README: Make fork friendlier for users

  - How to audit code

    Help users understand how the audit forks changes.

  - Use Gnupg for verification.

  - README: Update Change Log

    Keep the change log up to date.

2 files changed, 47 insertions, 1 deletions

diff --git a/GPG-KEY b/GPG-KEY
new file mode 100644
index 0000000..3ee668b
--- /dev/null
+++ b/GPG-KEY
@@ -0,0 +1,13 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEYtQrJBYJKwYBBAHaRw8BAQdAkd2m/wg3S5tUWgayttx6zTjKZKv25NKhgvsT
+plIwOOO0IlNsYWNrIENvZGVyIDxzbGFja2NvZGVyQHNlcnZlci5reT6IkAQTFgoA
+OAIbAwULCQgHAwUVCgkICwUWAgMBAAIeBQIXgBYhBNDP/RB1yrjaMpl1B40UfuoZ
+7/ApBQJmEFlHAAoJEI0UfuoZ7/ApOPYBAJRp4fNisMg16DC79qETHcomlH2/gzHl
+ZRsTjKT6pWiiAQDDSBBeGOokL+vlO+sSoKN1SMj/MYNWauFGlow5vx3uBrg4BGLU
+KyQSCisGAQQBl1UBBQEBB0Bgk8J69bD5Pd/RK5KBluEitrvpQS+QTV4DlFXWp54U
+IQMBCAeIeAQYFgoAIAIbDBYhBNDP/RB1yrjaMpl1B40UfuoZ7/ApBQJmEFlwAAoJ
+EI0UfuoZ7/ApZ1gBALlkEkH/xoL1XFbX6ThGih6CV/72sHULuehbOQxRKBiZAQDW
+hEJjXCY6c+nXOH2CbLkuDu3pWD5hYvoZRP9fIS3jBA==
+=20yW
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/README.md b/README.md
index fe9276f..f184cc7 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,41 @@
-# sbotools [![Build Status](https://travis-ci.org/pink-mist/sbotools.svg)](https://travis-ci.org/pink-mist/sbotools)
+# sbotools
 
 **[sbotools](https://pink-mist.github.io/sbotools/)** provides a ports-like interface to [slackbuilds.org](http://www.slackbuilds.org/).
 
+Here is an unofficial maintenance fork for sbotools.  Development for the original has stopped for a number of years.
+
+## Auditing Changes
+
+You can audit the forked changes by asking git to show commits since the last known official commit.
+
+```
+git remote add pink-mist https://github.com/pink-mist/sbotools
+git fetch pink-mist
+git show pink-mist/master..
+```
+
+The latest changes on the master branch can be verified using the maintainer's
+[GPG Key](./GPG-KEY) included in the project.  The 'FINGERPRINT' should not
+change unless the maintainer does.
+
+```
+FINGERPRINT=D0CFFD1075CAB8DA329975078D147EEA19EFF029
+
+if ! gpg2 --list-keys | grep "$FINGERPRINT" >/dev/null; then
+  gpg2 --import ./GPG-KEY
+fi
+if git verify-commit origin/master; then
+  echo "verification ok"
+else
+  echo "verification failed"
+fi
+```
+
 ## Changes
+
+* Unreleased
+  * Add support for Slackware 15.0.
+
 * 2.7 - 2019-04-28
   * Actually fix the sbofind -e bug #71