Dpkg::Source::Package: Include upstream orig tarball signatures

If there are upstream signatures for orig.tar files, pick them up and
include them in the .dsc file.

See: #759478

debian/changelog

@@ -114,6 +114,8 @@ dpkg (1.18.5) UNRELEASED; urgency=medium
       changelog entry header lines.
     - Allow detached upstream orig tarball signatures when extracting
       version 1.0 non-native source packages.
+    - Include upstream orig tarball signatures in source packages.
+      See #759478.
   * Build system:
     - Fix building development documentation.
     - Remove unused UA_LIBS variable.

man/dpkg-source.1

@@ -282,6 +282,9 @@ deployment of those formats within Debian.
 A source package in this format consists either of a \fB.orig.tar.gz\fP
 associated to a \fB.diff.gz\fP or a single \fB.tar.gz\fP (in that case
 the package is said to be \fInative\fP).
+Optionally the original tarball might be accompanied by a detached
+upstream signature \fB.orig.tar.gz.asc\fP, extraction and building
+supported since dpkg 1.18.5.
 
 .B Extracting
 
@@ -456,6 +459,11 @@ an original tarball (\fB.orig.tar.\fP\fIext\fP where \fIext\fP can be
 tarballs (\fB.orig\-\fP\fIcomponent\fP\fB.tar.\fP\fIext\fP).
 \fIcomponent\fP can only contain alphanumeric characters and hyphens
 (\(oq\-\(cq).
+Optionally each original tarball can be accompanied by a detached
+upstream signature (\fB.orig.tar.\fP\fIext\fP\fB.asc\fP and
+\fB.orig\-\fP\fIcomponent\fP\fB.tar.\fP\fIext\fP\fB.asc\fP), extraction
+supported since dpkg 1.17.20, building supported since dpkg 1.18.5.
+
 .PP
 .B Extracting
 .PP

scripts/Dpkg/Source/Package/V1.pm

@@ -345,6 +345,7 @@ sub do_build {
     }
 
     my ($tarname, $tardirname, $tardirbase);
+    my $tarsign;
     if ($sourcestyle ne 'n') {
 	my ($origdirname, $origdirbase) = fileparse($origdir);
 
@@ -357,6 +358,7 @@ sub do_build {
         $tardirname = $origdirname;
 
 	$tarname = $origtargz || "$basename.orig.tar.gz";
+	$tarsign = "$tarname.asc";
 	unless ($tarname =~ /\Q$basename\E\.orig\.tar\.gz/) {
 	    warning(g_('.orig.tar name %s is not <package>_<upstreamversion>' .
 	               '.orig.tar (wanted %s)'),
@@ -399,6 +401,7 @@ sub do_build {
     }
 
     $self->add_file($tarname) if $tarname;
+    $self->add_file($tarsign) if $tarsign and -e $tarsign;
 
     if ($sourcestyle =~ m/[kpKP]/) {
         if (stat($origdir)) {

scripts/Dpkg/Source/Package/V2.pm

@@ -405,10 +405,12 @@ sub generate_patch {
             $tarfile = $file;
             push @origtarballs, $file;
             $self->add_file($file);
+            $self->add_file("$file.asc") if -e "$file.asc";
         } elsif ($file =~ /\.orig-([[:alnum:]-]+)\.tar\.$comp_ext_regex$/) {
             $addonfile{$1} = $file;
             push @origtarballs, $file;
             $self->add_file($file);
+            $self->add_file("$file.asc") if -e "$file.asc";
         }
     }
 

scripts/dpkg-genchanges.pl

@@ -270,6 +270,7 @@ if (build_has_any(BUILD_SOURCE)) {
         $origsrcmsg = g_('not including original source code in upload');
         foreach my $f (grep { m/\.orig(-.+)?\.tar\.$ext$/ } $checksums->get_files()) {
             $checksums->remove_file($f);
+            $checksums->remove_file("$f.asc");
         }
     } else {
         if ($sourcestyle =~ m/d/ &&