Add Debusine APT sources for trixie and forky

AGENTS.md

@@ -18,8 +18,10 @@ Dockerfiles/
   extra-packages.txt               # Packages installed inside the build chroot
   keyrings/
     qsc-deb-releases.asc           # Qualcomm APT repo PGP public key
+    debusine.asc                   # Qualcomm Debusine qli repo PGP public key
   sources/
-    <distro>/qsc-deb-releases.sources  # Pre-configured Qualcomm APT source entry per distro
+    <ubuntu-distro>/qsc-deb-releases.sources  # QArtifactory source entry
+    <debian-distro>/qli.sources             # Debusine qli source entry
 ```
 
 ## Supported Distros
@@ -41,9 +43,10 @@ Dockerfiles/
   with a plain one that lacks Qualcomm APT sources.
 - **CA certificates in chroot**: The chroot tarball must include `ca-certificates` and `openssl`
   so that HTTPS APT repositories work inside the chroot at build time.
-- **Qualcomm APT key**: All chroots have the Qualcomm PGP key pre-installed at
-  `/etc/apt/keyrings/qsc-deb-releases.asc` and a matching `.sources` file so that packages from
-  `qartifactory-edge.qualcomm.com` are available without `trusted=yes` or `--extra-repo`.
+- **Qualcomm APT sources**:
+  - Ubuntu chroots include `qsc-deb-releases.sources` from `qartifactory-edge.qualcomm.com`.
+  - Debian `trixie` chroots include `qli.sources` from `deb.debusine.qualcomm.com`.
+  - `sid` includes no default Qualcomm source and relies on caller-provided `--extra-repo` when needed.
 
 ## Common Commands
 

Dockerfiles/Dockerfile.debian.sid

@@ -27,14 +27,13 @@ RUN apt-get update && \
 
 COPY extra-packages.txt /tmp/extra-packages.txt
 COPY keyrings/ /tmp/keyrings/
-COPY sources/sid/qsc-deb-releases.sources /tmp/qsc-deb-releases.sources
 
 # sbuild's unshare backend looks for a pre-built tarball at
 # /root/.cache/sbuild/<distro>-<arch>.tar — create it with mmdebstrap
 # so builds don't regenerate it every time, and include ca-certificates
 # so HTTPS extra-repositories work.
-# The customize-hook installs the Qualcomm APT signing key so that callers can
-# use signed-by=/etc/apt/keyrings/qsc-deb-releases.asc instead of trusted=yes.
+# The customize-hook installs available Qualcomm APT signing keys so callers
+# can pass signed-by extra repositories when needed.
 RUN EXTRA_PACKAGES=$(tr -s '[:space:]' ',' < /tmp/extra-packages.txt) && \
     mkdir -p /root/.cache/sbuild && \
     mmdebstrap --variant=buildd \
@@ -43,7 +42,7 @@ RUN EXTRA_PACKAGES=$(tr -s '[:space:]' ',' < /tmp/extra-packages.txt) && \
                --skip=output/mknod \
                --format=tar \
                --components=main,contrib,non-free,non-free-firmware \
-               --customize-hook='mkdir -p "$1/etc/apt/keyrings" && cp /tmp/keyrings/qsc-deb-releases.asc "$1/etc/apt/keyrings/" && mkdir -p "$1/etc/apt/sources.list.d" && cp /tmp/qsc-deb-releases.sources "$1/etc/apt/sources.list.d/"' \
+               --customize-hook='mkdir -p "$1/etc/apt/keyrings" && cp /tmp/keyrings/*.asc "$1/etc/apt/keyrings/"' \
                sid \
                /root/.cache/sbuild/sid-arm64.tar
 

Dockerfiles/Dockerfile.debian.trixie

@@ -1,4 +1,4 @@
-# Use an official Ubuntu base image
+# Use an official Debian base image
 FROM debian:trixie
 LABEL org.opencontainers.image.source=https://github.com/qualcomm-linux/docker-pkg-build
 
@@ -14,7 +14,7 @@ RUN apt-get update && \
 
 COPY extra-packages.txt /tmp/extra-packages.txt
 COPY keyrings/ /tmp/keyrings/
-COPY sources/trixie/qsc-deb-releases.sources /tmp/qsc-deb-releases.sources
+COPY sources/trixie/qli.sources /tmp/qli.sources
 
 RUN EXTRA_PACKAGES=$(tr -s '[:space:]' ',' < /tmp/extra-packages.txt) && \
     sbuild-createchroot --include="$EXTRA_PACKAGES" \
@@ -24,11 +24,11 @@ RUN EXTRA_PACKAGES=$(tr -s '[:space:]' ',' < /tmp/extra-packages.txt) && \
                         /srv/chroot/trixie \
                         http://deb.debian.org/debian && \
     mkdir -p /srv/chroot/trixie/etc/apt/keyrings && \
-    cp /tmp/keyrings/qsc-deb-releases.asc /srv/chroot/trixie/etc/apt/keyrings/ && \
-    cp /tmp/qsc-deb-releases.sources /srv/chroot/trixie/etc/apt/sources.list.d/
+    cp /tmp/keyrings/*.asc /srv/chroot/trixie/etc/apt/keyrings/ && \
+    cp /tmp/qli.sources /srv/chroot/trixie/etc/apt/sources.list.d/
 
 # Set working directory
 WORKDIR /workspace
 
 # Default command
-CMD [ "bash" ]
+CMD [ "bash" ]

Dockerfiles/keyrings/debusine.asc

@@ -0,0 +1,9 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEag8p/xYJKwYBBAHaRw8BAQdAdB6JSNF1OXxnsTgp4VTUekW52BM7e6ZQVRsq
+QT5QDaS0JEFyY2hpdmUgc2lnbmluZyBrZXkgZm9yIHF1YWxjb21tL3FsaYiQBBMW
+CgA4FiEEOwuFfyf8aPE5SQakb8qSvoHfw8IFAmoPKf8CGwMFCwkIBwIGFQoJCAsC
+BBYCAwECHgECF4AACgkQb8qSvoHfw8Lz1gEA9XocADbvqUgZQc0LceThn7vMI98d
+kTJoiInuulQ6rEUBANo+GOKILH71VRnZ5jWtsu7IlVk7oUMlTtC0eE5tcBwB
+=bX6V
+-----END PGP PUBLIC KEY BLOCK-----

Dockerfiles/sources/trixie/qli.sources

@@ -0,0 +1,7 @@
+# Qualcomm Linux repository
+Types: deb
+URIs: https://deb.debusine.qualcomm.com/qualcomm/qli
+Suites: trixie
+Components: main contrib non-free-firmware non-free
+Signed-By: /etc/apt/keyrings/debusine.asc
+Enabled: yes

README.md

@@ -136,7 +136,9 @@ docker_deb_build.py \
 ### Docker Images
 
 To add a new suite, copy an existing suite Dockerfile in `Dockerfiles/` and adapt it for the new release.
-Also add the suite-specific Qualcomm source file under `Dockerfiles/sources/<suite>/qsc-deb-releases.sources`.
+Also add any suite-specific Qualcomm source files under `Dockerfiles/sources/<suite>/`:
+- Ubuntu suites use `qsc-deb-releases.sources`
+- Debian `trixie` uses `qli.sources`
 
 The last step is to ensure the new image is also pushed to GHCR as part of the
 `.github/workflows/qcom-container-build-and-upload.yml` workflow by adding a new line in the

docker_deb_build.py

@@ -26,7 +26,7 @@
 from color_logger import logger
 
 # Docker image name template
-# suite_name: 'noble', 'questing', 'sid'
+# suite_name: 'noble', 'questing', 'trixie', 'sid'
 # Example: ghcr.io/qualcomm-linux/pkg-builder:noble
 DOCKER_IMAGE_NAME_FMT = "ghcr.io/qualcomm-linux/pkg-builder:{suite_name}"