Mark deb packages with security fixes as security updates

Hi,

I've noticed you've just released Openresty 1.11.2.4 in order to include the latest security fixes from upstream nginx version.

We only update our Ubuntu systems (automatically) with security fixes, but this new version isn't detected as a security release. In order to detect which security fixes do we have to apply, we use apt-show-versions command:

$ apt-show-versions | grep openresty

openresty:amd64/xenial 1.11.2.3-4~xenial1 upgradeable to 1.11.2.4-1~xenial1
openresty-openssl:amd64/xenial 1.0.2k-2~xenial1 uptodate
openresty-opm:amd64/xenial 1.11.2.3-4~xenial1 upgradeable to 1.11.2.4-1~xenial1
openresty-pcre:amd64/xenial 8.40-1~xenial1 uptodate
openresty-resty:all/xenial 1.11.2.3-4~xenial1 upgradeable to 1.11.2.4-1~xenial1
openresty-zlib:amd64/xenial 1.2.11-2~xenial1 uptodate

As you can see, all openresty packages are from "all/xenial" target. Instead of this, if these packages were marked as xenial-security they would be covered by the following command:

$ apt-show-versions | grep openresty | grep upgradeable | grep $(lsb_release -cs)-security

<no output>

Could you mark them as xenial-security instead of xenial when the new version is released because of a security fix?

Thanks

Start by locating the packaging scripts for Ubuntu releases and review how package targets are assigned. Use the apt-show-versions examples in the issue to verify the behavior; done means security-fix releases are marked for the xenial-security target instead of xenial.