dpkg-buildpackage: Move and pack signing logic at the end of the build

This packs all signing in a single place, so that additional checks can
be performed before any signing is done.

debian/changelog

@@ -1,5 +1,8 @@
 dpkg (1.17.6) UNRELEASED; urgency=low
 
+  [ Guillem Jover ]
+  * Move signing in dpkg-buildpackage to the end of the build.
+
   [ Updated scripts translations ]
   * German (Helge Kreutzmann).
 

man/dpkg-buildpackage.1

@@ -56,18 +56,16 @@ case, or if \fB\-b\fP is specified), or \fBbuild\-arch\fP and
 \fBbinary\-arch\fP (if \fB\-B\fP is specified), or \fBbuild\-indep\fP and
 \fBbinary\-indep\fP (if \fB\-A\fP is specified).
 .IP \fB6.\fP 3
-It calls \fBgpg2\fP or \fBgpg\fP to sign the \fB.dsc\fP file (if any, unless
-\fB\-us\fP is specified or on UNRELEASED builds).
-.IP \fB7.\fP 3
 It calls \fBdpkg\-genchanges\fP to generate a \fB.changes\fP file.
 Many \fBdpkg\-buildpackage\fP options are forwarded to
 \fBdpkg\-genchanges\fP.
-.IP \fB8.\fP 3
-It calls \fBgpg2\fP or \fBgpg\fP to sign the \fB.changes\fP file (unless
-\fB\-uc\fP is specified or on UNRELEASED builds).
-.IP \fB9.\fP 3
+.IP \fB7.\fP 3
 If \fB\-tc\fP is specified, it will call \fBfakeroot debian/rules clean\fP
 again. Finally it calls \fBdpkg\-source \-\-after\-build\fP.
+.IP \fB8.\fP 3
+It calls \fBgpg2\fP or \fBgpg\fP to sign the \fB.dsc\fP file (if any, unless
+\fB\-us\fP is specified or on UNRELEASED builds), and the \fB.changes\fP file
+(unless \fB\-uc\fP is specified or on UNRELEASED builds).
 .
 .SH OPTIONS
 .TP

scripts/dpkg-buildpackage.pl

@@ -446,19 +446,6 @@ if ($include & BUILD_BINARY) {
     withecho(@debian_rules, $buildtarget);
     withecho(@rootcommand, @debian_rules, $binarytarget);
 }
-if ($signpause &&
-    ($signchanges || (($include & BUILD_SOURCE) && $signsource))) {
-    print _g("Press the return key to start signing process\n");
-    getc();
-}
-
-my $signerrors;
-if ($include & BUILD_SOURCE) {
-    if ($signsource && signfile("$pv.dsc")) {
-	$signerrors = _g('failed to sign .dsc and .changes file');
-	$signchanges = 0;
-    }
-}
 
 if (defined($maint)) { push @changes_opts, "-m$maint" }
 if (defined($changedby)) { push @changes_opts, "-e$changedby" }
@@ -514,10 +501,6 @@ if (fileomitted '\.deb') {
     }
 }
 
-if ($signchanges && signfile("$pva.changes")) {
-    $signerrors = _g('failed to sign .changes file');
-}
-
 if ($cleansource) {
     withecho(@rootcommand, @debian_rules, 'clean');
 }
@@ -525,14 +508,24 @@ chdir('..') or syserr('chdir ..');
 withecho('dpkg-source', @source_opts, '--after-build', $dir);
 chdir($dir) or syserr("chdir $dir");
 
+print "$Dpkg::PROGNAME: $srcmsg\n";
+
+if ($signpause &&
+    ($signchanges || (($include & BUILD_SOURCE) && $signsource))) {
+    print _g("Press the return key to start signing process\n");
+    getc();
+}
+
+if ($signsource && ($include & BUILD_SOURCE) && signfile("$pv.dsc")) {
+    error(_g('failed to sign .dsc and .changes file'));
+}
+if ($signchanges && signfile("$pva.changes")) {
+    error(_g('failed to sign .changes file'));
+}
+
 if (not $signreleased) {
     warning(_g('not signing UNRELEASED build; use --force-sign to override'));
 }
-print "$Dpkg::PROGNAME: $srcmsg\n";
-if ($signerrors) {
-    warning($signerrors);
-    exit 1;
-}
 
 sub mustsetvar {
     my ($var, $text) = @_;