Build securedrop-proxy package with qubesdb integration

debian/control

@@ -2,7 +2,7 @@ Source: securedrop-client
 Section: unknown
 Priority: optional
 Maintainer: SecureDrop Team <securedrop@freedom.press>
-Build-Depends: debhelper-compat (= 11), dh-apparmor, python3-virtualenv, libssl-dev, pkg-config
+Build-Depends: debhelper-compat (= 11), dh-apparmor, python3-virtualenv, libssl-dev, pkg-config, libclang-dev, qubesdb-dev
 Standards-Version: 3.9.8
 Homepage: https://github.com/freedomofpress/securedrop-client
 X-Python3-Version: >= 3.5

debian/rules

@@ -7,7 +7,7 @@ override_dh_auto_install:
 	bash ./debian/setup-venv.sh client
 	bash ./debian/setup-venv.sh export
 	bash ./debian/setup-venv.sh log
-	cargo build --release --locked
+	cargo build --release --locked --features qubesdb
 	dh_auto_install
 	dh_apparmor --profile-name=usr.bin.securedrop-client -psecuredrop-client
 

scripts/Dockerfile

@@ -1,13 +1,19 @@
 ARG DISTRO=bullseye
 FROM debian:$DISTRO
 
+# ARGs must be repeated for every different build stage
+ARG DISTRO
+
 ENV PIP_DISABLE_PIP_VERSION_CHECK=1
 ENV PIP_PROGRESS_BAR=off
 ENV CARGO_TERM_COLOR=never
 ENV CARGO_TERM_PROGRESS_WHEN=never
 
 RUN apt-get update && apt-get --yes upgrade && apt-get install --yes build-essential curl
 
+RUN echo "deb [arch=amd64] https://deb.qubes-os.org/r4.1/vm ${DISTRO} main" > /etc/apt/sources.list.d/qubes.list
+COPY qubes-archive-keyring.gpg /etc/apt/trusted.gpg.d/
+
 # Keep in sync with rust-toolchain.toml
 ENV RUST_VERSION 1.74.1
 ENV RUSTUP_VERSION 1.24.3