Hello Richard,
First, sorry for the commit message (I gave details in the first patch on externalsrc.bbclass but not on this one). I agree with you that it seems an hack but I don't know to make package;bbclass find the sources correctly.
processdebugsrc += "(cd '%s' ; cpio -pd0mlL --no-preserve-owner '%s%s' 2>/dev/null)"
this command explicitely goes into workparentdir and wait for the sources to be in it thanks to the input list that was calculated as the output of dwarfsrcfiles earlier call (with localsrc_prefix remove from them).
Have you an idea (or even a lead that I can explore) on how make things correct here ?