Dpkg::Source::Package::V1: Allow detached upstream orig tarball signatures

Upstream orig tarballs usually come with detached signatures, which would
be useful to have in the source package, as an additional check that could
be performed to verify its integrity and provenance.

Fixes: #759478
Suggested-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

debian/changelog

@@ -112,6 +112,8 @@ dpkg (1.18.5) UNRELEASED; urgency=medium
       in Dpkg::Source::Package.
     - Handle undef versions in Dpkg::Changelog from empty versions in
       changelog entry header lines.
+    - Allow detached upstream orig tarball signatures when extracting
+      version 1.0 non-native source packages.
   * Build system:
     - Fix building development documentation.
     - Remove unused UA_LIBS variable.

scripts/Dpkg/Source/Package/V1.pm

@@ -164,10 +164,13 @@ sub do_extract {
 
     # V1.0 only supports gzip compression
     my ($tarfile, $difffile);
+    my $tarsign;
     foreach my $file ($self->get_files()) {
 	if ($file =~ /^(?:\Q$basename\E\.orig|\Q$basenamerev\E)\.tar\.gz$/) {
             error(g_('multiple tarfiles in v1.0 source package')) if $tarfile;
             $tarfile = $file;
+        } elsif ($file =~ /^\Q$basename\E\.orig\.tar\.gz\.asc$/) {
+            $tarsign = $file;
 	} elsif ($file =~ /^\Q$basenamerev\E\.diff\.gz$/) {
 	    $difffile = $file;
 	} else {