dpkg-source: don't block indefinitely on gpg

dpkg-source's signature check is now done with gpgv if possible and
timeouts if not completed within 10 seconds.

debian/changelog

@@ -24,6 +24,8 @@ dpkg (1.15.1) UNRELEASED; urgency=low
   * dpkg-gencontrol displays a better error message when an ORed dependency
     is used in a union field like Conflicts, Replaces or Breaks.
     Closes: #489238
+  * dpkg-source's signature check is now done with gpgv if possible and
+    timeouts if not completed within 10 seconds. Closes: #490929
 
   [ Guillem Jover ]
   * Fix typo in dpkg output (‘unexecpted’ → ‘unexpected’). Closes: #519082

scripts/Dpkg/Source/Package.pm

@@ -274,8 +274,13 @@ sub is_signed {
 sub check_signature {
     my ($self) = @_;
     my $dsc = $self->get_filename();
-    if (-x '/usr/bin/gpg') {
-        my @exec = ("gpg", "-q", "--verify");
+    my @exec;
+    if (-x '/usr/bin/gpgv') {
+        push @exec, "gpgv";
+    } elsif (-x '/usr/bin/gpg') {
+        push @exec, "gpg", "--no-default-keyring", "-q", "--verify";
+    }
+    if (scalar(@exec)) {
         if (-r '/usr/share/keyrings/debian-keyring.gpg') {
             push @exec, "--keyring", "/usr/share/keyrings/debian-keyring.gpg";
         }
@@ -286,7 +291,8 @@ sub check_signature {
 
         my ($stdout, $stderr);
         fork_and_exec('exec' => \@exec, wait_child => 1, nocheck => 1,
-                      to_string => \$stdout, error_to_string => \$stderr);
+                      to_string => \$stdout, error_to_string => \$stderr,
+                      timeout => 10);
         if (WIFEXITED($?)) {
             my $gpg_status = WEXITSTATUS($?);
             print STDERR "$stdout$stderr" if $gpg_status;