debian: match upstream trusty