Add gpg stanza to compatible casks

[tapeinosyne]

Add gpg stanza to casks for which keys and detached signatures are available. Feel free to add entries to the list.

Known compatible:

• cryptol
• electrum
• electrum-ltc
• espionage
• git-annex
• gpgtools
• horndis
• jameica
• libreoffice
• linphone
• litecoin
• lyx
• macports
• multibit
• mumble
• mysqlworkbench
• onionshare
• pgadmin3
• ricochet
• torbrowser
• vlc
• armory — no detached signature
• bitcoin — no detached signature
• wireshark — no detached signature

[fanquake]

@ndr-qef I'm adding more casks to your compatible list above.

[tapeinosyne]

@fanquake, thanks. Unfortunately, armory and bitcoin only offer signed hashes, which we cannot verify automatically—at least, not without parsing stdout.

@vitorgalvao, I would like your opinion on cask layout. What should be the canonical position of the gpg stanza?

Something to consider is that many signatures are found at urls which equal their package's, plus .asc or .sig. Moving gpg after url would allow us to interpolate the latter. The gain in clarity is particularly evident with long urls, such as those found in the libreoffice cask.

E.g. gpg before url:

gpg 'https://example.com/package.dmg.asc'
    :key_id '…'

url 'https://example.com/package.dmg'

gpg after url:

url 'https://example.com/package.dmg'
gpg "#{url}.asc"
    :key_id '…'

[vitorgalvao]

Moving gpg after url would allow us to interpolate the latter.

That also sounds like the best option, to me. We already put appcast in that section as well, so it seems like a good place to make the addition; having all of the “url-related” stanzas in a block makes sense. Having url as the first option is both convenient and clear, so I say we go with your suggestion.

[tapeinosyne]

12 casks of varying key type should suffice for a start. Once Travis passes, I will mark this PR as ready.

[fanquake]

@ndr-qef Ah I see.

Also agree with your layout suggestion

[tapeinosyne]

I crawled the most predictable urls for gpg signatures, obtaining 8 new candidates. This PR now includes all gpg signatures which can be reasonably autodiscovered.

Casual statistic: approximately 1% of our casks offer gpg verification.