Comment 1 for bug 1860780

Adding more things to the sources.list that's put into place just before finalising the image indeed wouldn't affect Launchpad. However, we must be careful that the actual set of packages in the image doesn't include post-release pockets, as that would impair our ability to accurately build packages that e.g. are supposed to be built without -updates.

That is, the process needs to involve building chroots without -security, -updates, etc., and if we put -security and -updates in place in the final sources.list then that has to be done at the end. live-build has various facilities for doing this kind of thing but I don't remember the exact details.