In the equuleus branch, both debootstrap and live-build require unmerged patches. For debootstrap, the current practice is to patch within the Dockerfile; the same method is suggested for live-build:
https://phabricator.vyos.net/T1710
However, one can raise the objection that this is an improper change to a user's build environment, without warning; a suggested alternative is to maintain our own versions of these packages, especially as the live-team is slow in merging patches.