diff -pruN 1.43/debian/changelog 1.43ubuntu1/debian/changelog
--- 1.43/debian/changelog	2016-03-24 05:14:32.000000000 +0000
+++ 1.43ubuntu1/debian/changelog	2016-08-12 06:20:42.000000000 +0000
@@ -1,3 +1,22 @@
+net-retriever (1.43ubuntu1) yakkety; urgency=medium
+
+  * Resynchronise with Debian.  Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+    - Support overlay archives.
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Fri, 12 Aug 2016 07:20:03 +0100
+
 net-retriever (1.43) unstable; urgency=medium
 
   [ Roger Shimizu ]
@@ -34,6 +53,40 @@ net-retriever (1.40) unstable; urgency=m
 
  -- Christian Perrier <bubulle@debian.org>  Thu, 25 Jun 2015 15:09:25 +0200
 
+net-retriever (1.39ubuntu3) xenial; urgency=medium
+
+  * Support CC.ports.ubuntu.com, and set appropriate security host for
+    those (ports.ubuntu.com).
+
+ -- Dimitri John Ledkov <xnox@ubuntu.com>  Fri, 15 Apr 2016 12:38:35 +0100
+
+net-retriever (1.39ubuntu2) wily; urgency=medium
+
+  * Fix handling of failures when downloading files from an overlay: we want
+    to give up and exit only if the download was successful and the file is
+    found on disk, otherwise go ahead and try to fetch it from the archive.
+
+ -- Mathieu Trudel-Lapierre <mathieu-tl@ubuntu.com>  Fri, 03 Jul 2015 23:18:58 -0400
+
+net-retriever (1.39ubuntu1) vivid; urgency=medium
+
+  * Resynchronise with Debian.  Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+    - Support overlay archives.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Mon, 17 Nov 2014 16:38:51 +0000
+
 net-retriever (1.39) unstable; urgency=medium
 
   [ Updated translations ]
@@ -57,6 +110,28 @@ net-retriever (1.38) unstable; urgency=l
 
  -- Cyril Brulebois <kibi@debian.org>  Wed, 29 Jan 2014 21:19:59 +0100
 
+net-retriever (1.37ubuntu1) trusty; urgency=medium
+
+  [ Colin Watson ]
+  * Resynchronise with Debian.  Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+  [ Michael Casadevall ]
+  * Merge in overlay archive support (LP: #1250930).
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Thu, 09 Jan 2014 14:41:43 +0000
+
 net-retriever (1.37) unstable; urgency=low
 
   [ Updated translations ]
@@ -64,6 +139,24 @@ net-retriever (1.37) unstable; urgency=l
 
  -- Christian Perrier <bubulle@debian.org>  Tue, 17 Dec 2013 11:55:45 +0100
 
+net-retriever (1.36ubuntu1) trusty; urgency=low
+
+  * Resynchronise with Debian.  Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Tue, 29 Oct 2013 08:07:14 -0700
+
 net-retriever (1.36) unstable; urgency=low
 
   [ Updated translations ]
@@ -71,6 +164,24 @@ net-retriever (1.36) unstable; urgency=l
 
  -- Christian Perrier <bubulle@debian.org>  Sat, 14 Sep 2013 15:25:12 +0200
 
+net-retriever (1.35ubuntu1) saucy; urgency=low
+
+  * Resynchronise with Debian.  Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Tue, 10 Sep 2013 23:35:11 +0100
+
 net-retriever (1.35) unstable; urgency=low
 
   [ Updated translations ]
@@ -78,6 +189,24 @@ net-retriever (1.35) unstable; urgency=l
 
  -- Christian Perrier <bubulle@debian.org>  Sun, 08 Sep 2013 15:58:46 +0200
 
+net-retriever (1.34ubuntu1) saucy; urgency=low
+
+  * Resynchronise with Debian.  Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Fri, 02 Aug 2013 11:46:27 +0100
+
 net-retriever (1.34) unstable; urgency=low
 
   [ Dmitrijs Ledkovs ]
@@ -87,6 +216,31 @@ net-retriever (1.34) unstable; urgency=l
 
  -- Christian Perrier <bubulle@debian.org>  Sat, 13 Jul 2013 14:21:02 +0200
 
+net-retriever (1.33ubuntu2) saucy; urgency=low
+
+  * Deduplicate Packages files entirely in C, massively speeding it up for
+    large files (LP: #1067934).
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Tue, 16 Jul 2013 13:13:15 +0100
+
+net-retriever (1.33ubuntu1) saucy; urgency=low
+
+  * Resynchronise with Debian.  Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Mon, 20 May 2013 15:17:47 +0100
+
 net-retriever (1.33) unstable; urgency=low
 
   [ Updated translations ]
@@ -94,6 +248,24 @@ net-retriever (1.33) unstable; urgency=l
 
  -- Christian Perrier <bubulle@debian.org>  Fri, 17 May 2013 22:13:46 +0200
 
+net-retriever (1.32ubuntu1) raring; urgency=low
+
+  * Resynchronise with Debian.  Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Tue, 08 Jan 2013 10:08:45 +0000
+
 net-retriever (1.32) unstable; urgency=low
 
   [ Updated translations ]
@@ -101,6 +273,30 @@ net-retriever (1.32) unstable; urgency=l
 
  -- Christian Perrier <bubulle@debian.org>  Tue, 11 Dec 2012 19:51:48 +0100
 
+net-retriever (1.31ubuntu2) raring; urgency=low
+
+  * Use correct compiler when cross-building.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Thu, 06 Dec 2012 18:06:44 +0000
+
+net-retriever (1.31ubuntu1) raring; urgency=low
+
+  * Resynchronise with Debian.  Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Mon, 26 Nov 2012 17:12:09 +0000
+
 net-retriever (1.31) unstable; urgency=low
 
   * Replace XC-Package-Type by Package-Type in debian/control
@@ -110,6 +306,24 @@ net-retriever (1.31) unstable; urgency=l
 
  -- Christian Perrier <bubulle@debian.org>  Mon, 15 Oct 2012 08:40:03 +0200
 
+net-retriever (1.30ubuntu1) quantal; urgency=low
+
+  * Resynchronise with Debian.  Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Thu, 21 Jun 2012 11:10:39 +0100
+
 net-retriever (1.30) unstable; urgency=low
 
   * Team upload
@@ -126,6 +340,24 @@ net-retriever (1.30) unstable; urgency=l
 
  -- Christian Perrier <bubulle@debian.org>  Fri, 15 Jun 2012 07:58:14 +0200
 
+net-retriever (1.29ubuntu1) precise; urgency=low
+
+  * Resynchronise with Debian.  Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Wed, 11 Apr 2012 15:21:44 +0100
+
 net-retriever (1.29) unstable; urgency=low
 
   [ Updated translations ]
@@ -150,6 +382,24 @@ net-retriever (1.29) unstable; urgency=l
 
  -- Otavio Salvador <otavio@debian.org>  Thu, 15 Mar 2012 14:50:28 -0300
 
+net-retriever (1.28ubuntu1) oneiric; urgency=low
+
+  * Resynchronise with Debian.  Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Tue, 03 May 2011 11:55:25 +0100
+
 net-retriever (1.28) unstable; urgency=low
 
   [ Updated translations ]
@@ -167,6 +417,24 @@ net-retriever (1.28) unstable; urgency=l
 
  -- Christian Perrier <bubulle@debian.org>  Sat, 23 Apr 2011 08:04:38 +0200
 
+net-retriever (1.27ubuntu1) natty; urgency=low
+
+  * Resynchronise with Debian.  Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Thu, 13 Jan 2011 09:07:05 -0600
+
 net-retriever (1.27) unstable; urgency=low
 
   [ Updated translations ]
@@ -176,6 +444,30 @@ net-retriever (1.27) unstable; urgency=l
 
  -- Otavio Salvador <otavio@debian.org>  Fri, 24 Dec 2010 20:10:39 -0200
 
+net-retriever (1.26ubuntu2) natty; urgency=low
+
+  * Fix vergt link line ordering.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Mon, 15 Nov 2010 11:49:40 +0000
+
+net-retriever (1.26ubuntu1) natty; urgency=low
+
+  * Resynchronise with Debian.  Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Mon, 15 Nov 2010 10:51:53 +0000
+
 net-retriever (1.26) unstable; urgency=low
 
   [ Updated translations ]
@@ -191,6 +483,24 @@ net-retriever (1.26) unstable; urgency=l
 
  -- Otavio Salvador <otavio@debian.org>  Fri, 12 Nov 2010 16:12:10 -0200
 
+net-retriever (1.25ubuntu1) natty; urgency=low
+
+  * Resynchronise with Debian.  Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Tue, 12 Oct 2010 23:14:01 +0100
+
 net-retriever (1.25) unstable; urgency=low
 
   [ Colin Watson ]
@@ -225,6 +535,31 @@ net-retriever (1.25) unstable; urgency=l
 
  -- Christian Perrier <bubulle@debian.org>  Sun, 11 Jul 2010 17:18:48 +0200
 
+net-retriever (1.24ubuntu2) lucid; urgency=low
+
+  * rebuild rest of main for armel armv7/thumb2 optimization;
+    UbuntuSpec:mobile-lucid-arm-gcc-v7-thumb2
+
+ -- Alexander Sack <asac@ubuntu.com>  Sun, 07 Mar 2010 00:58:17 +0100
+
+net-retriever (1.24ubuntu1) karmic; urgency=low
+
+  * Resynchronise with Debian. Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Mon, 15 Jun 2009 14:09:15 +0100
+
 net-retriever (1.24) unstable; urgency=low
 
   [ Christian Perrier ]
@@ -247,6 +582,24 @@ net-retriever (1.24) unstable; urgency=l
 
  -- Christian Perrier <bubulle@debian.org>  Sun, 14 Jun 2009 19:37:20 +0200
 
+net-retriever (1.23ubuntu1) jaunty; urgency=low
+
+  * Resynchronise with Debian. Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Wed, 05 Nov 2008 11:52:55 +0000
+
 net-retriever (1.23) unstable; urgency=low
 
   [ Updated translations ]
@@ -265,6 +618,24 @@ net-retriever (1.23) unstable; urgency=l
 
  -- Otavio Salvador <otavio@debian.org>  Sun, 21 Sep 2008 19:23:24 -0300
 
+net-retriever (1.22ubuntu1) intrepid; urgency=low
+
+  * Resynchronise with Debian. Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+    - Deduplicate Packages files before passing them to anna.
+    - Fetch packages from security host if trying to fetch them from the
+      main host fails.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Tue, 24 Jun 2008 12:10:56 +0100
+
 net-retriever (1.22) unstable; urgency=low
 
   [ Philip Hands ]
@@ -277,6 +648,39 @@ net-retriever (1.22) unstable; urgency=l
 
  -- Frans Pop <fjp@debian.org>  Tue, 17 Jun 2008 14:26:54 +0200
 
+net-retriever (1.21ubuntu3) intrepid; urgency=low
+
+  * Build-depend on libdebian-installer4-dev; add ${shlibs:Depends} to
+    net-retriever's dependencies.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Fri, 30 May 2008 13:19:12 +0100
+
+net-retriever (1.21ubuntu2) intrepid; urgency=low
+
+  * Deduplicate Packages files before passing them to anna (LP: #234486).
+    Circumstances conspire to make this excessively difficult, including
+    requiring net-retriever to become Architecture: any; this should really
+    be done in libdebian-installer, but for the meantime that's even harder.
+  * Fetch packages from security host if trying to fetch them from the main
+    host fails (LP: #94398).
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Fri, 30 May 2008 12:44:30 +0100
+
+net-retriever (1.21ubuntu1) intrepid; urgency=low
+
+  * Resynchronise with Debian. Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+    - Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+    - Fetch installer components from -proposed if apt-setup/proposed is
+      true.
+    - Fetch udebs from components listed in mirror/udeb/components.
+    - Fetch security updates path from apt-setup/security_path if possible.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Mon, 19 May 2008 09:49:47 +0200
+
 net-retriever (1.21) unstable; urgency=low
 
   [ Frans Pop ]
@@ -320,6 +724,39 @@ net-retriever (1.19) unstable; urgency=l
 
  -- Christian Perrier <bubulle@debian.org>  Thu, 10 Jan 2008 07:50:08 +0100
 
+net-retriever (1.18ubuntu4) hardy; urgency=low
+
+  * Fetch security updates path from apt-setup/security_path if possible
+    (LP: #51470).
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Mon, 31 Mar 2008 05:37:44 +0100
+
+net-retriever (1.18ubuntu3) hardy; urgency=low
+
+  * Fetch udebs from components listed in mirror/udeb/components
+    (LP: #191262).
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Sun, 30 Mar 2008 22:14:22 +0100
+
+net-retriever (1.18ubuntu2) hardy; urgency=low
+
+  * Add Vcs-Bzr for Ubuntu.
+  * Fetch installer components from -proposed if apt-setup/proposed is true
+    (LP: #181776).
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Fri, 08 Feb 2008 15:25:38 +0000
+
+net-retriever (1.18ubuntu1) hardy; urgency=low
+
+  * Resynchronise with Debian. Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+  * Depend on ubuntu-keyring-udeb rather than debian-archive-keyring-udeb.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Tue, 23 Oct 2007 18:18:10 +0100
+
 net-retriever (1.18) unstable; urgency=low
 
   * Use /etc/udebs-source as the default release from which to fetch udebs.
@@ -341,6 +778,16 @@ net-retriever (1.17) unstable; urgency=l
 
  -- Frans Pop <fjp@debian.org>  Mon, 21 May 2007 16:40:16 +0200
 
+net-retriever (1.16ubuntu1) gutsy; urgency=low
+
+  * Resynchronise with Debian. Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Wed, 25 Apr 2007 18:51:18 +0100
+
 net-retriever (1.16) unstable; urgency=low
 
   * Multiply menu-item-numbers by 100
@@ -379,6 +826,22 @@ net-retriever (1.13) unstable; urgency=l
 
  -- Frans Pop <fjp@debian.org>  Wed, 31 Jan 2007 11:49:18 +0100
 
+net-retriever (1.12ubuntu2) feisty; urgency=low
+
+  * Set Maintainer to ubuntu-installer@lists.ubuntu.com.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Thu, 15 Mar 2007 00:24:46 +0000
+
+net-retriever (1.12ubuntu1) feisty; urgency=low
+
+  * Resynchronise with Debian. Remaining changes:
+    - Fetch installer components from -updates and -security as well as the
+      unadorned suite; various hacks to deal with finding -security.
+    - Make sure never to download udebs from components other than main and
+      restricted.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Fri, 10 Nov 2006 10:02:19 -0800
+
 net-retriever (1.12) unstable; urgency=low
 
   * Add missing debconf dependencies.
@@ -438,6 +901,19 @@ net-retriever (1.11) unstable; urgency=l
 
  -- Frans Pop <fjp@debian.org>  Thu, 13 Jul 2006 17:29:02 +0200
 
+net-retriever (1.10ubuntu2) edgy; urgency=low
+
+  * Use ports.ubuntu.com instead of security.ubuntu.com on ports
+    architectures (see Malone #39342).
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Wed, 11 Oct 2006 15:13:16 +0100
+
+net-retriever (1.10ubuntu1) edgy; urgency=low
+
+  * Resynchronise with Debian.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Thu, 29 Jun 2006 13:43:02 +0100
+
 net-retriever (1.10) unstable; urgency=low
 
   [ Updated translations ]
@@ -453,6 +929,23 @@ net-retriever (1.10) unstable; urgency=l
 
  -- Frans Pop <fjp@debian.org>  Mon, 23 Jan 2006 20:32:17 +0100
 
+net-retriever (1.09ubuntu2) dapper; urgency=low
+
+  * Fetch installer components from -updates and -security (the latter from
+    apt-setup/security_host or security.ubuntu.com) as well as the unadorned
+    suite.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Tue,  2 May 2006 22:42:09 +0100
+
+net-retriever (1.09ubuntu1) dapper; urgency=low
+
+  * Resynchronise with Debian.
+  * Make sure never to download udebs from components other than main and
+    restricted. This is an Ubuntu-specific hack for now because I have no
+    bright ideas on how to make it more generic.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Tue, 17 Jan 2006 22:12:10 +0000
+
 net-retriever (1.09) unstable; urgency=low
 
   * Support Release files with multiple signatures; as long as one signature
@@ -531,6 +1024,12 @@ net-retriever (1.07) unstable; urgency=l
 
  -- Frans Pop <fjp@debian.org>  Sun, 25 Dec 2005 02:47:01 +0100
 
+net-retriever (1.06ubuntu1) dapper; urgency=low
+
+  * Resynchronise with Debian.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Sun, 30 Oct 2005 07:50:48 -0500
+
 net-retriever (1.06) unstable; urgency=low
 
   [ Updated translations ]
@@ -572,6 +1071,12 @@ net-retriever (1.05) unstable; urgency=l
 
  -- Joey Hess <joeyh@debian.org>  Fri, 15 Jul 2005 17:09:45 +0300
 
+net-retriever (1.04ubuntu1) breezy; urgency=low
+
+  * Resynchronise with Debian.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Tue,  3 May 2005 18:06:28 +0100
+
 net-retriever (1.04) unstable; urgency=low
 
   * Not for sarge; needs new anna.
@@ -596,6 +1101,36 @@ net-retriever (1.04) unstable; urgency=l
 
  -- Joey Hess <joeyh@debian.org>  Sun,  1 May 2005 11:02:27 -0400
 
+net-retriever (1.03ubuntu4) hoary; urgency=low
+
+  * Add draft Xhosa translation.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Tue, 22 Mar 2005 13:58:35 +0000
+
+net-retriever (1.03ubuntu3) hoary; urgency=low
+
+  * Use gpgv --ignore-time-conflict to avoid validation errors due to clock
+    problems.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Tue,  8 Feb 2005 08:26:55 +0000
+
+net-retriever (1.03ubuntu2) hoary; urgency=low
+
+  * Look for main/.../Packages.gz in Release, not
+    hoary/main/.../Packages.gz.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Mon, 24 Jan 2005 14:10:35 +0000
+
+net-retriever (1.03ubuntu1) hoary; urgency=low
+
+  * Backport from trunk:
+    - Define error() as well as calling it.
+  * Check md5sum and size of each Packages file against Release file.
+  * Check signature of Release file if gpgv and the Ubuntu keyring are
+    installed.
+
+ -- Colin Watson <cjwatson@canonical.com>  Fri, 14 Jan 2005 20:19:03 +0000
+
 net-retriever (1.03) unstable; urgency=low
 
   * Fix a stupid mistake in the logic of the last version.
diff -pruN 1.43/debian/control 1.43ubuntu1/debian/control
--- 1.43/debian/control	2016-01-30 04:05:32.000000000 +0000
+++ 1.43ubuntu1/debian/control	2016-08-12 06:19:52.000000000 +0000
@@ -1,17 +1,19 @@
 Source: net-retriever
 Section: debian-installer
 Priority: optional
-Maintainer: Debian Install System Team <debian-boot@lists.debian.org>
+Maintainer: Ubuntu Installer Team <ubuntu-installer@lists.ubuntu.com>
+XSBC-Original-Maintainer: Debian Install System Team <debian-boot@lists.debian.org>
 Uploaders: Christian Perrier <bubulle@debian.org>, Cyril Brulebois <kibi@debian.org>
-Build-Depends: debhelper (>= 9)
+Build-Depends: debhelper (>= 9), libdebian-installer4-dev
 Build-Depends-Indep: dpkg-dev (>= 1.7.0)
-Vcs-Browser: https://anonscm.debian.org/cgit/d-i/net-retriever.git
-Vcs-Git: https://anonscm.debian.org/git/d-i/net-retriever.git
+XS-Debian-Vcs-Browser: https://anonscm.debian.org/cgit/d-i/net-retriever.git
+XS-Debian-Vcs-Git: https://anonscm.debian.org/git/d-i/net-retriever.git
+Vcs-Bzr: http://bazaar.launchpad.net/~ubuntu-core-dev/net-retriever/ubuntu
 
 Package: net-retriever
 Package-Type: udeb
-Architecture: all
-Depends: ${misc:Depends}, choose-mirror, configured-network, di-utils (>= 1.58), gpgv-udeb, debian-archive-keyring-udeb
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, choose-mirror, configured-network, di-utils (>= 1.58), gpgv-udeb, ubuntu-keyring-udeb
 Provides: retriever
 Description: Fetch modules from the Internet
  This is a retriever that uses wget to fetch files over http or ftp.
diff -pruN 1.43/debian/net-retriever.install 1.43ubuntu1/debian/net-retriever.install
--- 1.43/debian/net-retriever.install	2011-01-19 04:49:30.000000000 +0000
+++ 1.43ubuntu1/debian/net-retriever.install	2016-08-12 06:17:24.000000000 +0000
@@ -1 +1,2 @@
 net-retriever usr/lib/debian-installer/retriever
+deduplicate usr/lib/net-retriever
diff -pruN 1.43/debian/net-retriever.templates 1.43ubuntu1/debian/net-retriever.templates
--- 1.43/debian/net-retriever.templates	2011-01-19 04:49:30.000000000 +0000
+++ 1.43ubuntu1/debian/net-retriever.templates	2016-08-12 06:17:24.000000000 +0000
@@ -11,3 +11,10 @@ _Description: Downloading a file failed:
  problem with your network, or with the mirror. You can choose to retry
  the download, select a different mirror, or cancel and choose another
  installation method.
+
+Template: mirror/udeb/components
+Type: multiselect
+Choices: main, restricted, universe, multiverse
+Default: main, restricted
+Description: for internal use; may be preseeded
+ Components from which to retrieve udebs.
diff -pruN 1.43/debian/po/be.po 1.43ubuntu1/debian/po/be.po
--- 1.43/debian/po/be.po	2015-04-27 03:01:47.000000000 +0000
+++ 1.43ubuntu1/debian/po/be.po	2016-08-12 06:19:20.000000000 +0000
@@ -23,9 +23,10 @@ msgstr ""
 "Project-Id-Version: be\n"
 "Report-Msgid-Bugs-To: debian-boot@lists.debian.org\n"
 "POT-Creation-Date: 2008-01-26 07:32+0000\n"
-"PO-Revision-Date: 2010-07-06 01:58+0300\n"
-"Last-Translator: Viktar Siarheichyk <vics@eq.by>\n"
-"Language-Team: Belarusian <i18n@mova.org>\n"
+"PO-Revision-Date: 2015-12-21 15:13+0300\n"
+"Last-Translator: Viktar Siarheichyk <vics@fsfe.org>\n"
+"Language-Team: Debian l10n team for Belarusian <debian-l10n-belarusian@lists."
+"debian.org>\n"
 "Language: be\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
diff -pruN 1.43/debian/po/da.po 1.43ubuntu1/debian/po/da.po
--- 1.43/debian/po/da.po	2011-07-07 01:02:01.000000000 +0000
+++ 1.43ubuntu1/debian/po/da.po	2016-08-12 06:19:20.000000000 +0000
@@ -6,6 +6,8 @@
 # translation of debian-installer_packages_po_sublevel1_da.po to
 # Danish messages for debian-installer.
 # This file is distributed under the same license as debian-installer.
+# Joe Hansen <joedalton2@yahoo.dk>, 2011, 2012, 2013, 2014, 2015.
+# Ask Hjorth Larsen <asklarsen@gmail.com>, 2010.
 # Mads Bille Lundby <lundbymads@gmail.com, 2009.
 # Henrik Christian Grove <debian@3001.dk>, 2008.
 # Jesper Dahl Nyerup <debian@jespernyerup.dk>, 2008.
@@ -15,14 +17,31 @@
 #
 # Volume er oversat til diskenhed. Ret hvis Dansk-gruppen finder en anbefaling.
 #
+# Translations from iso-codes:
+# Alastair McKinstry <mckinstry@computer.org>, 2001.
+# Claus Hindsgaul <claus.hindsgaul@gmail.com>, 2006.
+# Claus Hindsgaul <claus_h@image.dk>, 2004, 2005, 2006.
+# Computeroversættelse Tobias Toedter <t.toedter@gmx.net>, 2007.
+# Copyright (C) Free Software Foundation, Inc., 2006.
+# Frederik 'Freso' S. Olesen <freso.dk@gmail.com>, 2008.
+# Free Software Foundation, Inc., 2000, 2004, 2005.
+# Joe Hansen <joedalton2@yahoo.dk>, 2009, 2010, 2011.
+# Keld Simonsen <keld@dkuug.dk>, 2000, 2001.
+# Kenneth Christiansen <kenneth@gnu.org>, 2000.
+# Ole Laursen <olau@hardworking.dk>, 2001.
+#
+# vedrørende russisk:
+# (bogstavet й bliver normalt til j på dansk og y på engelsk.  Der er
+# også nogle forskelle med de mange s/sh-agtige lyde)
+#
 msgid ""
 msgstr ""
 "Project-Id-Version: debian-installer_packages_po_sublevel1_da\n"
 "Report-Msgid-Bugs-To: debian-boot@lists.debian.org\n"
 "POT-Creation-Date: 2008-01-26 07:32+0000\n"
-"PO-Revision-Date: 2010-08-05 10:48+0200\n"
-"Last-Translator: Jacob Sparre Andersen <jacob@jacob-sparre.dk>\n"
-"Language-Team: Danish <debian-l10n-danish@lists.debian.org>\n"
+"PO-Revision-Date: 2015-08-16 20:20+0200\n"
+"Last-Translator: Joe Hansen <joedalton2@yahoo.dk>\n"
+"Language-Team: <dansk@dansk-gruppen.dk>\n"
 "Language: da\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
diff -pruN 1.43/debian/rules 1.43ubuntu1/debian/rules
--- 1.43/debian/rules	2011-01-19 04:49:30.000000000 +0000
+++ 1.43ubuntu1/debian/rules	2016-08-12 06:17:24.000000000 +0000
@@ -1,3 +1,12 @@
 #! /usr/bin/make -f
+
+DEB_BUILD_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
+DEB_HOST_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
+
 %:
 	dh $@
+
+ifneq ($(DEB_BUILD_GNU_TYPE),$(DEB_HOST_GNU_TYPE))
+override_dh_auto_build:
+	dh_auto_build -- CC=$(DEB_HOST_GNU_TYPE)-gcc
+endif
diff -pruN 1.43/deduplicate.c 1.43ubuntu1/deduplicate.c
--- 1.43/deduplicate.c	1970-01-01 00:00:00.000000000 +0000
+++ 1.43ubuntu1/deduplicate.c	2016-08-12 06:17:24.000000000 +0000
@@ -0,0 +1,216 @@
+/* Remove duplicates in Packages file, pending libd-i doing it for us. */
+
+#define _GNU_SOURCE
+
+#include <sys/types.h>
+#include <ctype.h>
+#include <regex.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <debian-installer.h>
+
+di_hash_table *versions, *entries;
+regex_t package_re, version_re;
+
+static void package_version_free (void *key)
+{
+	di_package_version *ver = key;
+
+	di_free (ver->upstream);
+	di_free (ver->debian_revision);
+	di_free (ver);
+}
+
+static void xregcomp (regex_t *preg, const char *regex, int cflags)
+{
+	int err;
+
+	err = regcomp (preg, regex, cflags);
+	if (err) {
+		char *errbuf;
+		size_t errbuf_size;
+
+		errbuf_size = regerror (err, preg, NULL, 0);
+		errbuf = di_malloc (errbuf_size);
+		regerror (err, preg, errbuf, errbuf_size);
+		fprintf (stderr, "Failed to compile /%s/: %s", regex, errbuf);
+		di_free (errbuf);
+		exit (1);
+	}
+}
+
+static bool match_regex_capture_one (regex_t *preg, di_rstring *entry,
+				     di_rstring *out)
+{
+	regmatch_t matches[2];
+
+	if (regexec (preg, entry->string, 2, matches, 0) != 0 ||
+	    matches[1].rm_so == -1 || matches[1].rm_eo == -1)
+		return false;
+	out->size = matches[1].rm_eo - matches[1].rm_so;
+	out->string = di_stradup (entry->string + matches[1].rm_so, out->size);
+	return true;
+}
+
+static di_rstring *rstring_copy (di_rstring *orig)
+{
+	di_rstring *copy;
+
+	copy = di_new (di_rstring, 1);
+	copy->string = strdup (orig->string);
+	copy->size = orig->size;
+	return copy;
+}
+
+static void deduplicate_one (di_rstring *entry)
+{
+	di_rstring package, newver_str;
+	di_package dummynewver;
+	di_package_version *newver, *oldver;
+
+	package.string = NULL;
+	newver_str.string = NULL;
+
+	if (!match_regex_capture_one (&package_re, entry, &package))
+		goto out;
+	if (!*package.string ||
+	    memchr (package.string, '/', package.size))
+		goto out;
+
+	if (!match_regex_capture_one (&version_re, entry, &newver_str))
+		goto out;
+
+	/* libdebian-installer has a crazy interface that won't let me parse
+	 * raw strings, so I need this dance.
+	 */
+	dummynewver.version = newver_str.string;
+	newver = di_package_version_parse (&dummynewver);
+	if (!newver) {
+		fprintf (stderr, "failed to parse version %s\n",
+			 newver_str.string);
+		exit (2);
+	}
+	oldver = di_hash_table_lookup (versions, &package);
+	if (oldver && di_package_version_compare (oldver, newver) >= 0) {
+		package_version_free (newver);
+		goto out;
+	}
+	di_hash_table_insert (versions, rstring_copy (&package), newver);
+	di_hash_table_insert (entries, rstring_copy (&package),
+			      rstring_copy (entry));
+
+out:
+	di_free (package.string);
+	di_free (newver_str.string);
+}
+
+struct entry {
+	di_rstring key, value;
+};
+
+struct all_entries {
+	struct entry *entries;
+	di_ksize_t size, pos;
+};
+
+static void entry_append (void *key, void *value, void *user_data)
+{
+	struct all_entries *all_entries = user_data;
+	all_entries->entries[all_entries->pos].key = *(di_rstring *) key;
+	all_entries->entries[all_entries->pos].value = *(di_rstring *) value;
+	++all_entries->pos;
+}
+
+static int entry_compare (const void *va, const void *vb)
+{
+	const struct entry *a = va, *b = vb;
+	return strcmp (a->key.string, b->key.string);
+}
+
+static void output (void)
+{
+	struct all_entries all_entries;
+	di_ksize_t i;
+
+	all_entries.size = di_hash_table_size (entries);
+	all_entries.entries = di_new (struct entry, all_entries.size);
+	all_entries.pos = 0;
+	di_hash_table_foreach (entries, entry_append, &all_entries);
+	qsort (all_entries.entries, all_entries.size, sizeof (struct entry),
+	       entry_compare);
+
+	for (i = 0; i < all_entries.size; ++i) {
+		di_rstring *value = &all_entries.entries[i].value;
+
+		fputs (value->string, stdout);
+		if (!value->size || value->string[value->size - 1] != '\n')
+			fputc ('\n', stdout);
+		fputc ('\n', stdout);
+	}
+
+	di_free (all_entries.entries);
+}
+
+int main (int argc, char **argv)
+{
+	int ret;
+	di_rstring line;
+	ssize_t line_size;
+	size_t line_alloc;
+	di_rstring entry;
+	size_t entry_alloc;
+
+	versions = di_hash_table_new_full (di_rstring_hash, di_rstring_equal,
+					   free, package_version_free);
+	entries = di_hash_table_new_full (di_rstring_hash, di_rstring_equal,
+					  free, free);
+	xregcomp (&package_re, "^Package:[[:space:]]+(.*)",
+		  REG_EXTENDED | REG_ICASE | REG_NEWLINE);
+	xregcomp (&version_re, "^Version:[[:space:]]+(.*)",
+		  REG_EXTENDED | REG_ICASE | REG_NEWLINE);
+	line_alloc = 0;
+	line.string = NULL;
+	entry_alloc = 4096;
+	entry.string = di_malloc (entry_alloc);
+	entry.size = 0;
+
+	while ((line_size = getline (&line.string, &line_alloc, stdin)) >= 0) {
+		line.size = (di_ksize_t) line_size;
+		if (*line.string && *line.string != '\n') {
+			di_ksize_t new_size;
+
+			new_size = entry.size + line.size + 1;
+			if (new_size > entry_alloc) {
+				while (new_size > entry_alloc)
+					entry_alloc *= 2;
+				entry.string = di_realloc (entry.string,
+							   entry_alloc);
+			}
+			memcpy (entry.string + entry.size, line.string,
+				line.size + 1);
+			entry.size += line.size;
+		} else {
+			deduplicate_one (&entry);
+			*entry.string = '\0';
+			entry.size = 0;
+		}
+	}
+	if (ferror (stdin)) {
+		perror ("getline");
+		ret = 1;
+		goto out;
+	}
+	if (entry.size)
+		deduplicate_one (&entry);
+	output ();
+	ret = 0;
+
+out:
+	di_hash_table_destroy (versions);
+	di_hash_table_destroy (entries);
+	regfree (&package_re);
+	regfree (&version_re);
+	return ret;
+}
diff -pruN 1.43/Makefile 1.43ubuntu1/Makefile
--- 1.43/Makefile	1970-01-01 00:00:00.000000000 +0000
+++ 1.43ubuntu1/Makefile	2016-08-12 06:17:24.000000000 +0000
@@ -0,0 +1,7 @@
+CFLAGS := -Os -fomit-frame-pointer -g -Wall
+LDLIBS := -ldebian-installer
+
+all: deduplicate
+
+clean:
+	rm -f deduplicate
diff -pruN 1.43/net-retriever 1.43ubuntu1/net-retriever
--- 1.43/net-retriever	2016-03-24 04:03:39.000000000 +0000
+++ 1.43ubuntu1/net-retriever	2016-08-12 06:19:20.000000000 +0000
@@ -16,11 +16,35 @@ db_get mirror/$protocol/hostname
 hostname="$RET"
 db_get mirror/$protocol/directory
 directory="$RET"
+if db_get apt-setup/security_host; then
+	sechostname="$RET"
+	if db_get apt-setup/security_path; then
+		secdirectory="$RET"
+	else
+		secdirectory=/ubuntu
+	fi
+elif echo $hostname | grep -q ports.ubuntu.com; then	
+	# Awful Ubuntu-specific hack. *-security suites for ports
+	# architectures aren't available on security.ubuntu.com, only on
+	# ports.ubuntu.com.
+	sechostname="$hostname"
+	secdirectory="$directory"
+else
+	# TODO: hardcoding, since apt-setup might not be installed yet
+	sechostname=security.ubuntu.com
+	secdirectory=/ubuntu
+fi
+
+# We may have an overlayed archive to replace installer components
+db_get apt-setup/overlay_host
+overlay_host="$RET"
+db_get apt-setup/overlay_directory
+overlay_directory="$RET"
 
-keyring=/usr/share/keyrings/archive.gpg
+keyring_dir=/usr/share/keyrings
 
 fetch() {
-	fetch-url -c "${protocol}://${hostname}${directory}/$1" "$2"
+	fetch-url -c "${protocol}://$1$2/$3" "$4"
 }
 
 # Note: callers are expected to check for non-empty strings in return,
@@ -84,12 +108,36 @@ read_gpg_status() {
 	exit 1
 }
 
+# Nasty hack to remove duplicates in Packages file.
+deduplicate () {
+	/usr/lib/net-retriever/deduplicate <"$1" >"$1.new"
+	mv "$1.new" "$1"
+}
+
 cmd="$1"
 shift
 
 case "$cmd" in
     retrieve)
-	fetch "$@"
+	# This entire function is a massive hack, but since we don't records
+	# where we downloaded Packages.gz from, we need to try a scattershot
+	# approach to downloading.
+	#
+	# FIXME: Revise this and other installer logic to download from the
+	# correct location only
+	if db_get apt-setup/overlay && [ "$RET" = true ]; then
+		fetch "$overlay_host" "$overlay_directory" "$@"
+
+		# Ugh, this is horribly hacky, but the second argument
+		# is where the file will be written out to, and this prevents
+		# us from polling the main archive if we don't need to
+		if [ $? = 0 ] && [ -e "$2" ]; then
+			exit 0
+		fi
+	fi
+
+	fetch "$hostname" "$directory" "$@" || \
+		fetch "$sechostname" "$secdirectory" "$@"
 	exit $?
 	;;
 
@@ -107,21 +155,70 @@ case "$cmd" in
 	fi
 	codename="$RET"
 
+	# TODO: Ubuntu-specific hack to fetch -updates and
+	# -security; is there any way to make this more generic?
+	codenames="$codename $codename-updates $codename-security"
+	if db_get apt-setup/proposed && [ "$RET" = true ]; then
+		codenames="$codenames $codename-proposed"
+	fi
+	for codename_extra in $codenames; do
+		if [ "$codename_extra" = "$codename-security" ]; then
+			thishost="$sechostname"
+			thisdir="$secdirectory"
+		else
+			thishost="$hostname"
+			thisdir="$directory"
+		fi
+		if $0 packages_one "$thishost" "$thisdir" "$1" "$codename_extra"; then
+			:
+		else
+			ret=$?
+			if [ "$codename_extra" = "$codename" ]; then
+				deduplicate "$1"
+				exit $ret
+			else
+				# ignore errors from secondary suites
+				continue
+			fi
+		fi
+	done
+	# Now handle the overlay archive
+	if db_get apt-setup/overlay && [ "$RET" = true ]; then
+		# FIXME: Failure probably should be an error
+		$0 packages_one "$overlay_host" "$overlay_directory" "$1" "$codename"
+	fi
+		
+	deduplicate "$1"
+	exit 0
+	;;
+
+    packages_one)
+	codename="$4"
 	Release="/tmp/net-retriever-$$-Release"
-	fetch "dists/$codename/Release" "$Release" || exit $?
+	fetch "$1" "$2" "dists/$codename/Release" "$Release" || exit $?
 	# If gpgv and a keyring are installed, authentication is
 	# mandatory by default.
-	if type gpgv >/dev/null && [ -f "$keyring" ]; then
+	if type gpgv >/dev/null && [ -d "$keyring_dir" ]; then
 		if db_get debian-installer/allow_unauthenticated && [ "$RET" = true ]; then
 			log "Not verifying Release signature: unauthenticated mode enabled"
 		else
-			if ! fetch "dists/$codename/Release.gpg" "$Release.gpg"; then
+			if ! fetch "$1" "$2" "dists/$codename/Release.gpg" "$Release.gpg"; then
 				error "dists/$codename/Release is unsigned."
 			fi
-			if ! log-output -t net-retriever --pass-stdout \
-			     gpgv --status-fd 1 --keyring "$keyring" \
-			     --ignore-time-conflict \
-			     "$Release.gpg" "$Release" | read_gpg_status; then
+			for keyring in $keyring_dir/*; do
+				# on each iteration, clear the badsig flag
+				badsig=false
+
+				if ! log-output -t net-retriever --pass-stdout \
+				     gpgv --status-fd 1 --keyring "$keyring" \
+				     --ignore-time-conflict \
+				     "$Release.gpg" "$Release" | read_gpg_status; then
+					badsig=true
+				else
+					break
+				fi	
+			done
+			if [ "$badsig" = true ]; then
 				error "Bad signature on $Release."
 			fi
 		fi
@@ -130,11 +227,22 @@ case "$cmd" in
 	fi
 
 	ARCH=`udpkg --print-architecture`
-	components="`grep ^Components: $Release | cut -d' ' -f2-`"
+	allcomponents="`grep ^Components: $Release | cut -d' ' -f2-`"
 	ret=1
-	if [ -z "$components" ]; then
+	if [ -z "$allcomponents" ]; then
 		error "No components listed in $Release."
 	fi
+	db_get mirror/udeb/components
+	components="$(echo "$RET" | sed 's/,/ /g; s/  */ /g')"
+	newcomponents=
+	for comp in $components; do
+		case " $allcomponents " in
+		    *" $comp "*)
+			newcomponents="${newcomponents:+$newcomponents }$comp"
+			;;
+		esac
+	done
+	components="$newcomponents"
 	for comp in $components; do
 		for ext in '.xz' '.gz' ''; do
 			pkgfile="$comp/debian-installer/binary-$ARCH/Packages$ext"
@@ -144,14 +252,14 @@ case "$cmd" in
 			fi
 			Packages="/tmp/net-retriever-$$-Packages"
 			rm -f "$Packages"
-			fetch "dists/$codename/$pkgfile" "$Packages" || continue
+			fetch "$1" "$2" "dists/$codename/$pkgfile" "$Packages" || continue
 			checkmatch "$Release" "$Packages" "$pkgfile"
 			if [ "$ext" = '' ]; then
-				cat "$Packages" >> "$1"
+				cat "$Packages" >> "$3"
 			elif [ "$ext" = .gz ]; then
-				zcat "$Packages" >> "$1"
+				zcat "$Packages" >> "$3"
 			elif [ "$ext" = .xz ]; then
-				xzcat "$Packages" >> "$1"
+				xzcat "$Packages" >> "$3"
 			fi
 			ret=0
 			break
