From 3919563e58a3f208c70ac9b324ea16c09949600a Mon Sep 17 00:00:00 2001
From: Jeremy Stanley <fungi@yuggoth.org>
Date: Tue, 15 Oct 2019 21:20:02 +0000
Subject: [PATCH] Add security suite name override in debian-minimal

Add option to set the suite subpath after the release name for the
security mirror URL independently in the debian-minimal element,
since this can differ between mirrors.

Change-Id: I4cc8f54fba012986423e30e19bff276208b8ad62
---
 diskimage_builder/elements/debian-minimal/README.rst       | 4 +++-
 .../debian-minimal/environment.d/10-debian-minimal.bash    | 3 ++-
 releasenotes/notes/debian-security-b4f677a148fdf9c9.yaml   | 7 +++++++
 3 files changed, 12 insertions(+), 2 deletions(-)
 create mode 100644 releasenotes/notes/debian-security-b4f677a148fdf9c9.yaml

diff --git a/diskimage_builder/elements/debian-minimal/README.rst b/diskimage_builder/elements/debian-minimal/README.rst
index 2b6368e3..c2b5e3fa 100644
--- a/diskimage_builder/elements/debian-minimal/README.rst
+++ b/diskimage_builder/elements/debian-minimal/README.rst
@@ -17,6 +17,8 @@ mirroring (see ``debootsrap`` element documentation).  However, the
 security repositories are separate for Debian, so we can not assume
 they exist at ``DIB_DISTRIBUTION_MIRROR``.  If you do not wish to use
 the upstream repository (from ``security.debian.org``) override it
-with ``DIB_DEBIAN_SECURITY_MIRROR``.
+with ``DIB_DEBIAN_SECURITY_MIRROR``. The security suite name's subpath
+can also be overridden to something other than ``/updates`` with the
+``DIB_DEBIAN_SECURITY_SUBPATH`` variable.
 
 .. element_deps::
diff --git a/diskimage_builder/elements/debian-minimal/environment.d/10-debian-minimal.bash b/diskimage_builder/elements/debian-minimal/environment.d/10-debian-minimal.bash
index dad20965..acaa6f33 100644
--- a/diskimage_builder/elements/debian-minimal/environment.d/10-debian-minimal.bash
+++ b/diskimage_builder/elements/debian-minimal/environment.d/10-debian-minimal.bash
@@ -11,6 +11,7 @@ export DIB_DISTRIBUTION_MIRROR=${DIB_DISTRIBUTION_MIRROR:-http://deb.debian.org/
 # choice is for people to add it separately, otherwise we use
 # upstream.
 DIB_DEBIAN_SECURITY_MIRROR=${DIB_DEBIAN_SECURITY_MIRROR:-http://security.debian.org/}
+DIB_DEBIAN_SECURITY_SUBPATH=${DIB_DEBIAN_SECURITY_SUBPATH:-/updates}
 
 export DIB_DEBIAN_COMPONENTS=${DIB_DEBIAN_COMPONENTS:-main}
 export DIB_DEBIAN_COMPONENTS_WS=${DIB_DEBIAN_COMPONENTS//,/ }
@@ -19,7 +20,7 @@ DIB_APT_SOURCES_CONF_DEFAULT=\
 "default:deb ${DIB_DISTRIBUTION_MIRROR} ${DIB_RELEASE} ${DIB_DEBIAN_COMPONENTS_WS}
 backports:deb ${DIB_DISTRIBUTION_MIRROR} ${DIB_RELEASE}-backports ${DIB_DEBIAN_COMPONENTS_WS}
 updates:deb ${DIB_DISTRIBUTION_MIRROR} ${DIB_RELEASE}-updates ${DIB_DEBIAN_COMPONENTS_WS}
-security:deb ${DIB_DEBIAN_SECURITY_MIRROR} ${DIB_RELEASE}/updates ${DIB_DEBIAN_COMPONENTS_WS}
+security:deb ${DIB_DEBIAN_SECURITY_MIRROR} ${DIB_RELEASE}${DIB_DEBIAN_SECURITY_SUBPATH} ${DIB_DEBIAN_COMPONENTS_WS}
 "
 
 if [ "${DIB_RELEASE}" = "testing" -o "${DIB_RELEASE}" = "unstable" ]; then
diff --git a/releasenotes/notes/debian-security-b4f677a148fdf9c9.yaml b/releasenotes/notes/debian-security-b4f677a148fdf9c9.yaml
new file mode 100644
index 00000000..2dd969b3
--- /dev/null
+++ b/releasenotes/notes/debian-security-b4f677a148fdf9c9.yaml
@@ -0,0 +1,7 @@
+---
+features:
+  - |
+    A new variable ``DIB_DEBIAN_SECURITY_SUBPATH`` is added to
+    override the suite subpath of security repositories.  Previously
+    this was hard-coded to the upstream repository layout, which may
+    not always match the mirror's layout.