packages more robust. Previously, a once failed 'make prepare PKG=curl' would not leave any trace of the verification state. Hence, a successive attempt to perform the 'make prepare' step again succeeded even if the signature check failed. To solve this problem, the outcome of a successful signature check is represented by a tag file called 'download/<archive-name>.verified'. Because the rule for extracting the archive depends on the .verify tag file, the extraction step is not performed until the signature check succeeds. Issue #748
2013-06-06 16:49:56 +02:00 · 2013-06-06 16:49:56 +02:00 · 179f742924
parent 96e9fcd326
commit 179f742924
30 changed files with 168 additions and 80 deletions
--- a/libports/ports/curl.mk
+++ b/libports/ports/curl.mk
@ -22,10 +22,13 @@ $(CONTRIB_DIR)/$(CURL): clean-curl
 $(DOWNLOAD_DIR)/$(CURL_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(CURL_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(CURL_URL_SIG) && touch $@
-	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(CURL_TGZ) $(DOWNLOAD_DIR)/$(CURL_SIG) $(CURL_KEY)

-$(CONTRIB_DIR)/$(CURL): $(DOWNLOAD_DIR)/$(CURL_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(CURL_TGZ).verified: $(DOWNLOAD_DIR)/$(CURL_TGZ)
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(CURL_TGZ) $(DOWNLOAD_DIR)/$(CURL_SIG) $(CURL_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(CURL): $(DOWNLOAD_DIR)/$(CURL_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@
 	$(VERBOSE)find ./src/lib/curl/ -name "*.patch" |\
 		xargs -ixxx sh -c "patch -p1 -r - -N -d $(CONTRIB_DIR)/$(CURL) < xxx" || true

--- a/libports/ports/freetype.mk
+++ b/libports/ports/freetype.mk
@ -21,10 +21,13 @@ $(CONTRIB_DIR)/$(FREETYPE): clean-freetype
 $(DOWNLOAD_DIR)/$(FREETYPE_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(FREETYPE_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(FREETYPE_URL_SIG) && touch $@
-	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(FREETYPE_TGZ) $(DOWNLOAD_DIR)/$(FREETYPE_SIG) $(FREETYPE_KEY)

-$(CONTRIB_DIR)/$(FREETYPE): $(DOWNLOAD_DIR)/$(FREETYPE_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(FREETYPE_TGZ).verified: $(DOWNLOAD_DIR)/$(FREETYPE_TGZ)
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(FREETYPE_TGZ) $(DOWNLOAD_DIR)/$(FREETYPE_SIG) $(FREETYPE_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(FREETYPE): $(DOWNLOAD_DIR)/$(FREETYPE_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@

 include/freetype:
 	$(VERBOSE)ln -s ../$(CONTRIB_DIR)/$(FREETYPE)/include/freetype $@
--- a/libports/ports/fribidi.mk
+++ b/libports/ports/fribidi.mk
@ -25,14 +25,17 @@ $(DOWNLOAD_DIR)/$(FRIBIDI_TBZ2):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(FRIBIDI_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(FRIBIDI_URL_SHA) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(FRIBIDI_URL_SIG) && touch $@
+
+$(DOWNLOAD_DIR)/$(FRIBIDI_TBZ2).verified: $(DOWNLOAD_DIR)/$(FRIBIDI_TBZ2)
 	# XXX fribidi does NOT create a detached signature and thus the signature
 	# checking is useless !!! -- somebody should inform them
 	# see http://blog.terryburton.co.uk/2006/11/falling-into-trap-with-gpg.html
 	#$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(FRIBIDI_SHA) $(DOWNLOAD_DIR)/$(FRIBIDI_SHA_SIG) $(FRIBIDI_KEY)
 	$(VERBOSE)$(HASHVERIFIER) $(DOWNLOAD_DIR)/$(FRIBIDI_TBZ2) $(DOWNLOAD_DIR)/$(FRIBIDI_SHA) sha256
+	$(VERBOSE)touch $@

-$(CONTRIB_DIR)/$(FRIBIDI): $(DOWNLOAD_DIR)/$(FRIBIDI_TBZ2)
-	$(VERBOSE)tar xfj $< -C $(CONTRIB_DIR) && touch $@
+$(CONTRIB_DIR)/$(FRIBIDI): $(DOWNLOAD_DIR)/$(FRIBIDI_TBZ2).verified
+	$(VERBOSE)tar xfj $(<:.verified=) -C $(CONTRIB_DIR) && touch $@

 FRIBIDI_INCLUDES = fribidi.h

--- a/libports/ports/gmp.mk
+++ b/libports/ports/gmp.mk
@ -35,10 +35,12 @@ $(CONTRIB_DIR)/$(GMP): clean-gmp
 $(DOWNLOAD_DIR)/$(GMP_TBZ2):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(GMP_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(GMP_URL_SIG) && touch $@
+
+$(DOWNLOAD_DIR)/$(GMP_TBZ2).verified: $(DOWNLOAD_DIR)/$(GMP_TBZ2)
 	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(GMP_TBZ2) $(DOWNLOAD_DIR)/$(GMP_SIG) $(GMP_KEY)

-$(CONTRIB_DIR)/$(GMP): $(DOWNLOAD_DIR)/$(GMP_TBZ2)
-	$(VERBOSE)tar xfj $< -C $(CONTRIB_DIR) && touch $@
+$(CONTRIB_DIR)/$(GMP): $(DOWNLOAD_DIR)/$(GMP_TBZ2).verified
+	$(VERBOSE)tar xfj $(<:.verified=) -C $(CONTRIB_DIR) && touch $@

 include/gmp/gmp-impl.h:
 	$(VERBOSE)ln -sf ../../$(CONTRIB_DIR)/$(GMP)/gmp-impl.h $@
--- a/libports/ports/libav.mk
+++ b/libports/ports/libav.mk
@ -32,11 +32,14 @@ $(DOWNLOAD_DIR)/$(LIBAV_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(LIBAV_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(LIBAV_URL_SHA) && touch $@
 	#$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(LIBAV_URL_SIG) && touch $@
-	# XXX The following hash verification does not ensure authenticity
-	$(VERBOSE)$(HASHVERIFIER) $(DOWNLOAD_DIR)/$(LIBAV_TGZ) $(DOWNLOAD_DIR)/$(LIBAV_SHA) sha1

-$(CONTRIB_DIR)/$(LIBAV): $(DOWNLOAD_DIR)/$(LIBAV_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(LIBAV_TGZ).verified: $(DOWNLOAD_DIR)/$(LIBAV_TGZ)
+	# XXX Hash verification of libav does not ensure authenticity
+	$(VERBOSE)$(HASHVERIFIER) $(DOWNLOAD_DIR)/$(LIBAV_TGZ) $(DOWNLOAD_DIR)/$(LIBAV_SHA) sha1
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(LIBAV): $(DOWNLOAD_DIR)/$(LIBAV_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@
 	$(VERBOSE)patch -d $(CONTRIB_DIR)/$(LIBAV) -p1 -i $(CURDIR)/src/app/avplay/avplay.patch

 clean-libav:
--- a/libports/ports/libiconv.mk
+++ b/libports/ports/libiconv.mk
@ -19,10 +19,13 @@ prepare-libiconv: $(CONTRIB_DIR)/$(LIBICONV) include/iconv
 $(DOWNLOAD_DIR)/$(LIBICONV_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(LIBICONV_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(LIBICONV_URL_SIG) && touch $@
-	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(LIBICONV_TGZ) $(DOWNLOAD_DIR)/$(LIBICONV_SIG) $(LIBICONV_KEY)

-$(CONTRIB_DIR)/$(LIBICONV): $(DOWNLOAD_DIR)/$(LIBICONV_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(LIBICONV_TGZ).verified: $(DOWNLOAD_DIR)/$(LIBICONV_TGZ)
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(LIBICONV_TGZ) $(DOWNLOAD_DIR)/$(LIBICONV_SIG) $(LIBICONV_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(LIBICONV): $(DOWNLOAD_DIR)/$(LIBICONV_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@

 #
 # Install iconv headers
--- a/libports/ports/libssh.mk
+++ b/libports/ports/libssh.mk
@ -27,11 +27,14 @@ $(CONTRIB_DIR)/$(LIBSSH): clean-libssh
 $(DOWNLOAD_DIR)/$(LIBSSH_TGZ):
 	$(VERBOSE)wget --no-check-certificate -c -P $(DOWNLOAD_DIR) $(LIBSSH_URL) && touch $@
 	$(VERBOSE)wget --no-check-certificate -c -P $(DOWNLOAD_DIR) $(LIBSSH_URL_SIG) && touch $@
-	# We have no key at the moment
-	#$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(LIBSSH_TGZ) $(DOWNLOAD_DIR)/$(LIBSSH_SIG) $(LIBSSH_KEY)

-$(CONTRIB_DIR)/$(LIBSSH): $(DOWNLOAD_DIR)/$(LIBSSH_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(LIBSSH_TGZ).verified: $(DOWNLOAD_DIR)/$(LIBSSH_TGZ)
+	# XXX We have no key for libssh at the moment
+	#$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(LIBSSH_TGZ) $(DOWNLOAD_DIR)/$(LIBSSH_SIG) $(LIBSSH_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(LIBSSH): $(DOWNLOAD_DIR)/$(LIBSSH_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@

 include/libssh:
 	$(VERBOSE)mkdir -p $@
--- a/libports/ports/lua.mk
+++ b/libports/ports/lua.mk
@ -19,10 +19,13 @@ $(CONTRIB_DIR)/$(LUA): clean-lua
 #
 $(DOWNLOAD_DIR)/$(LUA_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(LUA_URL) && touch $@
-	$(VERBOSE)$(HASHVERIFIER) $(DOWNLOAD_DIR)/$(LUA_TGZ) $(LUA_SHA) sha1

-$(CONTRIB_DIR)/$(LUA): $(DOWNLOAD_DIR)/$(LUA_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(LUA_TGZ).verified: $(DOWNLOAD_DIR)/$(LUA_TGZ)
+	$(VERBOSE)$(HASHVERIFIER) $(DOWNLOAD_DIR)/$(LUA_TGZ) $(LUA_SHA) sha1
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(LUA): $(DOWNLOAD_DIR)/$(LUA_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@

 LUA_INCLUDES = lua.h lauxlib.h luaconf.h lualib.h

--- a/libports/ports/mpc.mk
+++ b/libports/ports/mpc.mk
@ -26,10 +26,13 @@ $(CONTRIB_DIR)/$(MPC): clean-mpc
 $(DOWNLOAD_DIR)/$(MPC_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(MPC_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(MPC_URL_SIG) && touch $@
-	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(MPC_TGZ) $(DOWNLOAD_DIR)/$(MPC_SIG) $(MPC_KEY)

-$(CONTRIB_DIR)/$(MPC): $(DOWNLOAD_DIR)/$(MPC_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(MPC_TGZ).verified: $(DOWNLOAD_DIR)/$(MPC_TGZ)
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(MPC_TGZ) $(DOWNLOAD_DIR)/$(MPC_SIG) $(MPC_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(MPC): $(DOWNLOAD_DIR)/$(MPC_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@

 include/mpc/mpc.h:
 	$(VERBOSE)mkdir -p $(dir $@)
--- a/libports/ports/mpfr.mk
+++ b/libports/ports/mpfr.mk
@ -23,10 +23,13 @@ $(CONTRIB_DIR)/$(MPFR): clean-mpfr
 $(DOWNLOAD_DIR)/$(MPFR_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(MPFR_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(MPFR_URL_SIG) && touch $@
-	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(MPFR_TGZ) $(DOWNLOAD_DIR)/$(MPFR_SIG) $(MPFR_KEY)

-$(CONTRIB_DIR)/$(MPFR): $(DOWNLOAD_DIR)/$(MPFR_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(MPFR_TGZ).verified: $(DOWNLOAD_DIR)/$(MPFR_TGZ)
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(MPFR_TGZ) $(DOWNLOAD_DIR)/$(MPFR_SIG) $(MPFR_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(MPFR): $(DOWNLOAD_DIR)/$(MPFR_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@

 include/mpfr/mpfr.h:
 	$(VERBOSE)mkdir -p $(dir $@)
--- a/libports/ports/ncurses.mk
+++ b/libports/ports/ncurses.mk
@ -43,10 +43,13 @@ $(NCURSES_GEN_SYMLINKS) $(NCURSES_GEN_FILES): $(CONTRIB_DIR)/$(NCURSES) src/lib/
 $(DOWNLOAD_DIR)/$(NCURSES_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(NCURSES_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(NCURSES_URL_SIG) && touch $@
-	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(NCURSES_TGZ) $(DOWNLOAD_DIR)/$(NCURSES_SIG) $(NCURSES_KEY)

-$(CONTRIB_DIR)/$(NCURSES): $(DOWNLOAD_DIR)/$(NCURSES_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(NCURSES_TGZ).verified: $(DOWNLOAD_DIR)/$(NCURSES_TGZ)
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(NCURSES_TGZ) $(DOWNLOAD_DIR)/$(NCURSES_SIG) $(NCURSES_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(NCURSES): $(DOWNLOAD_DIR)/$(NCURSES_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@

 src/lib/ncurses:
 	$(VERBOSE)mkdir -p $@
--- a/libports/ports/openssl.mk
+++ b/libports/ports/openssl.mk
@ -25,10 +25,13 @@ prepare-openssl: $(CONTRIB_DIR)/$(OPENSSL) include/openssl generate_asm
 $(DOWNLOAD_DIR)/$(OPENSSL_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(OPENSSL_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(OPENSSL_URL_SIG) && touch $@
+
+$(DOWNLOAD_DIR)/$(OPENSSL_TGZ).verified: $(DOWNLOAD_DIR)/$(OPENSSL_TGZ)
 	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(OPENSSL_TGZ) $(DOWNLOAD_DIR)/$(OPENSSL_SIG) $(OPENSSL_KEY)
+	$(VERBOSE)touch $@

 $(CONTRIB_DIR)/$(OPENSSL): $(DOWNLOAD_DIR)/$(OPENSSL_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@

 #
 # Generate ASM codes
--- a/libports/ports/pcre.mk
+++ b/libports/ports/pcre.mk
@ -22,10 +22,13 @@ $(CONTRIB_DIR)/$(PCRE): clean-pcre
 $(DOWNLOAD_DIR)/$(PCRE_TBZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(PCRE_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(PCRE_URL_SIG) && touch $@
+
+$(DOWNLOAD_DIR)/$(PCRE_TBZ).verified: $(DOWNLOAD_DIR)/$(PCRE_TBZ)
 	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(PCRE_TBZ) $(DOWNLOAD_DIR)/$(PCRE_SIG) $(PCRE_KEY)
+	$(VERBOSE)touch $@

 $(CONTRIB_DIR)/$(PCRE): $(DOWNLOAD_DIR)/$(PCRE_TBZ)
-	$(VERBOSE)tar xfj $< -C $(CONTRIB_DIR) && touch $@
+	$(VERBOSE)tar xfj $(<:.verified=) -C $(CONTRIB_DIR) && touch $@

 include/pcre:
 	$(VERBOSE)mkdir -p $@
--- a/libports/ports/python.mk
+++ b/libports/ports/python.mk
@ -20,6 +20,8 @@ $(CONTRIB_DIR)/$(PYTHON): clean-python
 #
 $(DOWNLOAD_DIR)/$(PYTHON_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(PYTHON_URL) && touch $@
+
+$(DOWNLOAD_DIR)/$(PYTHON_TGZ).verified: $(DOWNLOAD_DIR)/$(PYTHON_TGZ)
 	#
 	# As signatures are only provided for versions 2.7.3 and newer, the check
 	# is yet disabled. Just remove the comment sign once the newer version is
@ -27,9 +29,10 @@ $(DOWNLOAD_DIR)/$(PYTHON_TGZ):
 	#
 	#$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(PYTHON_URL_SIG) && touch $@
 	#$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(PYTHON_TGZ) $(DOWNLOAD_DIR)/$(PYTHON_SIG) $(PYTHON_KEY)
+	$(VERBOSE)touch $@

 $(CONTRIB_DIR)/$(PYTHON): $(DOWNLOAD_DIR)/$(PYTHON_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR)
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR)
 	@# rename Python subdirectory to lower case to be consistent
 	@# with the other libs
 	$(VERBOSE)mv $(CONTRIB_DIR)/Python-2.6.4 $@
--- a/libports/ports/readline.mk
+++ b/libports/ports/readline.mk
@ -21,12 +21,15 @@ $(CONTRIB_DIR)/$(READLINE): clean-readline
 $(DOWNLOAD_DIR)/$(READLINE_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(READLINE_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(READLINE_URL_SIG) && touch $@
+
+$(DOWNLOAD_DIR)/$(READLINE_TGZ).verified: $(DOWNLOAD_DIR)/$(READLINE_TGZ)
 	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(READLINE_TGZ) $(DOWNLOAD_DIR)/$(READLINE_SIG) $(READLINE_KEY)
+	$(VERBOSE)touch $@

 READLINE_HEADERS := rlstdc.h rltypedefs.h keymaps.h tilde.h

-$(CONTRIB_DIR)/$(READLINE): $(DOWNLOAD_DIR)/$(READLINE_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(CONTRIB_DIR)/$(READLINE): $(DOWNLOAD_DIR)/$(READLINE_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@
 	@# create symbolic links for public headers from contrib dir
 	$(VERBOSE)for i in $(READLINE_HEADERS); do \
 	  ln -sf ../../$(CONTRIB_DIR)/$(READLINE)/$$i include/readline/; done
--- a/libports/ports/sdl.mk
+++ b/libports/ports/sdl.mk
@ -25,10 +25,13 @@ $(CONTRIB_DIR)/$(SDL): clean-sdl
 $(DOWNLOAD_DIR)/$(SDL_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(SDL_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(SDL_URL_SIG) && touch $@
-	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(SDL_TGZ) $(DOWNLOAD_DIR)/$(SDL_SIG) $(SDL_KEY)

-$(CONTRIB_DIR)/$(SDL): $(DOWNLOAD_DIR)/$(SDL_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(SDL_TGZ).verified: $(DOWNLOAD_DIR)/$(SDL_TGZ)
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(SDL_TGZ) $(DOWNLOAD_DIR)/$(SDL_SIG) $(SDL_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(SDL): $(DOWNLOAD_DIR)/$(SDL_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@
 	$(VERBOSE)rm -f $@/include/SDL_config.h
 	$(VERBOSE)patch -p0 -i src/lib/sdl/SDL_video.patch
 	$(VERBOSE)patch -d $(CONTRIB_DIR)/$(SDL) -p1 -i $(CURDIR)/src/lib/sdl/SDL_audio.patch
--- a/libports/ports/stdcxx.mk
+++ b/libports/ports/stdcxx.mk
@ -45,11 +45,13 @@ $(CONTRIB_DIR)/$(STDCXX): clean-stdcxx
 $(DOWNLOAD_DIR)/$(STDCXX_TBZ2):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) -O$@ $(STDCXX_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(STDCXX_URL_SIG) && touch $@
-	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(STDCXX_TBZ2) $(DOWNLOAD_DIR)/$(STDCXX_SIG) $(STDCXX_KEY)

-$(CONTRIB_DIR)/$(STDCXX): $(DOWNLOAD_DIR)/$(STDCXX_TBZ2)
-	@#$(VERBOSE)tar xfj $< --transform "s/nova-userland/vancouver/" -C $(CONTRIB_DIR)
-	$(VERBOSE)tar xfj $< -C $(CONTRIB_DIR) gcc-$(STDCXX_VERSION)/libstdc++-v3 \
+$(DOWNLOAD_DIR)/$(STDCXX_TBZ2).verified: $(DOWNLOAD_DIR)/$(STDCXX_TBZ2)
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(STDCXX_TBZ2) $(DOWNLOAD_DIR)/$(STDCXX_SIG) $(STDCXX_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(STDCXX): $(DOWNLOAD_DIR)/$(STDCXX_TBZ2).verified
+	$(VERBOSE)tar xfj $(<:.verified=) -C $(CONTRIB_DIR) gcc-$(STDCXX_VERSION)/libstdc++-v3 \
 	                     --transform "s/gcc-$(STDCXX_VERSION).libstdc++-v3/stdcxx-$(STDCXX_VERSION)/" && touch $@

 include/stdcxx:
--- a/libports/ports/zlib.mk
+++ b/libports/ports/zlib.mk
@ -18,10 +18,13 @@ $(CONTRIB_DIR)/$(ZLIB):clean-zlib
 #
 $(DOWNLOAD_DIR)/$(ZLIB_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(ZLIB_URL) && touch $@
-	$(VERBOSE)$(HASHVERIFIER) $(DOWNLOAD_DIR)/$(ZLIB_TGZ) $(ZLIB_MD5) md5

-$(CONTRIB_DIR)/$(ZLIB): $(DOWNLOAD_DIR)/$(ZLIB_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(ZLIB_TGZ).verified: $(DOWNLOAD_DIR)/$(ZLIB_TGZ)
+	$(VERBOSE)$(HASHVERIFIER) $(DOWNLOAD_DIR)/$(ZLIB_TGZ) $(ZLIB_MD5) md5
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(ZLIB): $(DOWNLOAD_DIR)/$(ZLIB_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@

 ZLIB_INCLUDES = zconf.h zlib.h

--- a/ports/ports/bash.mk
+++ b/ports/ports/bash.mk
@ -19,9 +19,12 @@ prepare:: $(CONTRIB_DIR)/$(BASH)
 $(DOWNLOAD_DIR)/$(BASH_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(BASH_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(BASH_URL_SIG) && touch $@
-	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(BASH_TGZ) $(DOWNLOAD_DIR)/$(BASH_SIG) $(BASH_KEY)

-$(CONTRIB_DIR)/$(BASH): $(DOWNLOAD_DIR)/$(BASH_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(BASH_TGZ).verified: $(DOWNLOAD_DIR)/$(BASH_TGZ)
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(BASH_TGZ) $(DOWNLOAD_DIR)/$(BASH_SIG) $(BASH_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(BASH): $(DOWNLOAD_DIR)/$(BASH_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@
 	$(VERBOSE)patch -d $(CONTRIB_DIR)/$(BASH) -N -p1 < src/noux-pkg/bash/build.patch

--- a/ports/ports/binutils.mk
+++ b/ports/ports/binutils.mk
@ -19,8 +19,11 @@ prepare:: $(CONTRIB_DIR)/$(BINUTILS)
 $(DOWNLOAD_DIR)/$(BINUTILS_TBZ2):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(BINUTILS_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(BINUTILS_URL_SIG) && touch $@
-	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(BINUTILS_TBZ2) $(DOWNLOAD_DIR)/$(BINUTILS_SIG) $(BINUTILS_KEY)

-$(CONTRIB_DIR)/$(BINUTILS): $(DOWNLOAD_DIR)/$(BINUTILS_TBZ2)
-	$(VERBOSE)tar xfj $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(BINUTILS_TBZ2).verified: $(DOWNLOAD_DIR)/$(BINUTILS_TBZ2)
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(BINUTILS_TBZ2) $(DOWNLOAD_DIR)/$(BINUTILS_SIG) $(BINUTILS_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(BINUTILS): $(DOWNLOAD_DIR)/$(BINUTILS_TBZ2).verified
+	$(VERBOSE)tar xfj $(<:.verified=) -C $(CONTRIB_DIR) && touch $@
 	$(VERBOSE)patch -d $(CONTRIB_DIR)/$(BINUTILS) -N -p1 < src/noux-pkg/binutils/build.patch
--- a/ports/ports/coreutils.mk
+++ b/ports/ports/coreutils.mk
@ -19,8 +19,11 @@ prepare:: $(CONTRIB_DIR)/$(COREUTILS)
 $(DOWNLOAD_DIR)/$(COREUTILS_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(COREUTILS_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(COREUTILS_URL_SIG) && touch $@
+
+$(DOWNLOAD_DIR)/$(COREUTILS_TGZ).verified: $(DOWNLOAD_DIR)/$(COREUTILS_TGZ)
 	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(COREUTILS_TGZ) $(DOWNLOAD_DIR)/$(COREUTILS_SIG) $(COREUTILS_KEY)
+	$(VERBOSE)touch $@

 $(CONTRIB_DIR)/$(COREUTILS): $(DOWNLOAD_DIR)/$(COREUTILS_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@

--- a/ports/ports/findutils.mk
+++ b/ports/ports/findutils.mk
@ -19,8 +19,11 @@ prepare:: $(CONTRIB_DIR)/$(FINDUTILS)
 $(DOWNLOAD_DIR)/$(FINDUTILS_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(FINDUTILS_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(FINDUTILS_URL_SIG) && touch $@
-	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(FINDUTILS_TGZ) $(DOWNLOAD_DIR)/$(FINDUTILS_SIG) $(FINDUTILS_KEY)

-$(CONTRIB_DIR)/$(FINDUTILS): $(DOWNLOAD_DIR)/$(FINDUTILS_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(FINDUTILS_TGZ).verified: $(DOWNLOAD_DIR)/$(FINDUTILS_TGZ)
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(FINDUTILS_TGZ) $(DOWNLOAD_DIR)/$(FINDUTILS_SIG) $(FINDUTILS_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(FINDUTILS): $(DOWNLOAD_DIR)/$(FINDUTILS_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@
 	$(VERBOSE)patch -d $(CONTRIB_DIR)/$(FINDUTILS) -N -p1 < src/noux-pkg/findutils/build.patch
--- a/ports/ports/gcc.mk
+++ b/ports/ports/gcc.mk
@ -19,7 +19,10 @@ prepare:: $(CONTRIB_DIR)/$(GCC)/configure
 $(DOWNLOAD_DIR)/$(GCC_TGZ):
 	$(VERBOSE)wget -P $(DOWNLOAD_DIR) $(GCC_URL)/$(GCC)/$(GCC_TGZ) && touch $@
 	$(VERBOSE)wget -P $(DOWNLOAD_DIR) $(GCC_URL)/$(GCC)/$(GCC_SIG) && touch $@
+
+$(DOWNLOAD_DIR)/$(GCC_TGZ).verified: $(DOWNLOAD_DIR)/$(GCC_TGZ)
 	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(GCC_TGZ) $(DOWNLOAD_DIR)/$(GCC_SIG) $(GCC_KEY)
+	$(VERBOSE)touch $@

 #
 # Utilities
@ -40,8 +43,8 @@ ifeq ($(shell which autogen)),)
 $(error Need to have 'autogen' installed.)
 endif

-$(CONTRIB_DIR)/$(GCC): $(DOWNLOAD_DIR)/$(GCC_TGZ)
-	$(VERBOSE)for i in $^ ; do tar xfz $$i -C $(CONTRIB_DIR) ;done
+$(CONTRIB_DIR)/$(GCC): $(DOWNLOAD_DIR)/$(GCC_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR)

 include ../tool/tool_chain_gcc_patches.inc

--- a/ports/ports/gdb.mk
+++ b/ports/ports/gdb.mk
@ -54,10 +54,13 @@ prepare:: $(CONTRIB_DIR)/$(GDB)/configure generated_files
 $(DOWNLOAD_DIR)/$(GDB_TBZ2):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(GDB_URL)/$(GDB_TBZ2) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(GDB_URL)/$(GDB_SIG) && touch $@
-	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(GDB_TBZ2) $(DOWNLOAD_DIR)/$(GDB_SIG) $(GDB_KEY)

-$(CONTRIB_DIR)/$(GDB): $(DOWNLOAD_DIR)/$(GDB_TBZ2)
-	$(VERBOSE)tar xfj $< -C $(CONTRIB_DIR)
+$(DOWNLOAD_DIR)/$(GDB_TBZ2).verified: $(DOWNLOAD_DIR)/$(GDB_TBZ2)
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(GDB_TBZ2) $(DOWNLOAD_DIR)/$(GDB_SIG) $(GDB_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(GDB): $(DOWNLOAD_DIR)/$(GDB_TBZ2).verified
+	$(VERBOSE)tar xfj $(<:.verified=) -C $(CONTRIB_DIR)

 include ../tool/tool_chain_gdb_patches.inc

--- a/ports/ports/lighttpd.mk
+++ b/ports/ports/lighttpd.mk
@ -20,8 +20,11 @@ prepare:: $(CONTRIB_DIR)/$(LIGHTTPD)
 $(DOWNLOAD_DIR)/$(LIGHTTPD_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(LIGHTTPD_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(LIGHTTPD_URL_SIG) && touch $@
-	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(LIGHTTPD_TGZ) $(DOWNLOAD_DIR)/$(LIGHTTPD_SIG) $(LIGHTTPD_KEY)

-$(CONTRIB_DIR)/$(LIGHTTPD): $(DOWNLOAD_DIR)/$(LIGHTTPD_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(LIGHTTPD_TGZ).verified: $(DOWNLOAD_DIR)/$(LIGHTTPD_TGZ)
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(LIGHTTPD_TGZ) $(DOWNLOAD_DIR)/$(LIGHTTPD_SIG) $(LIGHTTPD_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(LIGHTTPD): $(DOWNLOAD_DIR)/$(LIGHTTPD_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@
 	$(VERBOSE)patch -N -p1 < src/app/lighttpd/disable_gethostbyaddr_fcntl.patch
--- a/ports/ports/lynx.mk
+++ b/ports/ports/lynx.mk
@ -18,6 +18,8 @@ prepare:: $(CONTRIB_DIR)/$(LYNX)
 $(DOWNLOAD_DIR)/$(LYNX_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) -O $@ $(LYNX_URL) && touch $@
 	#$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(LYNX_URL_SIG) && touch $@
+
+$(DOWNLOAD_DIR)/$(LYNX_TGZ).verified: $(DOWNLOAD_DIR)/$(LYNX_TGZ)
 	#
 	# XXX The current source of the lynx tarball does not contain the signature
 	#     file. The official location contains the signature. Thus, upon
@ -25,7 +27,8 @@ $(DOWNLOAD_DIR)/$(LYNX_TGZ):
 	#     enabled.
 	#
 	#$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(LYNX_TGZ) $(DOWNLOAD_DIR)/$(LYNX_SIG) $(LYNX_KEY)
+	$(VERBOSE)touch $@

-$(CONTRIB_DIR)/$(LYNX): $(DOWNLOAD_DIR)/$(LYNX_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(CONTRIB_DIR)/$(LYNX): $(DOWNLOAD_DIR)/$(LYNX_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@
 	$(VERBOSE)patch -d contrib/ -N -p0 < src/noux-pkg/lynx/build.patch
--- a/ports/ports/make.mk
+++ b/ports/ports/make.mk
@ -19,8 +19,11 @@ prepare:: $(CONTRIB_DIR)/$(GNUMAKE)
 $(DOWNLOAD_DIR)/$(GNUMAKE_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(GNUMAKE_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(GNUMAKE_URL_SIG) && touch $@
+
+$(DOWNLOAD_DIR)/$(GNUMAKE_TGZ).verified: $(DOWNLOAD_DIR)/$(GNUMAKE_TGZ)
 	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(GNUMAKE_TGZ) $(DOWNLOAD_DIR)/$(GNUMAKE_SIG) $(GNUMAKE_KEY)
+	$(VERBOSE)touch $@

-$(CONTRIB_DIR)/$(GNUMAKE): $(DOWNLOAD_DIR)/$(GNUMAKE_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(CONTRIB_DIR)/$(GNUMAKE): $(DOWNLOAD_DIR)/$(GNUMAKE_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@

--- a/ports/ports/openssh.mk
+++ b/ports/ports/openssh.mk
@ -19,10 +19,13 @@ prepare:: $(CONTRIB_DIR)/$(OPENSSH)
 $(DOWNLOAD_DIR)/$(OPENSSH_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(OPENSSH_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(OPENSSH_URL_SIG) && touch $@
-	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(OPENSSH_TGZ) $(DOWNLOAD_DIR)/$(OPENSSH_SIG) $(OPENSSH_KEY)

-$(CONTRIB_DIR)/$(OPENSSH): $(DOWNLOAD_DIR)/$(OPENSSH_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
+$(DOWNLOAD_DIR)/$(OPENSSH_TGZ).verified: $(DOWNLOAD_DIR)/$(OPENSSH_TGZ)
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(OPENSSH_TGZ) $(DOWNLOAD_DIR)/$(OPENSSH_SIG) $(OPENSSH_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(OPENSSH): $(DOWNLOAD_DIR)/$(OPENSSH_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@
 	$(VERBOSE)patch -d contrib/ -N -p0 < src/noux-pkg/openssh/monitor_fdpass.c.patch
 	$(VERBOSE)patch -d contrib/ -N -p0 < src/noux-pkg/openssh/sshconnect.h.patch
 	$(VERBOSE)patch -d contrib/ -N -p0 < src/noux-pkg/openssh/includes_h.patch
--- a/ports/ports/vim.mk
+++ b/ports/ports/vim.mk
@ -20,10 +20,13 @@ prepare:: $(CONTRIB_DIR)/$(VIM)
 #
 $(DOWNLOAD_DIR)/$(VIM_TBZ2):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(VIM_URL) && touch $@
-	$(VERBOSE)$(HASHVERIFIER) $(DOWNLOAD_DIR)/$(VIM_TBZ2) $(VIM_MD5) md5

-$(CONTRIB_DIR)/$(VIM): $(DOWNLOAD_DIR)/$(VIM_TBZ2)
-	$(VERBOSE)tar xfj $< -C $(CONTRIB_DIR)
+$(DOWNLOAD_DIR)/$(VIM_TBZ2).verified: $(DOWNLOAD_DIR)/$(VIM_TBZ2)
+	$(VERBOSE)$(HASHVERIFIER) $(DOWNLOAD_DIR)/$(VIM_TBZ2) $(VIM_MD5) md5
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(VIM): $(DOWNLOAD_DIR)/$(VIM_TBZ2).verified
+	$(VERBOSE)tar xfj $(<:.verified=) -C $(CONTRIB_DIR)
 	$(VERBOSE)mv $(CONTRIB_DIR)/vim73 $@ && touch $@
 	@#
 	@# Prevent configure script from breaking unconditionally
--- a/ports/ports/which.mk
+++ b/ports/ports/which.mk
@ -5,6 +5,7 @@ WHICH_BASE_URL = http://ftp.gnu.org/gnu/which
 WHICH_URL      = $(WHICH_BASE_URL)/$(WHICH_TGZ)
 WHICH_URL_SIG  = $(WHICH_BASE_URL)/$(WHICH_SIG)
 WHICH_KEY      = GNU
+
 #
 # Interface to top-level prepare Makefile
 #
@ -18,8 +19,10 @@ prepare:: $(CONTRIB_DIR)/$(WHICH)
 $(DOWNLOAD_DIR)/$(WHICH_TGZ):
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) -O $@ $(WHICH_URL) && touch $@
 	$(VERBOSE)wget -c -P $(DOWNLOAD_DIR) $(WHICH_URL_SIG) && touch $@
-	$(VERBOSE)$(SIGVERIFIER) $@ $(DOWNLOAD_DIR)/$(WHICH_SIG) $(WHICH_KEY)

-$(CONTRIB_DIR)/$(WHICH): $(DOWNLOAD_DIR)/$(WHICH_TGZ)
-	$(VERBOSE)tar xfz $< -C $(CONTRIB_DIR) && touch $@
-#	$(VERBOSE)patch -d contrib/ -N -p0 < src/noux-pkg/lynx/build.patch
+$(DOWNLOAD_DIR)/$(WHICH_TGZ).verified: $(DOWNLOAD_DIR)/$(WHICH_TGZ)
+	$(VERBOSE)$(SIGVERIFIER) $(DOWNLOAD_DIR)/$(WHICH_TGZ) $(DOWNLOAD_DIR)/$(WHICH_SIG) $(WHICH_KEY)
+	$(VERBOSE)touch $@
+
+$(CONTRIB_DIR)/$(WHICH): $(DOWNLOAD_DIR)/$(WHICH_TGZ).verified
+	$(VERBOSE)tar xfz $(<:.verified=) -C $(CONTRIB_DIR) && touch $@