I have several packges where upstream offers digests for the archives, instead of the more useful signatures. These come in two forms: either properly formatted or just the plain hex digest string. Teach cygport to deal with these; while it's not as good as signatures, it still helps verifying the download.
https://repo.or.cz/cygport/rpm-style.git/commitdiff/02ba3d27657a7e35bfbdb4f719c65f454473103f Regards, Achim. -- +<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+ SD adaptations for Waldorf Q V3.00R3 and Q+ V3.54R2: http://Synth.Stromeko.net/Downloads.html#WaldorfSDada