ensure things are properly signed before uploading to stage

upload_stage_rpms

@@ -5,4 +5,8 @@
 USER='yumrepostage'
 HOST='web01.osuosl.theforeman.org'
 
+if [[ "${VERSION}" != "nightly" ]]; then
+  ./verify_stage_sigs
+fi
+
 rsync --checksum --times --perms --recursive --links --verbose --partial --one-file-system --delete-after "tmp/$PROJECT/$VERSION/" "$USER@$HOST:rsync_cache/$PROJECT/$VERSION/"

verify_stage_sigs

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+set -e
+
+. settings
+
+ARCHES="x86_64 source"
+
+EXIT_CODE=0
+
+for os in $OSES; do
+  BASE="tmp/$PROJECT/$VERSION/$os"
+
+  for arch in $ARCHES; do
+    UNSIGNED_RPMS=$(./list_unsigned_rpms "$BASE/$arch" "$HALFGPGKEY")
+
+    if [[ -n "$UNSIGNED_RPMS" ]]; then
+      echo "$UNSIGNED_RPMS"
+      EXIT_CODE=1
+    fi
+  done
+done
+
+if [[ "${EXIT_CODE}" != "0" ]]; then
+  echo "RPMs not signed with ${HALFGPGKEY} found, aborting"
+fi
+
+exit ${EXIT_CODE}