diff --git a/.gitignore b/.gitignore
index 500c210..37e4048 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@
 /Electrum-2.7.13.tar.gz
 /Electrum-2.7.17.tar.gz
 /Electrum-2.7.18.tar.gz
+/Electrum-2.7.18.tar.gz.asc
diff --git a/electrum.spec b/electrum.spec
index 82ad505..7d92848 100644
--- a/electrum.spec
+++ b/electrum.spec
@@ -1,12 +1,16 @@
 Name:           electrum
 Version:        2.7.18
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A lightweight Bitcoin Client
 
 License:        MIT and BSD
 URL:            https://electrum.org/
 Source0:        https://download.electrum.org/%{version}/Electrum-%{version}.tar.gz
-Source1:        electrum.appdata.xml
+Source1:        https://download.electrum.org/%{version}/Electrum-%{version}.tar.gz.asc
+#Wed Feb 01 2017, exported the upstream gpg key using the command:
+#gpg2 --export --export-options export-minimal 6694D8DE7BE8EE5631BED9502BD5824B7F9470E6 > gpgkey-electrum.gpg
+Source2:        gpgkey-electrum.gpg
+Source3:        electrum.appdata.xml
 Patch0:         zbar-installation-instructions.patch
 BuildArch:      noarch
 
@@ -16,6 +20,7 @@ BuildRequires:  desktop-file-utils
 BuildRequires:  gettext
 
 BuildRequires:  libappstream-glib
+BuildRequires:  gnupg2
 
 Requires:       python2
 Requires:       python-ecdsa
@@ -42,6 +47,7 @@ by heart. There is no waiting time when you start the client, because
 it does not download the Bitcoin block chain.
 
 %prep
+gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0}
 %setup -q -n Electrum-%{version}
 %patch0
 rm -rf Electrum.egg-info
@@ -53,7 +59,7 @@ pyrcc4 icons.qrc -o gui/qt/icons_rc.py
 
 %install
 %{py2_install}
-install -Dpm 644 %{SOURCE1} %{buildroot}%{_datadir}/appdata/%{name}.appdata.xml
+install -Dpm 644 %{SOURCE3} %{buildroot}%{_datadir}/appdata/%{name}.appdata.xml
 
 # Remove shebang lines from .py files that aren't executable, and
 # remove executability from .py files that don't have a shebang line:
@@ -97,6 +103,9 @@ appstream-util validate-relax --nonet %{buildroot}/%{_datadir}/appdata/*.appdata
 %{python2_sitelib}/*
 
 %changelog
+* Wed Feb 01 2017 Jonny Heggheim <jonnyheggheim@sigaint.org> - 2.7.18-2
+- Verify the signature of the source tarball
+
 * Tue Jan 24 2017 Jonny Heggheim <jonnyheggheim@sigaint.org> - 2.7.18-1
 - new version
 
diff --git a/gpgkey-electrum.gpg b/gpgkey-electrum.gpg
new file mode 100644
index 0000000..8cab4d4
Binary files /dev/null and b/gpgkey-electrum.gpg differ
diff --git a/sources b/sources
index 89ef3d2..329d265 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (Electrum-2.7.18.tar.gz) = b63eb034e91ce4f52b4f49477bca6addb0aeabf287a5e8b3eef3374b359ede024aac6a50378184b4af0609fd3689c46ca209cf6dd7fbe238c4fb7fff2b64f4bf
+SHA512 (Electrum-2.7.18.tar.gz.asc) = 97e4df355bceea93321d84dd8cced009ed2330f3daf2670db931511a71cbed4de0d1823fe46c11896cc9d936f72f8417b34244a86463cee79e324a2aa941e6cf