Source:
<code>public boolean checkSignature(MultiStepProgress progress, URL signatureUrl, ProgressListener progressListener, SignatureVerifier signatureVerifier, String statusText, File fileToVerify) throws Exception { final boolean allowInsecurePackages = PreferencesData.getBoolean(Constants.ALLOW_INSECURE_PACKAGES, false); final boolean trustAll = PreferencesData.getBoolean(Constants.PREF_CONTRIBUTIONS_TRUST_ALL); final boolean skipVerification = allowInsecurePackages || trustAll; final String signatureFileName = FilenameUtils.getName(signatureUrl.getPath()); final File packageIndexSignature = BaseNoGui.indexer.getIndexFile(signatureFileName); final File packageIndexSignatureTemp = File.createTempFile(signatureFileName, ".tmp"); try { download(signatureUrl, packageIndexSignatureTemp, progress, statusText, progressListener, true); <START> <END> if (skipVerification) { log.info("Allowing insecure packages because allow_insecure_packages is set to true in preferences.txt" + " but the signature was download"); return true; } final boolean signatureVerified = signatureVerifier.isSigned(fileToVerify, packageIndexSignatureTemp); if (signatureVerified) { log.info("Signature verified. url={}, signature url={}, file to verify={}, signature file={}", signatureUrl, signatureUrl, fileToVerify, packageIndexSignatureTemp); Files.move(packageIndexSignatureTemp.toPath(), packageIndexSignature.toPath(), StandardCopyOption.REPLACE_EXISTING); } else { log.error("{} file signature verification failed. File ignored.", signatureUrl); System.err.println(format(tr("{0} file signature verification failed. File ignored."), signatureUrl.toString())); } return signatureVerified; } catch (Exception e) { log.error("Cannot download the signature from the package will be discard", signatureUrl, e); throw e; } finally { Files.deleteIfExists(packageIndexSignatureTemp.toPath()); } }</code><technical_language>Returning true update .sig file if signature is good. IMHO do normal (and do consider skipVerification preference)</technical_language>

Target:
public boolean checkSignature(MultiStepProgress progress, URL signatureUrl, ProgressListener progressListener, SignatureVerifier signatureVerifier, String statusText, File fileToVerify) throws Exception { final String signatureFileName = FilenameUtils.getName(signatureUrl.getPath()); final File packageIndexSignature = BaseNoGui.indexer.getIndexFile(signatureFileName); final File packageIndexSignatureTemp = File.createTempFile(signatureFileName, ".tmp"); try { download(signatureUrl, packageIndexSignatureTemp, progress, statusText, progressListener, true); if (PreferencesData.areInsecurePackagesAllowed()) { Files.move(packageIndexSignatureTemp.toPath(), packageIndexSignature.toPath(), StandardCopyOption.REPLACE_EXISTING); log.info("Allowing insecure packages because allow_insecure_packages is set to true in preferences.txt" + " but the signature was download"); return true; } final boolean signatureVerified = signatureVerifier.isSigned(fileToVerify, packageIndexSignatureTemp); if (signatureVerified) { log.info("Signature verified. url={}, signature url={}, file to verify={}, signature file={}", signatureUrl, signatureUrl, fileToVerify, packageIndexSignatureTemp); Files.move(packageIndexSignatureTemp.toPath(), packageIndexSignature.toPath(), StandardCopyOption.REPLACE_EXISTING); } else { log.error("{} file signature verification failed. File ignored.", signatureUrl); System.err.println(format(tr("{0} file signature verification failed. File ignored."), signatureUrl.toString())); } return signatureVerified; } catch (Exception e) { log.error("Cannot download the signature from the package will be discard", signatureUrl, e); throw e; } finally { Files.deleteIfExists(packageIndexSignatureTemp.toPath()); } }