signing: verify and generate identity

fixes verification of non-repository packages while installing
them. this is final thing needed for full signing support
(fixes #46).

1 files changed, 2 insertions, 2 deletions

diff --git a/src/add.c b/src/add.c
index 0b402fe..03fc96a 100644
--- a/src/add.c
+++ b/src/add.c
@@ -128,8 +128,8 @@ static int add_main(void *ctx, int argc, char **argv)
 				goto err;
 			}
 
-			/* FIXME: should verify the package too */
-			apk_sign_ctx_init(&sctx, APK_SIGN_GENERATE, NULL);
+			apk_sign_ctx_init(&sctx, APK_SIGN_VERIFY_AND_GENERATE,
+					  NULL);
 			r = apk_pkg_read(&db, argv[i], &sctx, &pkg);
 			apk_sign_ctx_free(&sctx);
 			if (r != 0) {