deb: resolve pocket suites and serve Debian security updates

A changelog may target a pocket suite ('trixie-security') rather than
the bare series: split the pocket off so the build resolves against
the base series with that pocket enabled - the same target an
explicit '-s trixie -p security' names. The pocket must be one of
the base series' distro-info pockets, which also guards against
series names merely containing a dash; an explicit --pocket wins.

Debian serves security updates from a dedicated archive: appending
the security suite to the main mirror would 404 on 'apt-get update'
(ubuntu serves every pocket from the same archive, where appending
works) - clone the pinned source against deb.debian.org/debian-security
instead, as mmdebstrap does.

src/deb/local.rs

@@ -246,6 +246,26 @@ pub async fn build(
     if let Some(pocket_name) = pocket {
         let pocket_suite = format!("{series}-{pocket_name}");
         log::info!("Enabling pocket '{}' for build dependencies", pocket_suite);
+
+        // Debian serves security updates from a dedicated archive: appending
+        // the suite to the main mirror would 404 on 'apt-get update' (ubuntu
+        // serves every pocket from the same archive, where appending works)
+        let security_archive = sources.iter().position(|source| {
+            source.uri.contains("deb.debian.org/debian")
+                && !source.uri.contains("debian-security")
+                && source.suite.iter().any(|suite| suite == series)
+        });
+        if pocket_name == "security"
+            && let Some(index) = security_archive
+        {
+            let mut security = sources[index].clone();
+            security.uri = sources[index]
+                .uri
+                .replace("deb.debian.org/debian", "deb.debian.org/debian-security");
+            security.suite = vec![pocket_suite.clone()];
+            sources.push(security);
+            modified = true;
+        } else {
             for source in &mut sources {
                 if crate::deb::is_archive_source_pinned(&source.uri, mirror)
                     && !source.suite.contains(&pocket_suite)
@@ -254,6 +274,7 @@ pub async fn build(
                     modified = true;
                 }
             }
+        }
 
         // 'proposed' pockets are marked 'NotAutomatic' in their Release file,
         // giving them an apt priority of 1: without an explicit pin, apt

src/deb/mod.rs

@@ -319,6 +319,29 @@ async fn build_binary_package_impl(
         log::info!("Suite '{}' resolved to series {}", series, codename);
         series = codename;
     }
+    // A changelog may also target a pocket suite ('trixie-security') rather
+    // than the bare series: split the pocket off so the build resolves
+    // against the base series with that pocket enabled — the same target an
+    // explicit '-s trixie -p security' names. An explicit --pocket wins.
+    // The pocket must be one of the base series' distro-info pockets, which
+    // also guards against series names merely containing a dash.
+    let mut pocket = pocket.clone();
+    if pocket.is_none()
+        && let Some((base, pocket_name)) = series
+            .rsplit_once('-')
+            .map(|(b, p)| (b.to_string(), p.to_string()))
+        && let Ok(dist) = crate::distro_info::get_dist_from_series(&base).await
+        && let Ok(pockets) = crate::distro_info::get_dist_pockets(&dist)
+        && pockets.iter().any(|p| p.as_str() == pocket_name)
+    {
+        pocket = Some(pocket_name.clone());
+        series = base;
+        log::info!(
+            "Pocket suite resolved to series {} (pocket {})",
+            series,
+            pocket_name
+        );
+    }
     let series = series.as_str();
     let current_arch = crate::get_current_arch();
     let arch = arch.as_deref().unwrap_or(&current_arch);