Check signatures with gnupg?

[ioerror]

The Tor Browser has signatures for each release:
https://www.torproject.org/dist/torbrowser/osx/TorBrowser-2.3.25-2-osx-i386-es-ES.zip
https://www.torproject.org/dist/torbrowser/osx/TorBrowser-2.3.25-2-osx-i386-es-ES.zip.asc

And we publish a set of keys that are likely to sign them:
https://www.torproject.org/docs/verifying-signatures.html

I'd like to add the proper keys to my Tor Browser formula and have the signatures checked at install time.

[phinze]

This is not a bad idea for extending the existing hash-based check. Let's see what we can do!

[lanterndev]

Big +1 on this! Homebrew/legacy-homebrew#22238 (via Homebrew/legacy-homebrew#15631) provide some relevant history of the proposal to add this to homebrew, which has unfortunately not been accepted yet. If you're open to adding it to homebrew-cask, though, maybe we can make use of the prior art.

[alebcay]

A quick update on this - better security regarding gpg keys is being introduced via #4848, and should hopefully be implemented by #4688 (DSL 1.0).

[hellais]

Here is some broken code I wrote a long time ago to add support for what I described in #22238. If there is interest in this I could pick it back up again: https://github.com/hellais/homebrew/tree/feature/package-signing.