Wrong debian-security repo URI in `debian/eol:bullseye`

[olifre]

Trying to install e.g. gnupg yields:

Err:27 http://deb.debian.org/debian-security bullseye-security/main amd64 gnupg all 2.2.27-2+deb11u3
  404  Not Found
Fetched 10.3 MB in 0s (22.5 MB/s)
E: Failed to fetch http://deb.debian.org/debian-security/pool/updates/main/g/gnupg2/gnupg_2.2.27-2%2bdeb11u3_all.deb  404  Not Found
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

This is true both for the debian/bullseye container, which is not of course EOL, and the debian/eol:bullseye which is maintained here.

All of these repos fail:

• http://deb.debian.org/debian-security (see above)
• http://security.debian.org (missing files, e.g. http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_2.2.27-2%2bdeb11u3_amd64.deb )
• http://archive.debian.org/debian-security (/dists/does not contain bullseye yet)

So it is unclear to me which URL is the correct one to use, but the one within the containers does not work anymore.

[jas4711]

I get this failure too -- I suppose debian-security doesn't support bullseye any more?

https://gitlab.com/gsasl/guile-gnutls/-/jobs/16346578007

[tianon]

Huh, I thought this was going to be as simple as rebuilding since this is very normal for the archives historically, but this is the strangest one I've seen -- https://deb.debian.org/debian-security/dists/bullseye-security/ still exists and contains the appropriate metadata files, but directories like https://snapshot.debian.org/archive/debian-security/20260904T180512Z/pool/updates/main/g/gnupg2/ holding the actual referenced deb files seem to have been removed, which is very odd. 🤔

[jas4711]

I think clearly debian-security shouldn't be included any more:

E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is expired (invalid since 16h 37min 8s). Updates for this repository will not be applied.

[tianon]

Yes 😅 That much is obviously true the very minute archive.debian.org actually has all the bits, but rather than make that choice by hand over and over again over the years, I've opted to let it happen automatically based on availability -- that's come back to bite a few times, but never quite like this.

[smcv]

This seems more like an infrastructure issue within Debian than an intentional part of the EOL process. Normally each EOL suite is copied to archive.debian.org first, and then completely deleted from deb.debian.org and security.debian.org, significantly later than the EOL date (for example https://lists.debian.org/debian-devel-announce/2025/06/msg00001.html for Debian 10 was almost a year after the EOL of Debian 10 LTS).

The fact that deb.debian.org and security.debian.org are still serving metadata from dists/, but not the corresponding data in pool/, has been reported as https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147093

Separately, I requested a copy of bullseye-security on archive.debian.org as https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147150

E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is expired (invalid since 16h 37min 8s). Updates for this repository will not be applied.

For this part, I think it would be reasonable to set check-valid-until=no on those sources.list entries, to acknowledge that bullseye is known to be EOL and there will be no more security updates from bullseye-security. (But that won't really be useful until at least one of the Debian infrastructure issues linked above is fixed.)

I think clearly debian-security shouldn't be included any more

The problem with that is that if debian/eol:bullseye stops having some sort of apt source for debian-security, the next rebuild of the image will no longer have the last 2 years of updates (everything that was updated since the handover from Debian to Debian LTS in mid 2024), so the contents of the rebuilt image will be strictly older than they used to be.