Dpkg::Source::Package::V2: Allow detached upstream signatures

Upstream tarballs usually come with detached signatures, which would be
useful to have in the source package, as an additional check that could
be performed to verify its integrity and provenance.

For now just allow the detached signatures to be listed in the file
fields in the source control file (.dsc).

Closes: #759478
Suggested-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

debian/changelog

@@ -9,6 +9,9 @@ dpkg (1.17.20) UNRELEASED; urgency=low
   * Make the initial dependtry be 1 instead of 0. This gets rid of an unused
     dependtry step, which got accidentally introduced when the perl dpkg was
     rewritten in C, ages ago.
+  * Allow detached upstream signatures for upstream orig.tar files in the
+    .dsc file. Suggested by Daniel Kahn Gillmor <dkg@fifthhorseman.net>.
+    Closes: #759478
 
   [ Updated programs translations ]
   * German (Sven Joachim).

scripts/Dpkg/Source/Package/V2.pm

@@ -116,16 +116,23 @@ sub do_extract {
     my $basenamerev = $self->get_basename(1);
 
     my ($tarfile, $debianfile, %addonfile, %seen);
+    my ($tarsign, %addonsign);
     my $re_ext = compression_get_file_extension_regex();
     foreach my $file ($self->get_files()) {
-        (my $uncompressed = $file) =~ s/\.$re_ext$//;
-        error(_g('duplicate files in %s source package: %s.*'), 'v2.0',
+        my $uncompressed = $file;
+        $uncompressed =~ s/\.$re_ext$/.*/;
+        $uncompressed =~ s/\.$re_ext\.asc$/.*.asc/;
+        error(_g('duplicate files in %s source package: %s'), 'v2.0',
               $uncompressed) if $seen{$uncompressed};
         $seen{$uncompressed} = 1;
         if ($file =~ /^\Q$basename\E\.orig\.tar\.$re_ext$/) {
             $tarfile = $file;
+        } elsif ($file =~ /^\Q$basename\E\.orig\.tar\.$re_ext\.asc$/) {
+            $tarsign = $file;
         } elsif ($file =~ /^\Q$basename\E\.orig-([[:alnum:]-]+)\.tar\.$re_ext$/) {
             $addonfile{$1} = $file;
+        } elsif ($file =~ /^\Q$basename\E\.orig-([[:alnum:]-]+)\.tar\.$re_ext\.asc$/) {
+            $addonsign{$1} = $file;
         } elsif ($file =~ /^\Q$basenamerev\E\.debian\.tar\.$re_ext$/) {
             $debianfile = $file;
         } else {
@@ -137,6 +144,18 @@ sub do_extract {
     unless ($tarfile and $debianfile) {
         error(_g('missing orig.tar or debian.tar file in v2.0 source package'));
     }
+    if ($tarsign and $tarfile ne substr $tarsign, 0, -4) {
+        error(_g('mismatched orig.tar %s for signature %s in source package'),
+              $tarfile, $tarsign);
+    }
+    foreach my $name (keys %addonsign) {
+        error(_g('missing addon orig.tar for signature %s in source package'),
+              $addonsign{$name})
+            if not exists $addonfile{$name};
+        error(_g('mismatched addon orig.tar %s for signature %s in source package'),
+              $addonfile{$name}, $addonsign{$name})
+            if $addonfile{$name} ne substr $addonsign{$name}, 0, -4;
+    }
 
     erasedir($newdirectory);