Cannot import needed packages into the new tagged APT snapshot at point-release time

Originally created by @intrigeri on #11612 (Redmine)

When running ./bin/tag-apt-snapshots as part of the Tails 2.5 release process, I’m told:

I: detected origin: debian with reference: 2016073103
[...]
W: some packages were not found anywhere:
 - base-files/8+deb8u4/i386/binary
 - dmeventd/2:1.02.90-2.2/i386/binary
 - dmsetup/2:1.02.90-2.2/i386/binary
 - electrum/2.6.3-1/all/binary
 - evince-common/3.14.1-2/all/binary
 - evince/3.14.1-2/i386/binary

The build manifest contains:

origin_references:
  debian:
    reference: '2016073103'

… because config/APT_snapshots.d/debian/serial contains “latest”, which in this context means “do what I mean”, that is stick to previous release’s tagged snapshot (auto/scripts/apt-mirror)… except the part of our build system that creates the build manifest does not know about this convention.

And anyway, even if the build manifest pointed to the right place, i.e. the previous release’s (2.4) tagged APT snapshot, which is the only place where the missing packages are as of today: tails-prepare-tagged-apt-snapshot-import in its current shape does not know how to generate a configuration that pulls from there.

One option could be to modify how we deal with point-releases: when releasing, instead of using the aforementioned “latest” convention, on the stable branch we could keep pointing to the actual time-based snapshots we need for the next point-releases (in this case: 2016052503) and prevent them from being garbage-collected until next major release.

Feature Branch: bugfix/11612-tagged-APT-snapshot-for-point-release

Parent Task: sysadmin#5926 (closed)