Misc updates concerning gpg and dpkg-source

* Always display a warning when the signature verification failed.
* Update the dpkg-source's manual page to document that only the user's
  trustedkeys.gpg keyring is used for signature verification.

debian/changelog

@@ -26,6 +26,8 @@ dpkg (1.15.1) UNRELEASED; urgency=low
     Closes: #489238
   * dpkg-source's signature check is now done with gpgv if possible and
     timeouts if not completed within 10 seconds. Closes: #490929
+    When using gpg, use --no-default-keyring to be consistent with gpgv's
+    behaviour to not use the user's keyring. Closes: #440841
   * Update dpkg-dev dependencies: Closes: #472942
     - Move gnupg to Recommends. It's needed to sign .dsc and .changes.
     - Add gpgv to Recommends. Useful to check signatures of extracted packages.

man/dpkg-source.1

@@ -183,7 +183,8 @@ Do not check signatures and checksums before unpacking.
 .TP
 .BI \-\-require\-valid\-signature
 Refuse to unpack the source package if it doesn't contain an OpenPGP
-signature that can be verified either with the user's keyring or one
+signature that can be verified either with the user's
+\fItrustedkeys.gpg\fP keyring or one
 of the official Debian keyrings
 (\fI/usr/share/keyrings/debian-keyring.gpg\fP
 and \fI/usr/share/keyrings/debian-maintainers.gpg\fP).

scripts/Dpkg/Source/Package.pm

@@ -300,6 +300,8 @@ sub check_signature {
                 $self->{'options'}{'require_valid_signature'}))
             {
                 error(_g("failed to verify signature on %s"), $dsc);
+            } elsif ($gpg_status) {
+                warning(_g("failed to verify signature on %s"), $dsc);
             }
         } else {
             subprocerr("@exec");