README: Debian: extend to specify source packages

This allows to refer to Debian source packages. Often there is no
trivial mapping between source and binary packages (several binaries
built from one source, names as well as versions can differ between
binary and source packages!), so package-urls shall allow to explicitely
specify source packages.  Using the arch qualifier for this was
suggested by (former DPL) Chris Lamb and William Bartholomew in
package-url#57 and "avoids people
doing weird things like ?arch=amd64&type=source". To stay consistent
with former versions of the spec, a deb package without qualifier shall
refer to a binary package.

Signed-off-by: Gernot Hillier <[email protected]>

README.rst

@@ -525,13 +525,20 @@ candidate list further down.
   - The `namespace` is the "vendor" name such as "debian" or "ubuntu".
     It is not case sensitive and must be lowercased.
   - The `name` is not case sensitive and must be lowercased.
-  - The `version` is is the package version.
-  - `arch` is the `qualifiers` `key` for a package architecture
+  - The `version` is the version of the binary (or source) package.
+  - `arch` is the `qualifiers` `key` for a package architecture. The special
+    value `arch=source` shall identify a Debian source package (which
+    usually consists of a Debian Source control file (.dsc) and corresponding
+    upstream and Debian sources). In this case, `name` and `version` of the
+    source package shall be given (both may differ from binary package!), as
+    printed by `dpkg-query -f '${source:Package} ${source:Version} -W <pkg>`.
   - Examples::
 
         pkg:deb/debian/[email protected]?arch=i386&distro=jessie
         pkg:deb/debian/[email protected]?arch=amd64&distro=stretch
         pkg:deb/ubuntu/[email protected]?arch=amd64
+        pkg:deb/debian/attr@1:2.4.47-2?arch=source
+        pkg:deb/debian/attr@1:2.4.47-2%2Bb1?arch=amd64
 
 - `docker` for Docker images