Bug#1104093: apt doesn't download dep11 files of a self-hosted repository

Package: apt
Version: 3.0.0
X-Debbugs-CC: [email protected]

I own and manage a self-hosted Debian repository 
(https://repo.dawn.org.in/apt). This repository implements the dep11 
specification to provide metadata files for the hosted packages. I use 
`appstream-generator` for generating the metadata. The appstream files 
are stored correctly in the directory named dep11 
(dists/stable/main/dep11) as per the specification. The Release and 
InRelease files are also updated afterwards to include these files.

However for some reason, apt never fetches the dep11 files from the 
repository. I checked the file access permissions on the web-server and 
cross checked them by manually accessing the files via `wget`. It seems 
that apt doesn't even try to fetch the metadata from the server. To 
confirm this, I manually checked /var/lib/apt/lists. There is no 
evidence of any appstream data downloaded from the repository. I also 
checked /var/lib/swcatalog. appstreamcli does not recognize the app (in 
this case, the repository hosts a game called wikilynx 
(in.org.dawn.wikilynx)). appstreamcli is able to recognize the app from 
Flathub metadata.

I cross checked the directory structure and Release file with Debian 
repositories, except for the fact that the repo does not implement 
fetch-by-hash method, there is no visible difference in placement of 
these dep11 files. I have tested this in several clients and none of 
them showed any difference.

Here is a sample `apt update` output on one of my systems.

$ sudo apt update
Get:1 http://deb.debian.org/debian sid InRelease [205 kB]
Get:2 http://deb.debian.org/debian sid/contrib Sources [64.6 kB]
Get:3 http://deb.debian.org/debian sid/main Sources [11.0 MB]
Get:4 https://repository.spotify.com stable InRelease [3,316 B]
Get:5 https://repo.dawn.org.in/apt stable InRelease [8,038 B]
Get:6 https://repository.spotify.com stable/non-free amd64 Packages 
[1,643 B]
Get:7 https://repo.dawn.org.in/apt stable/main amd64 Packages [2,984 B]
Get:8 https://paulcarroty.gitlab.io/vscodium-deb-rpm-repo/debs vscodium 
InRelease [3,411 B]
Get:9 http://deb.debian.org/debian sid/non-free-firmware Sources [7,192 B]
Get:10 https://paulcarroty.gitlab.io/vscodium-deb-rpm-repo/debs 
vscodium/main amd64 Packages [1,208 B]
Get:11 http://deb.debian.org/debian sid/non-free Sources [87.1 kB]
Get:12 http://deb.debian.org/debian sid/main amd64 Packages [10.1 MB]
Get:13 http://deb.debian.org/debian sid/main Translation-en [7,406 kB]
Get:14 http://deb.debian.org/debian sid/main amd64 Components [5,216 kB]
Get:15 http://deb.debian.org/debian sid/main Icons (48x48) [3,759 kB]
Get:16 http://deb.debian.org/debian sid/main Icons (64x64) [7,710 kB]
Get:17 http://deb.debian.org/debian sid/contrib amd64 Packages [67.6 kB]
Get:18 http://deb.debian.org/debian sid/contrib Translation-en [58.3 kB]
Get:19 http://deb.debian.org/debian sid/contrib amd64 Components [39.8 kB]
Get:20 http://deb.debian.org/debian sid/contrib Icons (48x48) [63.5 kB]
Get:21 http://deb.debian.org/debian sid/contrib Icons (64x64) [137 kB]
Get:22 http://deb.debian.org/debian sid/non-free amd64 Packages [132 kB]
Get:23 http://deb.debian.org/debian sid/non-free Translation-en [88.4 kB]
Get:24 http://deb.debian.org/debian sid/non-free amd64 Components [5,264 B]
Get:25 http://deb.debian.org/debian sid/non-free Icons (48x48) [29 B]
Get:26 http://deb.debian.org/debian sid/non-free Icons (64x64) [26.5 kB]
Get:27 http://deb.debian.org/debian sid/non-free-firmware amd64 Packages 
[6,984 B]
Get:28 http://deb.debian.org/debian sid/non-free-firmware Translation-en 
[4,707 B]
Get:29 http://deb.debian.org/debian sid/non-free-firmware amd64 
Components [24.3 kB]
Get:30 http://deb.debian.org/debian sid/non-free-firmware Icons (48x48) 
[29 B]
Get:31 http://deb.debian.org/debian sid/non-free-firmware Icons (64x64) 
[29 B]
Fetched 46.3 MB in 5s (8,697 kB/s)
All packages are up to date.
$

The repository is configured like this.

sudo sh -c "curl https://repo.dawn.org.in/.keys/dawn-repo.gpg > 
/usr/share/keyrings/dawn-repo.gpg"
sudo sh -c "echo deb [signed-by=/usr/share/keyrings/dawn-repo.gpg] 
https://repo.dawn.org.in/apt stable main > 
/etc/apt/sources.list.d/dawn.list"

For your reference, there is also a web-server to host the html, media 
and hints (https://metainfo.dawn.org.in).

I believe apt should fetch the dep11 files from the repository to let 
appstream load the downloaded metadata files.

The output given above is from Debian GNU/Linux trixie/sid, kernel 
6.12.22-amd64, libc6 2.41-7, apt 3.0.0 and appstream 1.0.5-1.