Debian's apt sources.list is confusing for many people... Here, reprinted with permission, is an explanation that was posted to debian-user:

> - How _exactly_ does apt-get assemble the URI, the distribution name, and
> any component names to find Packages.gz files?

> - How _exactly_ does apt-get combine the URI, distribution, and component
> names with the pathnames in "Filename:" entries in Packages files to find
> *.deb files?

To best explain, we need to define a few variables:

As you may already know, there are two formats for a line in the sources.list file:
  deb $base $distribution $component $component ...
  deb $base $distribution/

Note, that trailing slash is required. Yes, there is a bug in the manpage.

In the Packages file on the server, each entry has a field like this:
  Filename: $field_Filename

$arch is your archetecture, e.g. i386. The command "dpkg --print-architecture" will tell you.

Next, locate the Packages file:

For a line with components, apt looks for the Packages file at $(base)/dists/$(distribution)/$(component)/binary-$(arch)/Packages[.gz]

For a line without components, it looks at $(base)/$(distribution)/Packages[.gz]

Finally, to find the URI of the .deb files to download look at $(base)/$(field_Filename)