fix: harden APT overlay precedence

internal/apt/apt.go

@@ -272,12 +272,9 @@ func translate(input profile.Profile) (translation, error) {
 			return translation{}, fmt.Errorf("APT cannot translate %s value %q: proxy scheme %q is incompatible", candidate.field, profile.ObscureURL(candidate.value), parsed.Scheme)
 		}
 	}
-	settings := make(map[string]string)
-	if httpValue != "" {
-		settings["Acquire::http::Proxy"] = httpValue
-	}
-	if httpsValue != "" {
-		settings["Acquire::https::Proxy"] = httpsValue
+	settings := map[string]string{
+		"Acquire::http::Proxy":  valueOrDirect(httpValue),
+		"Acquire::https::Proxy": valueOrDirect(httpsValue),
 	}
 	for _, bypass := range p.Bypass {
 		if strings.HasPrefix(bypass, ".") || strings.Contains(bypass, "/") || strings.Contains(bypass, ":") {
@@ -292,6 +289,13 @@ func translate(input profile.Profile) (translation, error) {
 	return translation{settings: settings, rendered: render(settings)}, nil
 }
 
+func valueOrDirect(value string) string {
+	if value == "" {
+		return "DIRECT"
+	}
+	return value
+}
+
 var settingOrder = []string{"Acquire::http::Proxy", "Acquire::https::Proxy"}
 
 func render(settings map[string]string) []byte {
@@ -336,7 +340,8 @@ func parseConfiguration(data []byte) map[string]string {
 		if !ok {
 			key, rest, ok = strings.Cut(line, "\t")
 		}
-		if !ok || !recognizedKey(key) {
+		key, recognized := canonicalKey(key)
+		if !ok || !recognized {
 			continue
 		}
 		rest = strings.TrimSpace(rest)
@@ -352,9 +357,22 @@ func parseConfiguration(data []byte) map[string]string {
 	return settings
 }
 
-func recognizedKey(key string) bool {
-	return key == "Acquire::http::Proxy" || key == "Acquire::https::Proxy" ||
-		strings.HasPrefix(key, "Acquire::http::Proxy::") || strings.HasPrefix(key, "Acquire::https::Proxy::")
+func canonicalKey(key string) (string, bool) {
+	parts := strings.Split(key, "::")
+	if len(parts) < 3 || !strings.EqualFold(parts[0], "Acquire") ||
+		(!strings.EqualFold(parts[1], "http") && !strings.EqualFold(parts[1], "https")) ||
+		!strings.EqualFold(parts[2], "Proxy") {
+		return "", false
+	}
+	canonical := "Acquire::" + strings.ToLower(parts[1]) + "::Proxy"
+	if len(parts) == 3 {
+		return canonical, true
+	}
+	host := strings.Join(parts[3:], "::")
+	if host == "" {
+		return "", false
+	}
+	return canonical + "::" + strings.ToLower(host), true
 }
 
 func recognizedProxy(settings map[string]string) (string, bool) {