Debian DomUs: Distinguish between $dist/updates and $dist-security

From Debian 11 Bullseye onwards, debian uses $dist-security instead of
$dist/updates as distribution part in /etc/apt/sources.list.

Mark those distributions with the old-style subdirectory path with
"security-subdir" in distributions.conf.

Thanks to Paul Wise for the bug report (and hence reminding me of
this) and for the suggestions on how to implement this (even if I
didn't follow them for the sake of simplicity and no additional
dependencies).

Closes: #972749

hooks/common.sh

@@ -422,3 +422,24 @@ installGentooPackage ()
     logMessage "NOTE: Not doing anything - this is a stub - FIXME"
 
 }
+
+
+
+
+#
+#  findDistributionConf path
+#
+# returns either a relative or an absolut path to distributions.conf
+#
+findDistributionsConf ()
+{
+    prefix=$1
+
+    if [ -f etc/distributions.conf ]; then
+        echo etc/distributions.conf
+    elif [ -f ${prefix:-}/etc/xen-tools/distributions.conf ]; then
+        echo ${prefix:-}/etc/xen-tools/distributions.conf
+    elif [ -f /etc/xen-tools/distributions.conf ]; then
+        echo /etc/xen-tools/distributions.conf
+    fi
+}

hooks/debian/20-setup-apt

@@ -20,6 +20,7 @@ else
     . ./hooks/common.sh
 fi
 
+distributions_conf=$(findDistributionsConf $prefix)
 
 #
 # Log our start
@@ -66,7 +67,9 @@ if ( test "${dist}" "!=" "sid" && test "${dist}" "!=" "unstable" && \
      test -e /etc/apt/sources.list && \
      grep ^deb.*security -r /etc/apt/sources.list /etc/apt/sources.list.d >/dev/null 2>/dev/null ) ; then
 
-    cat <<E_O_APT >> ${prefix}/etc/apt/sources.list
+    if fgrep "${dist}" $distributions_conf | fgrep -q security-subdir; then
+
+        cat <<E_O_APT >> ${prefix}/etc/apt/sources.list
 # 
 #  Security updates
 # 
@@ -74,13 +77,25 @@ deb     http://security.debian.org/ ${dist}/updates  main contrib non-free
 deb-src http://security.debian.org/ ${dist}/updates  main contrib non-free
 E_O_APT
 
+    else
+
+        cat <<E_O_APT >> ${prefix}/etc/apt/sources.list
+# 
+#  Security updates
+# 
+deb     http://security.debian.org/ ${dist}-security  main contrib non-free
+deb-src http://security.debian.org/ ${dist}-security  main contrib non-free
+E_O_APT
+
+    fi
+
 else
     cat <<E_O_APT >> ${prefix}/etc/apt/sources.list
 # 
 #  Security updates - Uncomment to enable.
 # 
-# deb     http://security.debian.org/ ${dist}/updates  main contrib non-free
-# deb-src http://security.debian.org/ ${dist}/updates  main contrib non-free
+# deb     http://security.debian.org/ ${dist}-security  main contrib non-free
+# deb-src http://security.debian.org/ ${dist}-security  main contrib non-free
 E_O_APT
 
 fi