pear/pear-core — pull request #20 by slusarz (2013-11-05 06:15:43+00:00)
Title: Gpg sign verify

Here's the final component (at least for today). This will verify signature if:
1) package contains gpg signature
2) gpg is configured in PEAR
3) public key of signing authority has been imported

UI & code architecture can obviously be discussed and tweaked. But it works, at least with the admittedly limited testing I have done so far.

The Debian folks have mentioned that they are very interested in this kind of security for PEAR packages that are packaged/distributed by them, so I can probably get some people involved as necessary if we need more support to get the ball rolling on getting this added.