Yum or apt-get like system on Solaris

The Packages.gz contains a Filename field with a value that probably looks something like pool/main/n/name-of-package/name-of-package_version_amd64.deb. This tells the package manager to look at that URL.
For instance, if you have the following line in your sources.list(.d):
deb https://some-domain.com/some-url some-distribution main
You will have the following file: https://some-domain.com/some-url/dists/some-distribution/main/binary-amd64/Packages.gz
That file will reference pool/main/n/name-of-package/name-of-package_version_amd64.deb, so your package manager will look at https://some-domain.com/some-url/pool/main/n/name-of-package/name-of-package_version_amd64.deb.

Sources.gz works the same way, but is optional. It works with apt source, which will fetch you the source if you wish to compile it yourself instead of using the pre-built binaries.
This is mainly useful for system administrators who want to patch the exact version of the package used by a distribution, rather than contributors/curious people who would just go to the project's homepage and follow the build instructions there.

If a package is in the distribution's pool directory but not in Packages.gz, it is most probably in another Package.gz. Notice how you have several words in a typical sources.list line:
deb http://archive.ubuntu.com/ubuntu precise main universe multiverse
main, universe and multiverse each have their own Packages.gz file. You may need to enable some, as debian for instance disables non-free by default. However, some packages still won't be available (not even in pool). You may choose to add untrusted repositories (such as PPAs on Ubuntu), package the missing program yourself (so you and other people can use their package manager to manage that program) or simply build and install it yourself (you should use the /usr/local prefix to avoid conflicts with your package manager).