You forgot a SOURCE_HASH for apr, but that wouldn't have helped since
it uses SOURCE_GPG. You added SOURCE_HASH to apr-util, but that also
uses SOURCE_GPG.
# cast apr apr-util
...
Building apr
GPG checking source file apr-1.3.3.tar.bz2...
gpg: armor header: Version: GnuPG v1.4.7 (GNU/Linux)
gpg: Signature made Fri Aug 8 23:09:51 2008 PDT using RSA key ID
CB9B9EC5 gpg: Can't check signature: public key not found
Failure to verify gpg signature
Abort? [y]
...
Building apr-util
GPG checking source file apr-util-1.3.4.tar.bz2...
gpg: armor header: Version: GnuPG v1.4.7 (GNU/Linux)
gpg: Signature made Wed Aug 13 22:32:49 2008 PDT using RSA key ID
CB9B9EC5 gpg: Can't check signature: public key not found
Failure to verify gpg signature
Abort? [y]