Verify signature on nginx tarballs

Fixes #10
wireapp · May 16, 2017 · 2f076ed · 2f076ed
1 parent 6cb6d5c
commit 2f076ed
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/services/nginz/Makefile b/services/nginz/Makefile
@@ -69,8 +69,11 @@ $(DIST):
 BUNDLE=nginx-$(VERSION).tar.gz
 
 src: $(TMPDIR)/$(BUNDLE)
+	#Find keys on https://nginx.org/en/pgp_keys.html
+	gpg --verify $(TMPDIR)/$(BUNDLE).asc
 	tar zxf $(TMPDIR)/$(BUNDLE)
 	mv nginx-$(VERSION) src
 
 $(TMPDIR)/$(BUNDLE):
-	(cd $(TMPDIR); curl -O http://nginx.org/download/$(BUNDLE))
+	(cd $(TMPDIR); curl -O https://nginx.org/download/$(BUNDLE).asc)
+	(cd $(TMPDIR); curl -O https://nginx.org/download/$(BUNDLE))