clippy

'proposed' pockets are marked 'NotAutomatic' in their Release file,
which gives them an apt priority of 1: apt would ignore them during
build-dependency resolution even when the suite is enabled.

Write an apt preferences entry pinning '{series}-proposed' at
priority 600 so build-dependencies are actually resolved from the
requested pocket.

Apt preferences are global: a single 'release' pin matches the pinned
suite on every repository carrying it (archive, security and ports),
for all architectures, so this also covers cross-builds pulling
dependencies from 'ports.ubuntu.com'.

src/deb/cross.rs

@@ -104,7 +104,7 @@ pub fn ensure_repositories(
     if !has_ports {
         // Add ports repository for the target architecture
         let mut ports_suites = vec![
-            format!("{series}"),
+            series.to_string(),
             format!("{series}-updates"),
             format!("{series}-backports"),
             format!("{series}-security"),

src/deb/local.rs

@@ -82,7 +82,7 @@ pub async fn build(
                     }
 
                     // Create suite list with all Ubuntu series
-                    let suites = vec![format!("{}", series)];
+                    let suites = vec![series.to_string()];
 
                     let new_source = crate::apt::sources::SourceEntry {
                         enabled: true,
@@ -128,6 +128,13 @@ pub async fn build(
                 modified = true;
             }
         }
+
+        // 'proposed' pockets are marked 'NotAutomatic' in their Release file,
+        // giving them an apt priority of 1: without an explicit pin, apt
+        // would ignore them even when enabled
+        if pocket_name.starts_with("proposed") {
+            pin_pocket(&pocket_suite, &ctx)?;
+        }
     }
 
     if modified {
@@ -331,6 +338,24 @@ fn apply_quilt_patches(
     Ok(())
 }
 
+/// Pin a 'NotAutomatic' pocket (e.g. '-proposed') so apt takes it into
+/// account during dependency resolution.
+///
+/// Apt preferences are global: a single 'release' pin matches the pinned
+/// suite on every repository carrying it (archive, security and ports),
+/// for all architectures, so this also covers cross-builds pulling
+/// dependencies from 'ports.ubuntu.com'.
+fn pin_pocket(pocket_suite: &str, ctx: &Arc<Context>) -> Result<(), Box<dyn Error>> {
+    let pin_path = format!("/etc/apt/preferences.d/pkh-{}", pocket_suite);
+    let pin_content = format!(
+        "Package: *\nPin: release a={}\nPin-Priority: 600\n",
+        pocket_suite
+    );
+    log::info!("Pinning pocket '{}' with priority 600", pocket_suite);
+    ctx.write_file(Path::new(&pin_path), &pin_content)?;
+    Ok(())
+}
+
 fn install_injected_packages(
     packages: &[&str],
     env: &HashMap<String, String>,