[LyX/2.3.x] lyx-build: check sig in case one really uses download instead of local tarball.

[Pavel Sanda]

commit 0eccf8779709f5f761656be8712c8e031b9c60a2
Author: Pavel Sanda <sa...@lyx.org>
Date:   Tue Jun 19 23:53:36 2018 +0200

    lyx-build: check sig in case one really uses download instead of local 
tarball.
---
 development/tools/lyx-build |    7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/development/tools/lyx-build b/development/tools/lyx-build
index 27b72d5..644cf10 100755
--- a/development/tools/lyx-build
+++ b/development/tools/lyx-build
@@ -97,6 +97,13 @@ if [ ! -d $BASE/lyx-patch/lyx-$LAST ]; then
     echo "Will try to download from LyX site....";
     pushd $BASE/lyx-patch/;
     wget ftp://ftp.lyx.org/pub/lyx/stable/${FIRST}x/lyx-$LAST.tar.gz;
+    wget ftp://ftp.lyx.org/pub/lyx/stable/${FIRST}x/lyx-$LAST.tar.gz.sig
+    gpg -q --verify lyx-$LAST.tar.gz.sig
+    if ! [ $? == 0 ]; then
+      echo "Signature wrong!"
+      exit 1;
+    fi
+    rm lyx-$LAST.tar.gz.sig
     tar -zxvf lyx-$LAST.tar.gz;
     if [ ! -f lyx-$LAST.tar.gz ]; then
       echo "Still unable to find directory for last version $LAST.";