GPG signature verification tool

The signature verification tool uses gpg to verify the detached
signature of the given file.

It also tries to obtain the signing key if it is not part of the local
key ring.

Signature verification implies the verification of the integrity and
authenticity of a given file.

Issue #748
Hash verification tool

This tool verifies the integrity of a given file with a hash. It uses
md5sum, sha1sum and sha256sum as needed.

Issue #748
GPG signature verification of tool chain

The downloaded archives for building the tool chain are checked for its
signature before using them. In case of a signature failure, the build
is interrupted.

Issue #748
libports: Global variables for integrity check

Add global variables to the signature and hash verification tool for use
in the individual make templates.

Issue #748
libports: Verify signatures of 3rd-party code

This patch adds integrity checks for the packages of the libports
repository.

Issue #748
ports: Global variables for integrity check

Add global variables to the signature and hash verification tool to
ports/Makefile for use in the individual make templates.

Issue #748
ports: Verify signatures of 3rd-party code

This patch adds integrity checks for the packages of the ports
repository.

Issue #748
ports/libports: Handle failed integrity checks

This patch makes the handling of failed integrity checks of 3rd-party
packages more robust. Previously, a once failed 'make prepare PKG=curl'
would not leave any trace of the verification state. Hence, a successive
attempt to perform the 'make prepare' step again succeeded even if the
signature check failed.

To solve this problem, the outcome of a successful signature check is
represented by a tag file called 'download/<archive-name>.verified'.
Because the rule for extracting the archive depends on the .verify tag
file, the extraction step is not performed until the signature check
succeeds.

Issue #748