vhaudiquet/pkh
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

deb: resolve pocket suites and serve Debian security updates

Browse Source 
A changelog may target a pocket suite ('trixie-security') rather than
the bare series: split the pocket off so the build resolves against
the base series with that pocket enabled - the same target an
explicit '-s trixie -p security' names. The pocket must be one of
the base series' distro-info pockets, which also guards against
series names merely containing a dash; an explicit --pocket wins.

Debian serves security updates from a dedicated archive: appending
the security suite to the main mirror would 404 on 'apt-get update'
(ubuntu serves every pocket from the same archive, where appending
works) - clone the pinned source against deb.debian.org/debian-security
instead, as mmdebstrap does.
This commit is contained in:
vhaudiquet
2026-10-02 01:19:24 +02:00
parent 3c70ccce19
commit bb90842ac9
2 changed files with 50 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/deb/local.rs
+27 -6
View File
@@ -246,12 +246,33 @@ pub async fn build(
if let Some(pocket_name) = pocket {
let pocket_suite = format!("{series}-{pocket_name}");
log::info!("Enabling pocket '{}' for build dependencies", pocket_suite);
for source in &mut sources {
if crate::deb::is_archive_source_pinned(&source.uri, mirror)
&& !source.suite.contains(&pocket_suite)
{
source.suite.push(pocket_suite.clone());
modified = true;
// Debian serves security updates from a dedicated archive: appending
// the suite to the main mirror would 404 on 'apt-get update' (ubuntu
// serves every pocket from the same archive, where appending works)
let security_archive = sources.iter().position(|source| {
source.uri.contains("deb.debian.org/debian")
&& !source.uri.contains("debian-security")
&& source.suite.iter().any(|suite| suite == series)
});
if pocket_name == "security"
&& let Some(index) = security_archive
{
let mut security = sources[index].clone();
security.uri = sources[index]
.uri
.replace("deb.debian.org/debian", "deb.debian.org/debian-security");
security.suite = vec![pocket_suite.clone()];
sources.push(security);
modified = true;
} else {
for source in &mut sources {
if crate::deb::is_archive_source_pinned(&source.uri, mirror)
&& !source.suite.contains(&pocket_suite)
{
source.suite.push(pocket_suite.clone());
modified = true;
}
}
}
src/deb/mod.rs
+23
View File
@@ -319,6 +319,29 @@ async fn build_binary_package_impl(
log::info!("Suite '{}' resolved to series {}", series, codename);
series = codename;
}
// A changelog may also target a pocket suite ('trixie-security') rather
// than the bare series: split the pocket off so the build resolves
// against the base series with that pocket enabled — the same target an
// explicit '-s trixie -p security' names. An explicit --pocket wins.
// The pocket must be one of the base series' distro-info pockets, which
// also guards against series names merely containing a dash.
let mut pocket = pocket.clone();
if pocket.is_none()
&& let Some((base, pocket_name)) = series
.rsplit_once('-')
.map(|(b, p)| (b.to_string(), p.to_string()))
&& let Ok(dist) = crate::distro_info::get_dist_from_series(&base).await
&& let Ok(pockets) = crate::distro_info::get_dist_pockets(&dist)
&& pockets.iter().any(|p| p.as_str() == pocket_name)
{
pocket = Some(pocket_name.clone());
series = base;
log::info!(
"Pocket suite resolved to series {} (pocket {})",
series,
pocket_name
);
}
let series = series.as_str();
let current_arch = crate::get_current_arch();
let arch = arch.as_deref().unwrap_or(&current_arch);