Repository: nodejs/node
Pull request: tools: verify signatures when updating nghttp*

The keyring was generated using:

```sh
GNUPGHOME=$(mktemp -d)
GNUPGHOME="$GNUPGHOME" gpg --keyserver keyserver.ubuntu.com --recv-keys 516B622918D15C478AB1EA3A5339A2BE82E07DEC
mv "$GNUPGHOME/pubring.kbx" tools/dep_updaters/nghttp.kbx
```

<!--
Before submitting a pull request, please read:

- the CONTRIBUTING guide at https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md
- the commit message formatting guidelines at
  https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#commit-message-guidelines

For code changes:
1. Include tests for any bug fixes or new features.
2. Update documentation if relevant.
3. Ensure that `make -j4 test` (UNIX), or `vcbuild test` (Windows) passes.

If you believe this PR should be highlighted in the Node.js CHANGELOG
please add the `notable-change` label.

Developer's Certificate of Origin 1.1

By making a contribution to this project, I certify that:

(a) The contribution was created in whole or in part by me and I
    have the right to submit it under the open source license
    indicated in the file; or

(b) The contribution is based upon previous work that, to the best
    of my knowledge, is covered under an appropriate open source
    license and I have the right under that license to submit that
    work with modifications, whether created in whole or in part
    by me, under the same open source license (unless I am
    permitted to submit under a different license), as indicated
    in the file; or

(c) The contribution was provided directly to me by some other
    person who certified (a), (b) or (c) and I have not modified
    it.

(d) I understand and agree that this project and the contribution
    are public and that a record of the contribution (including all
    personal information I submit with it, including my sign-off) is
    maintained indefinitely and may be redistributed consistent with
    this project or the open source license(s) involved.
-->


Changed files:
filename: tools/dep_updaters/update-nghttp2.sh
patch: @@ -42,18 +42,19 @@ cleanup () {
 trap cleanup INT TERM EXIT
 
 NGHTTP2_REF="v$NEW_VERSION"
-NGHTTP2_TARBALL="nghttp2-$NEW_VERSION.tar.gz"
+NGHTTP2_TARBALL="nghttp2-$NEW_VERSION.tar.xz"
 
 cd "$WORKSPACE"
 
 echo "Fetching nghttp2 source archive"
 curl -sL -o "$NGHTTP2_TARBALL" "https://github.com/nghttp2/nghttp2/releases/download/$NGHTTP2_REF/$NGHTTP2_TARBALL"
 
-DEPOSITED_CHECKSUM=$(curl -sL "https://github.com/nghttp2/nghttp2/releases/download/$NGHTTP2_REF/checksums.txt" | grep "$NGHTTP2_TARBALL")
+echo "Verifying PGP signature"
+curl -sL "https://github.com/nghttp2/nghttp2/releases/download/${NGHTTP2_REF}/${NGHTTP2_TARBALL}.asc" \
+| gpgv --keyring "$BASE_DIR/tools/dep_updaters/nghttp.kbx" "$NGHTTP2_TARBALL"
 
-log_and_verify_sha256sum "nghttp2" "$NGHTTP2_TARBALL" "$DEPOSITED_CHECKSUM"
-
-gzip -dc "$NGHTTP2_TARBALL" | tar xf -
+echo "Unpacking archive"
+tar xJf "$NGHTTP2_TARBALL"
 rm "$NGHTTP2_TARBALL"
 mv "nghttp2-$NEW_VERSION" nghttp2
 

filename: tools/dep_updaters/update-nghttp3.sh
patch: @@ -48,8 +48,12 @@ cd "$WORKSPACE"
 
 echo "Fetching nghttp3 source archive..."
 curl -sL -o "$ARCHIVE_BASENAME.tar.xz" "https://github.com/ngtcp2/nghttp3/releases/download/${NGHTTP3_REF}/${ARCHIVE_BASENAME}.tar.xz"
-SHA256="$(curl -sL "https://github.com/ngtcp2/nghttp3/releases/download/${NGHTTP3_REF}/checksums.txt" | grep 'tar.xz$')"
-log_and_verify_sha256sum "nghttp3" "$ARCHIVE_BASENAME.tar.xz" "$SHA256"
+
+echo "Verifying PGP signature..."
+curl -sL "https://github.com/ngtcp2/nghttp3/releases/download/${NGHTTP3_REF}/${ARCHIVE_BASENAME}.tar.xz.asc" \
+| gpgv --keyring "$BASE_DIR/tools/dep_updaters/nghttp.kbx" - "$ARCHIVE_BASENAME.tar.xz"
+
+echo "Unpacking archive..."
 tar -xJf "$ARCHIVE_BASENAME.tar.xz"
 rm "$ARCHIVE_BASENAME.tar.xz"
 mv "$ARCHIVE_BASENAME" nghttp3