vhaudiquet/pkh
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

deb: resolve pocket suites and serve Debian security updates

Browse Source 
A changelog may target a pocket suite ('trixie-security') rather than
the bare series: split the pocket off so the build resolves against
the base series with that pocket enabled - the same target an
explicit '-s trixie -p security' names. The pocket must be one of
the base series' distro-info pockets, which also guards against
series names merely containing a dash; an explicit --pocket wins.

Debian serves security updates from a dedicated archive: appending
the security suite to the main mirror would 404 on 'apt-get update'
(ubuntu serves every pocket from the same archive, where appending
works) - clone the pinned source against deb.debian.org/debian-security
instead, as mmdebstrap does.
This commit is contained in:
vhaudiquet
2026-10-02 01:19:24 +02:00
parent 3c70ccce19
commit bb90842ac9
2 changed files with 50 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/deb/local.rs
+27 -6
View File
@@ -246,12 +246,33 @@ pub async fn build(
if let Some(pocket_name) = pocket {
let pocket_suite = format!("{series}-{pocket_name}");
log::info!("Enabling pocket '{}' for build dependencies", pocket_suite);
for source in &mut sources {
if crate::deb::is_archive_source_pinned(&source.uri, mirror)
&& !source.suite.contains(&pocket_suite)
{
source.suite.push(pocket_suite.clone());
modified = true;
// Debian serves security updates from a dedicated archive: appending
// the suite to the main mirror would 404 on 'apt-get update' (ubuntu
// serves every pocket from the same archive, where appending works)
let security_archive = sources.iter().position(|source| {
source.uri.contains("deb.debian.org/debian")
&& !source.uri.contains("debian-security")
&& source.suite.iter().any(|suite| suite == series)
});
if pocket_name == "security"
&& let Some(index) = security_archive
{
let mut security = sources[index].clone();
security.uri = sources[index]
.uri
.replace("deb.debian.org/debian", "deb.debian.org/debian-security");
security.suite = vec![pocket_suite.clone()];
sources.push(security);
modified = true;
} else {
for source in &mut sources {
if crate::deb::is_archive_source_pinned(&source.uri, mirror)
&& !source.suite.contains(&pocket_suite)
{
source.suite.push(pocket_suite.clone());
modified = true;
}
}
}