dpkg: Search for debsig-verify in PATH instead of using an absolute path

Check that the command exists in the PATH before using it. This makes it
future proof, and friendlier to other systems that might not be using
the same filesystem layout.

It also makes it possible to use a local debsig-verify in a path such as
/usr/local/bin.

debian/changelog

@@ -43,6 +43,7 @@ dpkg (1.18.5) UNRELEASED; urgency=medium
     Closes: #719845
     - Use it with dpkg --recursive option.
   * Unify start-stop-daemon --help output with the rest of the tools.
+  * Search for debsig-verify in PATH instead of using an absolute path.
   * Portability:
     - Move DPKG_ADMINDIR environment variable name out from update-alternatives
       code, to make life easier for non-dpkg-based systems.

lib/dpkg/dpkg.h

@@ -104,7 +104,7 @@ DPKG_BEGIN_DECLS
 #define DPKGSTAT	"dpkg-statoverride"
 #define DPKGTRIGGER	"dpkg-trigger"
 #define DPKG		"dpkg"
-#define DEBSIGVERIFY	"/usr/bin/debsig-verify"
+#define DEBSIGVERIFY	"debsig-verify"
 
 #define RM		"rm"
 #define CAT		"cat"

src/unpack.c

@@ -129,17 +129,18 @@ deb_reassemble(const char **filename, const char **pfilename)
 static void
 deb_verify(const char *filename)
 {
-  struct stat stab;
   pid_t pid;
 
-  if (stat(DEBSIGVERIFY, &stab) < 0)
+  /* We have to check on every unpack, in case the debsig-verify package
+   * gets installed or removed. */
+  if (!find_command(DEBSIGVERIFY))
     return;
 
   printf(_("Authenticating %s ...\n"), filename);
   fflush(stdout);
   pid = subproc_fork();
   if (!pid) {
-    execl(DEBSIGVERIFY, DEBSIGVERIFY, "-q", filename, NULL);
+    execlp(DEBSIGVERIFY, DEBSIGVERIFY, "-q", filename, NULL);
     ohshite(_("unable to execute %s (%s)"),
             _("package signature verification"), DEBSIGVERIFY);
   } else {