You've installed apt-transport-tor to help prevent targeted attacks on your system. Great! Now you want to build Debian packages using cowbuilder, and you notice these are still using plain HTTP.
If you're willing to fetch the first few packages without using apt-transport-tor, this is as easy as:
- Add 'EXTRAPACKAGES="apt-transport-tor"' to your pbuilderrc.
- Run 'cowbuilder --update'
- Set 'MIRRORSITE=tor+http://http.debian.net/debian' in pbuilderrc.
- Run 'cowbuilder --update' again.
Now any future builds should fetch build-dependencies over Tor.
Unfortunately, creating a base.cow from scratch is more problematic. Neither 'debootstrap' nor 'cdebootstrap' actually rely on apt acquire methods to download files - they look at the URL scheme themselves to work out where to fetch from. I think it's a design point that they shouldn't need apt, anyway, so that you can debootstrap on non-Debian systems. I don't have a good solution beyond using some other means to route these requests over Tor.