I just got bitten by this when I wanted to get the source of libcairo2-1.8.6-2 on my testing system.
Ubuntu has apparently fixed this in 0.7.20.2ubuntu1, see https://bugs.launchpad.net/debian/+source/apt/+bug/202219. I haven't looked at it in detail, but maybe the change could be adopted?
signature.asc
Description: PGP signature