[schmitch]

Fixes #750

What

An apt proxy answered 404 for every pool path except pool/<component>/<prefix>/<package>/<file>. The Debian security archive keeps its packages one level deeper. Its dists/bookworm-security/main/binary-amd64/Packages lists, today:

Filename: pool/updates/main/7/7zip/7zip_22.01+really26.02+dfsg-0+deb12u1_amd64.deb

So a proxy of security.debian.org/debian-security, set up as docs/apt.md describes, served apt-get update but no security package.

How

• layout. A pool path may have an area before its component: pool/[<area>/]<component>/<prefix>/<directory>/<file>. PoolPath::area is empty for the layout hosted repositories and dpkg's tools write, and updates for the security archive.
• Proxies. These paths are served. The file is checked against the Packages index of its component, the directory before the name's prefix (main). That index is the one the archive's Release lists hashes for and the one clients read. Package selectors apply to these files as to any other pool file (hello:amd64).
• Hosted repositories keep their one layout. A path below an area is neither found (pool_matches) nor deleted (pool_ref) there: DELETE pool/updates/main/h/hello/… answers 404 and leaves pool/main/h/hello/… alone.

apt repositories are new in 2.2.0 (#176), so there is no changelog fragment.

Tests

• forge-format-apt unit tests: parsing a pool/updates/main/… path; selectors and pool_matches on such a path; the proxy looks the file up in dists/<d>/main/binary-amd64/Packages.gz. 44 passed.

• crates/server/tests/apt.rs proxies_serve_the_security_archives_pool:

  • a mock security mirror serves the package through the proxy;
  • a package that does not match main's index answers 502;
  • a hosted repository finds and deletes nothing below pool/updates/.

  7 passed.

• .github/scripts/apt-e2e.sh: the mock mirror also holds security-pkg under pool/updates/main/, and the real apt-get installs it through the proxy. CI's apt-e2e job runs it; I did not run it locally.

• cargo clippy -p forge-format-apt -p forge-server --all-targets -- -D warnings and cargo fmt --check are clean.

---

Generated by Claude Code