Are there websites that allow one to search for which package contains a particular file

This isn't a direct answer to your question, but there are several things you can do to mitigate against this risk. The simplest one is to check your downloaded packages against the checksums from a different mirror than you downloaded from.

When my package manager (poldek) downloads a package, I have it set to keep a copy of the downloaded rpm in a cache folder. It automatically checks the checksum of the download against the package repository and warns/aborts on a mismatch, but if you were worried about man-in-the-middle attacked against your distro repository it would be easy to write a secondary script that browsed through all your downloaded packages and verify them against checksums you download from a different mirror. You can even run your first install as a dry-run so that packages get downloaded but not installed, then run your verification script, then do the actual install.

This doesn't stop a compromised package from getting into the distro's repository, but most distros have other ways of mitigating that, and even signed packages would not guarantee this was never a problem. What it does do is stifle the targeted man-in-the-middle attack vector. By using a separate source and downloading on a separate channel, you kill the ease with which a compromised package could be dropped into a tapped line.

well, opengrok for opensolaris code base but no opengrok for linux codebase, one could start one however but the cost involved in setting up and maintaining is too greater I suppose. kernel.org maintains only kernel source tarballs. It has been left to the individual distro maker to distribute source code along with the product OS but practices are seldom distribute the source along with the code(I guess debian is an exception and thats why it provides more than 20-30 disks)

There is this : http://lxr.linux.no/

LXR (formerly "the Linux Cross Referencer") is a software toolset for indexing and presenting source code repositories. LXR was initially targeted at the Linux source code, but has proved usable for a wide range of software projects.

Update: Another link I came across is http://fxr.watson.org/ , which has all the popular distro sources cross reference. Pretty useful for systems programmers.