diff --git a/guix/gnu-maintenance.scm b/guix/gnu-maintenance.scm
index 5ca2923379..93645367e9 100644
--- a/guix/gnu-maintenance.scm
+++ b/guix/gnu-maintenance.scm
@@ -321,10 +321,13 @@ (define* (latest-ftp-release project
                              #:key
                              (server "ftp.gnu.org")
                              (directory (string-append "/gnu/" project))
+                             (file->signature (cut string-append <> ".sig"))
                              (ftp-open ftp-open) (ftp-close ftp-close))
   "Return an <upstream-source> for the latest release of PROJECT on SERVER
 under DIRECTORY, or #f.  Use FTP-OPEN and FTP-CLOSE to open (resp. close) FTP
-connections; this can be useful to reuse connections."
+connections; this can be useful to reuse connections.  FILE->SIGNATURE must be
+a procedure; it is passed a source file URL and must return the corresponding
+signature URL, or #f it signatures are unavailable."
   (define (latest a b)
     (if (version>? a b) a b))
 
@@ -350,7 +353,9 @@ (define (file->source directory file)
        (package project)
        (version (tarball->version file))
        (urls (list url))
-       (signature-urls (list (string-append url ".sig"))))))
+       (signature-urls (match (file->signature url)
+                         (#f #f)
+                         (sig (list sig)))))))
 
   (let loop ((directory directory)
              (result    #f))
@@ -468,7 +473,11 @@ (define (latest-gnome-release package)
                        #:directory (string-append "/pub/gnome/sources/"
                                                   (match package
                                                     ("gconf" "GConf")
-                                                    (x       x))))))
+                                                    (x       x)))
+
+                       ;; ftp.gnome.org provides no signatures, only
+                       ;; checksums.
+                       #:file->signature (const #f))))
 
 (define %gnu-updater
   (upstream-updater
diff --git a/guix/upstream.scm b/guix/upstream.scm
index 12eed3f2b4..c62667dd01 100644
--- a/guix/upstream.scm
+++ b/guix/upstream.scm
@@ -98,8 +98,9 @@ (define (release>? r1 r2)
                         (urls (append (upstream-source-urls release)
                                       (upstream-source-urls head)))
                         (signature-urls
-                         (append (upstream-source-signature-urls release)
-                                 (upstream-source-signature-urls head))))
+                         (let ((one (upstream-source-signature-urls release))
+                               (two (upstream-source-signature-urls release)))
+                           (and one two (append one two)))))
                        tail)
                  (cons release result)))
             (()