Add verify_required config option and set after verify

verify_required requires the package to be verified for the build to
continue. If a package is ever verified, this configuration is
automatically set to prevent future regressions. If a regression does
occur in the future but there is a valid reason, a developer must
manually unset the verify_require flag to build the package. This is a
safety mechanism.

autospec/config.py

@@ -84,7 +84,8 @@ config_options = {
     "broken_parallel_build":  "disable parallelization during build",
     "pgo": "set profile for pgo",
     "use_clang": "add clang flags",
-    "32bit" : "build 32 bit libraries"}
+    "32bit" : "build 32 bit libraries",
+    "verify_required": "require package verification for build"}
 
 def create_conf():
     config_f = configparser.ConfigParser(allow_no_value=True)

autospec/pkg_integrity.py

@@ -12,6 +12,8 @@ from io import BytesIO
 from contextlib import contextmanager
 from subprocess import Popen, PIPE
 
+import config
+
 GPG_CLI = False
 DESCRIPTION = "Performs package signature verification for packages signed with\
 gpg."
@@ -201,25 +203,37 @@ class GPGVerifier(Verifier):
         print("Verifying GPG signature\n")
         if os.path.exists(self.package_path) is False:
             self.print_result(False, err_msg='{} not found'.format(self.package_path))
+            if config.config_opts['verify_required']:
+                self.quit_verify()
             return None
         if os.path.exists(self.package_sign_path) is False and self.get_sign() is not True:
             self.print_result(False, err_msg='{} not found'.format(self.package_sign_path))
+            if config.config_opts['verify_required']:
+                self.quit_verify()
             return None
         pub_key = self.get_pubkey_path()
         EMAIL = parse_key(pub_key, r':user ID packet: ".* <(.+?)>"\n')
         if not pub_key or os.path.exists(pub_key) is False:
             key_id = get_keyid(self.package_sign_path)
             self.print_result(False, 'Public key {} not found in keyring'.format(key_id))
+            if config.config_opts['verify_required']:
+                self.quit_verify()
             return None
         sign_status = verify_cli(pub_key, self.package_path, self.package_sign_path)
         if sign_status is None:
             self.print_result(self.package_path)
             KEYID = KEYID_TRY
+            config.config_opts['verify_required'] = True
+            config.rewrite_config_opts()
             return True
         else:
             self.print_result(False, err_msg=sign_status.strerror)
             self.quit()
 
+    def quit_verify(self):
+        print_error("verification required for build (verify_required option set)")
+        self.quit()
+
 
 # GEM Verifier
 class GEMShaVerifier(Verifier):

tests/testfiles/c-helloworld-32/conf-expectations

@@ -33,4 +33,6 @@ use_avx2 = false
 use_clang = false
 # configure build for lto
 use_lto = false
+# require package verification for build
+verify_required = false
 

tests/testfiles/c-helloworld-opts/conf-expectations

@@ -33,4 +33,6 @@ use_avx2 = false
 use_clang = false
 # configure build for lto
 use_lto = true
+# require package verification for build
+verify_required = false
 

tests/testfiles/c-helloworld/conf-expectations

@@ -33,4 +33,6 @@ use_avx2 = false
 use_clang = false
 # configure build for lto
 use_lto = false
+# require package verification for build
+verify_required = false
 

tests/testfiles/libjpeg-turbo/conf-expectations

@@ -33,4 +33,6 @@ use_avx2 = false
 use_clang = false
 # configure build for lto
 use_lto = false
+# require package verification for build
+verify_required = false
 

tests/testfiles/py-helloworld/conf-expectations

@@ -33,4 +33,6 @@ use_avx2 = false
 use_clang = false
 # configure build for lto
 use_lto = false
+# require package verification for build
+verify_required = false