build: verifies the rpm packages signatures.

Closes #12370

.circleci/config.yml

@@ -148,6 +148,11 @@ jobs:
           name: sign packages
           name: sign packages
           command: './scripts/build/sign_packages.sh'
           command: './scripts/build/sign_packages.sh'
       - run:
       - run:
+          name: verify signed packages
+          command: |
+            curl https://grafanarel.s3.amazonaws.com/RPM-GPG-KEY-grafana > ~/.rpmdb/pubkeys/grafana.key
+            ./scripts/build/verify_signed_packages.sh dist/*.rpm
+      - run:
           name: sha-sum packages
           name: sha-sum packages
           command: 'go run build.go sha-dist'
           command: 'go run build.go sha-dist'
       - run:
       - run:

scripts/build/verify_signed_packages.sh

+#!/bin/bash
+_files=$*
+
+ALL_SIGNED=0
+
+for file in $_files; do
+  rpm -K "$file" | grep "pgp.*OK" -q
+  if [[ $? != 0 ]]; then
+    ALL_SIGNED=1
+    echo $file NOT SIGNED
+  else
+    echo $file OK
+  fi
+done
+
+
+exit $ALL_SIGNED