add GPG verification where possible

.gitignore

@@ -18,3 +18,9 @@
 *.run
 /tests
 Twoliter.override
+packages/*/*.asc
+packages/*/*-asc.txt
+packages/*/*.sig
+packages/*/*-sig.txt
+packages/*/*.sign
+!packages/*/gpgkey-*.asc

packages/grub/gpgkey-B21C50FA44A99720EAA72F7FE951904AD832C631.asc

@@ -0,0 +1,32 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: B21C 50FA 44A9 9720 EAA7  2F7F E951 904A D832 C631
+Comment: Amazon Linux <[email protected]>
+
+xsFNBGOSDXkBEADR0NT7Y5EHACoAUEEdT3J742u8zXftpjh3hwBMYCC9d5VtTDJ2
+MLjBQXljlm9byrd0aLEaa90zurhvnwuFJQlSdVHXsZEgyJIaONTw64lVUnwQmgV0
+iTasVSxK0inLODIxLa92kSebaGj6GOyGDMgRtu30dpTgrFosOILXu9trL1FN6czS
+udq8fbsol6kx3Q7BknYs0F07af+1f7LVKGMA2o4TuTjs8i4HPChJ7Rvjffzb2NtP
+3lfqh4HwzNgc2nRG7ftq1A9MbfpyouiXlTjeri66TpkRp7MvinnBzPznE6LxK/Vq
+pK5IDEje1LRSA2Sz7Yxw5731/7cM2aVtnM99i98m2E93aaq9RqiHa2RrMamt/Qz0
+sMSMBXuztGJ8cpmUbMlq4sIfIMnU+bgNqBmEViJlFpAd34Ypn3DIxdFOAL2Hr1lA
+c3DO/9OsrxZq346flmjoQw9R/Yigy2r9qwWNFNoMIL09VQm9jAk848c7EB6nyrFE
+RBzIVtf8i3buOnLNA2Nj3yRB4JmIiGGr9lKppoSwfXd0SUFXQFDgRCU6c8y5M68A
+MzvfeslMZyUjYYMHRk16cifwfDOXCRJf+igPedJLGPKsu2UYIYrVvAIxK1H6Db7m
+2AiwX08Rhpd6pHzILr3INkogxY1v8IBIt2q1SDMOp5e4VS1IDcYC4+II6QARAQAB
+zSZBbWF6b24gTGludXggPGFtYXpvbi1saW51eEBhbWF6b24uY29tPsLBvgQTAQoA
+cgWCZRXIXgkQ6VGQStgyxjFHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9p
+YS1wZ3Aub3JnVoQZ9CB5X7OFiIXWG972pn+O3yZ+RuNcZXkkP8SxIkcCmwMWIQSy
+HFD6RKmXIOqnL3/pUZBK2DLGMQAA7FkQAJdU1Ktc6iMkhrvXMNRUVnudss49GYiW
+IVRXhl7ZiZaha2s3JTdxK0VxIgrc+3tvny7WGDDKf5O85Io5GnL4fewL4ZCfqB/0
+sjG5OhgCD0WWtLeFrxc/Lay3+7xvKQxL9IgT7UpfnRm/iHlCWY7UEZelvQaE9uNN
+XbYjbah1EzJExP1okVauOW0P3/BP8kRX976w11JOlvU+Z3CndumDRR7IegZexQrm
+CNlV47uh5QFCbFt8m7+cS5PRTD3pB8vJyu8MZ3cbhxNZTwo2F7u0Y9SJRh+sjAuo
+NSls/YdbWvuWJwpNbJU2KN0oo9B1uuRDjz/qh0HWnhYifWoisjg6VZTdQom1dcee
+hjLmfH09pLNKR2uddjyJNjMuuAoOLMKbBoPwP459w/CcmakkP0v0mShi9MeoQOOb
+EE6H2BnMw9RbveXFJ2uHCSK3BpJaGeWbMGAbPsSIRXDs0DY8g+gnGr5+CKOuubkb
+Mwp7HYLHNR2m0Gvi2lqY3VMh/j+y4frKb2fwqPupkmYG0TEoCR1NuJhyG9GS046v
+pBuIXMGNfIqwNl3IehGWMtZScfJncAyDcmqvlbUggG9lKYAT+8Dp3U8+a4BI0Kay
+IfoH1wfyx0hjYeWqBjjY4W2Y1mgJ6QqATUp6yglC6/RTJZ0+0GlCS/EUxGFTRik6
+jE0MDu0zcISc
+=4Nri
+-----END PGP PUBLIC KEY BLOCK-----

packages/grub/grub.spec

@@ -17,9 +17,10 @@ Summary: Bootloader with support for Linux and more
 License: GPL-3.0-or-later AND Unicode-DFS-2015
 URL: https://www.gnu.org/software/grub/
 Source0: https://cdn.amazonlinux.com/al2023/blobstore/f4fa28cb4e1586d622925449b1e24748c6ab09ccebe0fd8ddfa20cf5e7ce182a/grub2-2.06-61.amzn2023.0.9.src.rpm
-Source1: bios.cfg
-Source2: efi.cfg
-Source3: sbat.csv.in
+Source1: gpgkey-B21C50FA44A99720EAA72F7FE951904AD832C631.asc
+Source2: bios.cfg
+Source3: efi.cfg
+Source4: sbat.csv.in
 Patch0001: 0001-setup-Add-root-device-argument-to-grub-setup.patch
 Patch0002: 0002-gpt-start-new-GPT-module.patch
 Patch0003: 0003-gpt-rename-misnamed-header-location-fields.patch
@@ -97,6 +98,9 @@ Summary: Tools for the bootloader with support for Linux and more
 %{summary}.
 
 %prep
+rpmkeys --import %{S:1} --dbpath "${PWD}/rpmdb"
+rpmkeys --checksig %{S:0} --dbpath "${PWD}/rpmdb"
+rm -rf "${PWD}/rpmdb"
 rpm2cpio %{S:0} | cpio -iu grub-%{version}.tar.xz \
   bootstrap bootstrap.conf \
   gitignore %{gnulib_version}.tar.gz \
@@ -168,7 +172,7 @@ popd
 mkdir efi-build
 pushd efi-build
 
-sed -e "s,__VERSION__,%{version},g" %{S:3} > sbat.csv
+sed -e "s,__VERSION__,%{version},g" %{S:4} > sbat.csv
 
 %cross_configure \
   CFLAGS="" \
@@ -199,7 +203,7 @@ pushd bios-build
 %make_install
 mkdir -p %{buildroot}%{biosdir}
 %{buildroot}%{_cross_bindir}/grub-mkimage \
-  -c %{S:1} \
+  -c %{S:2} \
   -d ./grub-core/ \
   -O "i386-pc" \
   -o "%{buildroot}%{biosdir}/core.img" \
@@ -219,7 +223,7 @@ mkdir -p %{buildroot}%{efidir}
 truncate -s 4096 empty.pubkey
 
 %{buildroot}%{_cross_bindir}/grub-mkimage \
-  -c %{S:2} \
+  -c %{S:3} \
   -d ./grub-core/ \
   -O "%{_cross_grub_efi_format}" \
   -o "%{buildroot}%{efidir}/%{efi_image}" \

packages/kernel-5.10/gpgkey-00FA2C1079260870A76D2C285749CAD8646D9185.asc

@@ -0,0 +1,20 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v2.0.22 (GNU/Linux)
+
+mQENBF3JmncBCACyaaWVnTGnSbyHzQ4zNLgHe397CGDw0zJoimvedMkLpbTpqgnI
+UCk09LoNb/F24X2GFDAcy2qFBFia1jY8cOwcOoVWshfSgLZ5b5fcLuE4cB/h63bI
+3PRGsr5uVY98auLE4J6eXEWpuCPRN8CBr/pOEtvDX5fEkRIJstOWvC6vpAsVTK+g
+jtB+05iiNjhQSYNCdlU89gBHNpNDx/DtYMW7rwPZtEkUQ5n2RTz5vNIiuYPMGiwp
+cw7TR7N6kk4fVlyDiZf8BU4akVceAK+9EMh9UjjsmaKbcM/iUW+olavq1xbljMr6
+Hg/eVM0Hu78D62MV5JGoUOc8w78INRAwXt21ABEBAAG0MUFtYXpvbiBBV1MgTmV1
+cm9uIDxuZXVyb24tbWFpbnRhaW5lcnNAYW1hem9uLmNvbT6JATgEEwEIACICGwMG
+CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheABQJjc99RAAoJEFdJythkbZGFOYEIAIht
+ydP6jaMc3oMFmzZYgkDXSFoC2TPij7wdpPJCgq6phMl8vOofT33jZ3RiTQX+2Qug
+EvZUL/oVeSajsH7tki7uDyup+g2K8QnB+eYis37CBZmRFT/7Q6J09pJESDfdDXH9
+PnGlfHnKQ50AmO9chihGQxIxmkWzmpdrQdZUBMqlPsV40WktXToaZ8KIq6cLNHMs
+uuZtPLDXcct8ylS25sRok2BZGQuwTr+Qh9ygJy3aEuhd3uVspNNeN/ia/hLAvn4L
+n1rfiuYr9fmbOkEXsGOwfA+c5vH+74P/V3zlyJ1y+4ZYlCvdOgwsTj69OHS04NBD
+8+oQTxomyao+dnYcoz0=
+=iLMh
+-----END PGP PUBLIC KEY BLOCK-----
+

packages/kernel-5.10/gpgkey-99E617FE5DB527C0D8BD5F8E11CF1F95C87F5B1A.asc

@@ -0,0 +1,28 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFk4Y/gBEACo0PXWKPOeXB2BuxYOItNNX1GAJCSyIT5+tX28VilkpLtWZP0u
+yXuxeZsIjtWm8ZKA81OxB9/+JauFnYkDIchcMIh7Dgh9h/RHOjc2tkvvq7Zq37aJ
+SY29vTMPuWbc/tbqGOaNZfzGBqeWy/eqP4IrM3h7TuajjTHjhrumqUrCgnZUE7/K
+eVowJYNOAAOadqb5vS6QMwbv6Ph3t/fCi7DP/FvgiQ0I/6aU5f4MiPO/W+0+F4du
+7NnIwKmYsZsUtUW228CRKRFYzdoSzADj6K9hMmq4fN42uQujQdJ1tftWHafQVwU/
+jQ70dX1pAdAKQ3sEbShJcSmAjCjBJLhLK/0rbMXuErrhrxewXfPEgpzm+Fp+jlo2
+Ni2GTA3QPo21dOo4XL2SrVzc5Q+abYBRYncuZhZ7fwynG982BtDEZ066Q1G6eT1f
+Q9YPlqrfw6Hq16kXfPWQTbkUa8oR36q1TQAF1oHiAkIruV/+O7VHlfECEApht2HD
+eV87LbsN1TyYbtI8o9AQki77/9S6PPuWeN7QbgnmET/NXuPht2p69Kn/3DfJhKrn
+dkujEFmhK0fWtEQk0SGrJcRJ6aD+ZB2DmtCv9Mki9pImkvjoxBBq1/ZNCFu/6BfM
+R9X72/JyVWM1lWs77zhwJp5bRw5hYQqXO0x2ld91PNKRsTi5A6sykvJ7ewARAQAB
+tCZBbWF6b24gTGludXggPGFtYXpvbi1saW51eEBhbWF6b24uY29tPokCNwQTAQgA
+IQUCWThj+AIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRARzx+VyH9bGutz
+D/9m4aF5W2uE5eI/IzTyjI9qPL8jKM0GISo4SKE8GeUgAlZ6/RfTKU1Wv2EicFTS
+aKpX6oXDVfOumi2ZrooqlF7YdfREoVrn+dKHHXVzuMwJyFfd0t6FERLWNPeFAqWD
+n1bmPBNJ5hP+FRRd4zNaje7ZnD2YHcpaTtnHP6jBTTOsJs675DswzqcwLJ4dIPmH
+vkRbLc/1/7rjU2b29RyCVNsf+3hqx9hkk2I77nUCY8NHGxUvFhun98JmHG+xfyWk
+W/Cv929+NKDsrdZLjVcVOvnZg2WPNz+F9SPV6fF5kTP/qh4Dalfzfq0fKG8csnQ9
+lXUhIBk3v/carfrF3ChMKZf6gHxEW0g0zFv2Dc+vNS1E5mBn3LlzxpryzBay4O6n
+Zr+IZhIa5P2K0vqqzaYjmwPwm/sYulxbwPUrpN4kczCTBwqb/DfArS29w7UMTj/i
+3V6/feFOFJMfF74irr0rYNBB6syINkVyTv3KiKgvlXeY6qCux47PQirRH68l08TI
+MgXOAWjW6rOAlmZBiyzAC3GMytG2IccbHTEow407Oc5ElPbss7uIPHaQzG2MzCDM
+ZaaM0bT64vu5yAV3c3EUYXg7v55XlkRYBFX6m/hSc0ug9WyQi71JkrQg6twWnXzx
+wZ4hd0iTciWC5+mH4pxCMrCymz+x26UfvLdd7hbt4xEACw==
+=fA1M
+-----END PGP PUBLIC KEY BLOCK-----

packages/kernel-5.10/kernel-5.10.spec

@@ -8,8 +8,10 @@ License: GPL-2.0 WITH Linux-syscall-note
 URL: https://www.kernel.org/
 # Use latest-kernel-srpm-url.sh to get this.
 Source0: https://cdn.amazonlinux.com/blobstore/0af5f80d00a3d5a867d4959d74751bc7d24b1bcb0ab8a5de558ae301ae0fa52e/kernel-5.10.228-219.884.amzn2.src.rpm
+Source1: gpgkey-99E617FE5DB527C0D8BD5F8E11CF1F95C87F5B1A.asc
 # Use latest-neuron-srpm-url.sh to get this.
-Source1: https://yum.repos.neuron.amazonaws.com/aws-neuronx-dkms-2.18.12.0.noarch.rpm
+Source2: https://yum.repos.neuron.amazonaws.com/aws-neuronx-dkms-2.18.12.0.noarch.rpm
+Source3: gpgkey-00FA2C1079260870A76D2C285749CAD8646D9185.asc
 Source100: config-bottlerocket
 
 # Neuron-related drop-ins.
@@ -102,7 +104,10 @@ Summary: Header files for the Linux kernel for use by glibc
 %{summary}.
 
 %prep
-rpm2cpio %{SOURCE0} | cpio -iu linux-%{version}.tar config-%{_cross_arch} "*.patch"
+rpmkeys --import %{S:1} --dbpath "${PWD}/rpmdb"
+rpmkeys --checksig %{S:0} --dbpath "${PWD}/rpmdb"
+rm -rf "${PWD}/rpmdb"
+rpm2cpio %{S:0} | cpio -iu linux-%{version}.tar config-%{_cross_arch} "*.patch"
 tar -xof linux-%{version}.tar; rm linux-%{version}.tar
 %setup -TDn linux-%{version}
 # Patches from the Source0 SRPM
@@ -129,13 +134,16 @@ scripts/kconfig/merge_config.sh \
 %if "%{_cross_arch}" == "x86_64"
   ../config-microcode \
 %endif
-  %{SOURCE100}
+  %{S:100}
 
 rm -f ../config-* ../*.patch
 
 %if "%{_cross_arch}" == "x86_64"
 cd %{_builddir}
-rpm2cpio %{SOURCE1} | cpio -idmu './usr/src/aws-neuronx-*'
+rpmkeys --import %{S:3} --dbpath "${PWD}/rpmdb"
+rpmkeys --checksig %{S:2} --dbpath "${PWD}/rpmdb"
+rm -rf "${PWD}/rpmdb"
+rpm2cpio %{S:2} | cpio -idmu './usr/src/aws-neuronx-*'
 find usr/src/ -mindepth 1 -maxdepth 1 -type d -exec mv {} neuron \;
 rm -r usr
 %endif

packages/kernel-5.15/gpgkey-00FA2C1079260870A76D2C285749CAD8646D9185.asc

@@ -0,0 +1,20 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v2.0.22 (GNU/Linux)
+
+mQENBF3JmncBCACyaaWVnTGnSbyHzQ4zNLgHe397CGDw0zJoimvedMkLpbTpqgnI
+UCk09LoNb/F24X2GFDAcy2qFBFia1jY8cOwcOoVWshfSgLZ5b5fcLuE4cB/h63bI
+3PRGsr5uVY98auLE4J6eXEWpuCPRN8CBr/pOEtvDX5fEkRIJstOWvC6vpAsVTK+g
+jtB+05iiNjhQSYNCdlU89gBHNpNDx/DtYMW7rwPZtEkUQ5n2RTz5vNIiuYPMGiwp
+cw7TR7N6kk4fVlyDiZf8BU4akVceAK+9EMh9UjjsmaKbcM/iUW+olavq1xbljMr6
+Hg/eVM0Hu78D62MV5JGoUOc8w78INRAwXt21ABEBAAG0MUFtYXpvbiBBV1MgTmV1
+cm9uIDxuZXVyb24tbWFpbnRhaW5lcnNAYW1hem9uLmNvbT6JATgEEwEIACICGwMG
+CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheABQJjc99RAAoJEFdJythkbZGFOYEIAIht
+ydP6jaMc3oMFmzZYgkDXSFoC2TPij7wdpPJCgq6phMl8vOofT33jZ3RiTQX+2Qug
+EvZUL/oVeSajsH7tki7uDyup+g2K8QnB+eYis37CBZmRFT/7Q6J09pJESDfdDXH9
+PnGlfHnKQ50AmO9chihGQxIxmkWzmpdrQdZUBMqlPsV40WktXToaZ8KIq6cLNHMs
+uuZtPLDXcct8ylS25sRok2BZGQuwTr+Qh9ygJy3aEuhd3uVspNNeN/ia/hLAvn4L
+n1rfiuYr9fmbOkEXsGOwfA+c5vH+74P/V3zlyJ1y+4ZYlCvdOgwsTj69OHS04NBD
+8+oQTxomyao+dnYcoz0=
+=iLMh
+-----END PGP PUBLIC KEY BLOCK-----
+

packages/kernel-5.15/gpgkey-99E617FE5DB527C0D8BD5F8E11CF1F95C87F5B1A.asc

@@ -0,0 +1,28 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFk4Y/gBEACo0PXWKPOeXB2BuxYOItNNX1GAJCSyIT5+tX28VilkpLtWZP0u
+yXuxeZsIjtWm8ZKA81OxB9/+JauFnYkDIchcMIh7Dgh9h/RHOjc2tkvvq7Zq37aJ
+SY29vTMPuWbc/tbqGOaNZfzGBqeWy/eqP4IrM3h7TuajjTHjhrumqUrCgnZUE7/K
+eVowJYNOAAOadqb5vS6QMwbv6Ph3t/fCi7DP/FvgiQ0I/6aU5f4MiPO/W+0+F4du
+7NnIwKmYsZsUtUW228CRKRFYzdoSzADj6K9hMmq4fN42uQujQdJ1tftWHafQVwU/
+jQ70dX1pAdAKQ3sEbShJcSmAjCjBJLhLK/0rbMXuErrhrxewXfPEgpzm+Fp+jlo2
+Ni2GTA3QPo21dOo4XL2SrVzc5Q+abYBRYncuZhZ7fwynG982BtDEZ066Q1G6eT1f
+Q9YPlqrfw6Hq16kXfPWQTbkUa8oR36q1TQAF1oHiAkIruV/+O7VHlfECEApht2HD
+eV87LbsN1TyYbtI8o9AQki77/9S6PPuWeN7QbgnmET/NXuPht2p69Kn/3DfJhKrn
+dkujEFmhK0fWtEQk0SGrJcRJ6aD+ZB2DmtCv9Mki9pImkvjoxBBq1/ZNCFu/6BfM
+R9X72/JyVWM1lWs77zhwJp5bRw5hYQqXO0x2ld91PNKRsTi5A6sykvJ7ewARAQAB
+tCZBbWF6b24gTGludXggPGFtYXpvbi1saW51eEBhbWF6b24uY29tPokCNwQTAQgA
+IQUCWThj+AIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRARzx+VyH9bGutz
+D/9m4aF5W2uE5eI/IzTyjI9qPL8jKM0GISo4SKE8GeUgAlZ6/RfTKU1Wv2EicFTS
+aKpX6oXDVfOumi2ZrooqlF7YdfREoVrn+dKHHXVzuMwJyFfd0t6FERLWNPeFAqWD
+n1bmPBNJ5hP+FRRd4zNaje7ZnD2YHcpaTtnHP6jBTTOsJs675DswzqcwLJ4dIPmH
+vkRbLc/1/7rjU2b29RyCVNsf+3hqx9hkk2I77nUCY8NHGxUvFhun98JmHG+xfyWk
+W/Cv929+NKDsrdZLjVcVOvnZg2WPNz+F9SPV6fF5kTP/qh4Dalfzfq0fKG8csnQ9
+lXUhIBk3v/carfrF3ChMKZf6gHxEW0g0zFv2Dc+vNS1E5mBn3LlzxpryzBay4O6n
+Zr+IZhIa5P2K0vqqzaYjmwPwm/sYulxbwPUrpN4kczCTBwqb/DfArS29w7UMTj/i
+3V6/feFOFJMfF74irr0rYNBB6syINkVyTv3KiKgvlXeY6qCux47PQirRH68l08TI
+MgXOAWjW6rOAlmZBiyzAC3GMytG2IccbHTEow407Oc5ElPbss7uIPHaQzG2MzCDM
+ZaaM0bT64vu5yAV3c3EUYXg7v55XlkRYBFX6m/hSc0ug9WyQi71JkrQg6twWnXzx
+wZ4hd0iTciWC5+mH4pxCMrCymz+x26UfvLdd7hbt4xEACw==
+=fA1M
+-----END PGP PUBLIC KEY BLOCK-----

packages/kernel-5.15/kernel-5.15.spec

@@ -8,8 +8,10 @@ License: GPL-2.0 WITH Linux-syscall-note
 URL: https://www.kernel.org/
 # Use latest-kernel-srpm-url.sh to get this.
 Source0: https://cdn.amazonlinux.com/blobstore/9cea3dae03703f3c4c78fcb1302eeee5fe4c07ebf53d783cf3aaf7e4f30a6d39/kernel-5.15.168-114.166.amzn2.src.rpm
+Source1: gpgkey-99E617FE5DB527C0D8BD5F8E11CF1F95C87F5B1A.asc
 # Use latest-neuron-srpm-url.sh to get this.
-Source1: https://yum.repos.neuron.amazonaws.com/aws-neuronx-dkms-2.18.12.0.noarch.rpm
+Source2: https://yum.repos.neuron.amazonaws.com/aws-neuronx-dkms-2.18.12.0.noarch.rpm
+Source3: gpgkey-00FA2C1079260870A76D2C285749CAD8646D9185.asc
 Source100: config-bottlerocket
 
 # Neuron-related drop-ins.
@@ -100,7 +102,10 @@ Summary: Header files for the Linux kernel for use by glibc
 %{summary}.
 
 %prep
-rpm2cpio %{SOURCE0} | cpio -iu linux-%{version}.tar config-%{_cross_arch} "*.patch"
+rpmkeys --import %{S:1} --dbpath "${PWD}/rpmdb"
+rpmkeys --checksig %{S:0} --dbpath "${PWD}/rpmdb"
+rm -rf "${PWD}/rpmdb"
+rpm2cpio %{S:0} | cpio -iu linux-%{version}.tar config-%{_cross_arch} "*.patch"
 tar -xof linux-%{version}.tar; rm linux-%{version}.tar
 %setup -TDn linux-%{version}
 # Patches from the Source0 SRPM
@@ -127,13 +132,16 @@ scripts/kconfig/merge_config.sh \
 %if "%{_cross_arch}" == "x86_64"
   ../config-microcode \
 %endif
-  %{SOURCE100}
+  %{S:100}
 
 rm -f ../config-* ../*.patch
 
 %if "%{_cross_arch}" == "x86_64"
 cd %{_builddir}
-rpm2cpio %{SOURCE1} | cpio -idmu './usr/src/aws-neuronx-*'
+rpmkeys --import %{S:3} --dbpath "${PWD}/rpmdb"
+rpmkeys --checksig %{S:2} --dbpath "${PWD}/rpmdb"
+rm -rf "${PWD}/rpmdb"
+rpm2cpio %{S:2} | cpio -idmu './usr/src/aws-neuronx-*'
 find usr/src/ -mindepth 1 -maxdepth 1 -type d -exec mv {} neuron \;
 rm -r usr
 %endif

packages/kernel-6.1/gpgkey-00FA2C1079260870A76D2C285749CAD8646D9185.asc

@@ -0,0 +1,20 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v2.0.22 (GNU/Linux)
+
+mQENBF3JmncBCACyaaWVnTGnSbyHzQ4zNLgHe397CGDw0zJoimvedMkLpbTpqgnI
+UCk09LoNb/F24X2GFDAcy2qFBFia1jY8cOwcOoVWshfSgLZ5b5fcLuE4cB/h63bI
+3PRGsr5uVY98auLE4J6eXEWpuCPRN8CBr/pOEtvDX5fEkRIJstOWvC6vpAsVTK+g
+jtB+05iiNjhQSYNCdlU89gBHNpNDx/DtYMW7rwPZtEkUQ5n2RTz5vNIiuYPMGiwp
+cw7TR7N6kk4fVlyDiZf8BU4akVceAK+9EMh9UjjsmaKbcM/iUW+olavq1xbljMr6
+Hg/eVM0Hu78D62MV5JGoUOc8w78INRAwXt21ABEBAAG0MUFtYXpvbiBBV1MgTmV1
+cm9uIDxuZXVyb24tbWFpbnRhaW5lcnNAYW1hem9uLmNvbT6JATgEEwEIACICGwMG
+CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheABQJjc99RAAoJEFdJythkbZGFOYEIAIht
+ydP6jaMc3oMFmzZYgkDXSFoC2TPij7wdpPJCgq6phMl8vOofT33jZ3RiTQX+2Qug
+EvZUL/oVeSajsH7tki7uDyup+g2K8QnB+eYis37CBZmRFT/7Q6J09pJESDfdDXH9
+PnGlfHnKQ50AmO9chihGQxIxmkWzmpdrQdZUBMqlPsV40WktXToaZ8KIq6cLNHMs
+uuZtPLDXcct8ylS25sRok2BZGQuwTr+Qh9ygJy3aEuhd3uVspNNeN/ia/hLAvn4L
+n1rfiuYr9fmbOkEXsGOwfA+c5vH+74P/V3zlyJ1y+4ZYlCvdOgwsTj69OHS04NBD
+8+oQTxomyao+dnYcoz0=
+=iLMh
+-----END PGP PUBLIC KEY BLOCK-----
+

packages/kernel-6.1/gpgkey-B21C50FA44A99720EAA72F7FE951904AD832C631.asc

@@ -0,0 +1,32 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: B21C 50FA 44A9 9720 EAA7  2F7F E951 904A D832 C631
+Comment: Amazon Linux <[email protected]>
+
+xsFNBGOSDXkBEADR0NT7Y5EHACoAUEEdT3J742u8zXftpjh3hwBMYCC9d5VtTDJ2
+MLjBQXljlm9byrd0aLEaa90zurhvnwuFJQlSdVHXsZEgyJIaONTw64lVUnwQmgV0
+iTasVSxK0inLODIxLa92kSebaGj6GOyGDMgRtu30dpTgrFosOILXu9trL1FN6czS
+udq8fbsol6kx3Q7BknYs0F07af+1f7LVKGMA2o4TuTjs8i4HPChJ7Rvjffzb2NtP
+3lfqh4HwzNgc2nRG7ftq1A9MbfpyouiXlTjeri66TpkRp7MvinnBzPznE6LxK/Vq
+pK5IDEje1LRSA2Sz7Yxw5731/7cM2aVtnM99i98m2E93aaq9RqiHa2RrMamt/Qz0
+sMSMBXuztGJ8cpmUbMlq4sIfIMnU+bgNqBmEViJlFpAd34Ypn3DIxdFOAL2Hr1lA
+c3DO/9OsrxZq346flmjoQw9R/Yigy2r9qwWNFNoMIL09VQm9jAk848c7EB6nyrFE
+RBzIVtf8i3buOnLNA2Nj3yRB4JmIiGGr9lKppoSwfXd0SUFXQFDgRCU6c8y5M68A
+MzvfeslMZyUjYYMHRk16cifwfDOXCRJf+igPedJLGPKsu2UYIYrVvAIxK1H6Db7m
+2AiwX08Rhpd6pHzILr3INkogxY1v8IBIt2q1SDMOp5e4VS1IDcYC4+II6QARAQAB
+zSZBbWF6b24gTGludXggPGFtYXpvbi1saW51eEBhbWF6b24uY29tPsLBvgQTAQoA
+cgWCZRXIXgkQ6VGQStgyxjFHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9p
+YS1wZ3Aub3JnVoQZ9CB5X7OFiIXWG972pn+O3yZ+RuNcZXkkP8SxIkcCmwMWIQSy
+HFD6RKmXIOqnL3/pUZBK2DLGMQAA7FkQAJdU1Ktc6iMkhrvXMNRUVnudss49GYiW
+IVRXhl7ZiZaha2s3JTdxK0VxIgrc+3tvny7WGDDKf5O85Io5GnL4fewL4ZCfqB/0
+sjG5OhgCD0WWtLeFrxc/Lay3+7xvKQxL9IgT7UpfnRm/iHlCWY7UEZelvQaE9uNN
+XbYjbah1EzJExP1okVauOW0P3/BP8kRX976w11JOlvU+Z3CndumDRR7IegZexQrm
+CNlV47uh5QFCbFt8m7+cS5PRTD3pB8vJyu8MZ3cbhxNZTwo2F7u0Y9SJRh+sjAuo
+NSls/YdbWvuWJwpNbJU2KN0oo9B1uuRDjz/qh0HWnhYifWoisjg6VZTdQom1dcee
+hjLmfH09pLNKR2uddjyJNjMuuAoOLMKbBoPwP459w/CcmakkP0v0mShi9MeoQOOb
+EE6H2BnMw9RbveXFJ2uHCSK3BpJaGeWbMGAbPsSIRXDs0DY8g+gnGr5+CKOuubkb
+Mwp7HYLHNR2m0Gvi2lqY3VMh/j+y4frKb2fwqPupkmYG0TEoCR1NuJhyG9GS046v
+pBuIXMGNfIqwNl3IehGWMtZScfJncAyDcmqvlbUggG9lKYAT+8Dp3U8+a4BI0Kay
+IfoH1wfyx0hjYeWqBjjY4W2Y1mgJ6QqATUp6yglC6/RTJZ0+0GlCS/EUxGFTRik6
+jE0MDu0zcISc
+=4Nri
+-----END PGP PUBLIC KEY BLOCK-----

packages/kernel-6.1/kernel-6.1.spec

@@ -8,8 +8,10 @@ License: GPL-2.0 WITH Linux-syscall-note
 URL: https://www.kernel.org/
 # Use latest-kernel-srpm-url.sh to get this.
 Source0: https://cdn.amazonlinux.com/al2023/blobstore/c5625ba4f37a38809773fa50b769735602f1e4e50d60cb7127ed6231d0695e95/kernel-6.1.119-129.201.amzn2023.src.rpm
+Source1: gpgkey-B21C50FA44A99720EAA72F7FE951904AD832C631.asc
 # Use latest-neuron-srpm-url.sh to get this.
-Source1: https://yum.repos.neuron.amazonaws.com/aws-neuronx-dkms-2.18.12.0.noarch.rpm
+Source2: https://yum.repos.neuron.amazonaws.com/aws-neuronx-dkms-2.18.12.0.noarch.rpm
+Source3: gpgkey-00FA2C1079260870A76D2C285749CAD8646D9185.asc
 
 Source100: config-bottlerocket
 
@@ -167,7 +169,10 @@ Conflicts: %{_cross_os}image-feature(no-fips)
 %{summary}.
 
 %prep
-rpm2cpio %{SOURCE0} | cpio -iu linux-%{version}.tar config-%{_cross_arch} "*.patch"
+rpmkeys --import %{S:1} --dbpath "${PWD}/rpmdb"
+rpmkeys --checksig %{S:0} --dbpath "${PWD}/rpmdb"
+rm -rf "${PWD}/rpmdb"
+rpm2cpio %{S:0} | cpio -iu linux-%{version}.tar config-%{_cross_arch} "*.patch"
 tar -xof linux-%{version}.tar; rm linux-%{version}.tar
 %setup -TDn linux-%{version}
 # Patches from the Source0 SRPM
@@ -194,13 +199,16 @@ scripts/kconfig/merge_config.sh \
 %if "%{_cross_arch}" == "x86_64"
   ../config-microcode \
 %endif
-  %{SOURCE100}
+  %{S:100}
 
 rm -f ../config-* ../*.patch
 
 %if "%{_cross_arch}" == "x86_64"
 cd %{_builddir}
-rpm2cpio %{SOURCE1} | cpio -idmu './usr/src/aws-neuronx-*'
+rpmkeys --import %{S:3} --dbpath "${PWD}/rpmdb"
+rpmkeys --checksig %{S:2} --dbpath "${PWD}/rpmdb"
+rm -rf "${PWD}/rpmdb"
+rpm2cpio %{S:2} | cpio -idmu './usr/src/aws-neuronx-*'
 find usr/src/ -mindepth 1 -maxdepth 1 -type d -exec mv {} neuron \;
 rm -r usr
 %endif