update: Fix signing verification with digests/packagesite
update: Fix signing verification with digests/packagesite

This updates repo_archive_extract_file() to always write
the extracted file if 'dest' is set, regardless of dest_fd.

The problem was that digests was extracted directly to a fd
but never extracted to a file for rsa_verify() and sha256_file()
to use.

rsa_verify() and sha256_file() could be improved to read from
a fd instead.

Open343/pkg,junovitch/pkg,khorben/pkg,khorben/pkg,en90/pkg,Open343/pkg,skoef/pkg,skoef/pkg,khorben/pkg,junovitch/pkg,en90/pkg