deb822 sources by default for bookworm

[Julian Andres Klode <jak@debian.org>]

Hi all,

I'd like us to move from

    /etc/apt/sources.list

to
    /etc/apt/sources.list.d/debian.sources

in bookworm.

# deb822 intro

The deb822 format can be shorter and easier to read, to quote the
sources.list manual page:

       As an example, the sources for your distribution could look like this in one-line-style format:

           deb http://deb.debian.org/debian bullseye main contrib non-free
           deb http://security.debian.org bullseye-security main contrib non-free

       or like this in deb822 style format:

           Types: deb
           URIs: http://deb.debian.org/debian
           Suites: bullseye
           Components: main contrib non-free

           Types: deb
           URIs: http://security.debian.org
           Suites: bullseye-security
           Components: main contrib non-free


Now if you mix unstable and testing, you could just have that it one
paragraph.

The big advantage of deb822 sources is that you can embed larger data:

               Types: deb
               URIs: https://deb.debian.org
               Suites: stable
               Components: main contrib non-free
               Signed-By:
                -----BEGIN PGP PUBLIC KEY BLOCK-----
                .
                mDMEYCQjIxYJKwYBBAHaRw8BAQdAD/P5Nvvnvk66SxBBHDbhRml9ORg1WV5CvzKY
                CuMfoIS0BmFiY2RlZoiQBBMWCgA4FiEErCIG1VhKWMWo2yfAREZd5NfO31cFAmAk
                IyMCGyMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQREZd5NfO31fbOwD6ArzS
                dM0Dkd5h2Ujy1b6KcAaVW9FOa5UNfJ9FFBtjLQEBAJ7UyWD3dZzhvlaAwunsk7DG
                3bHcln8DMpIJVXht78sL
                =IE0r
                -----END PGP PUBLIC KEY BLOCK-----

Oh yeah, a standalone sources file with embedded key - making third-party
repository management substantially more convenient.

# issues

several software does not support deb822 currently. I plan to work on
adding deb822 support to python-apt in the upcoming months, I don't know
what else is affected.

There is some software "parsing" sources.list on its own, most of that
is better served by `apt-get indextargets` (and for downloading stuff
based on the urls, `apt-helper download-file`, such that it respects
proxies and supports all transports users may use in sources.list)

In terms of setting up system, I guess debootstrap and d-i's apt-setup
module need changes? I admit I do not have a total overview.

# timeline

I do not know the total outcome of this. My hope would be that
we can switch the default in Summer 2022 and see what breaks,
although I don't know who's going to install from testing
d-i :D

docker images probably can move earlier as they don't have
as much interactive users that use tools that might be broken
(e.g. software-properties). Possibly others, there's no need
to roll out in multiple places at the same time, as long as
we converge by freeze time.

I invite people to test this out already on their own systems,
I know several people do; and extrepo also builds deb822 sources
files, but several people I guess do not know about it yet. Please
test and report bugs.
-- 
debian developer - deb.li/jak | jak-linux.org - free software dev
ubuntu core developer                              i speak de, en