The upstream source for shellinabox is archived in googlecode SVN repository, . Some patches were made by users before this package was prepared for the Debian archive. Those patches as well as some of the unreleased changes made by the author are included in a single patch file. dpkg-source -x should prepare a patched directory for building. The working Debian repository for shellinabox is archived in github, . Upgrading the upstream sources may be accomplished by looking for the upstream tag in the repository, pulling back the changes since then, and reapplying those changes to updated archive.