#1147093 Bullseye Security Updates not available on archive.debian.org and broken on security.debian.org

Package:
security.debian.org
Source:
security.debian.org
Submitter:
Björn Kautler
Date:
2026-10-04 12:05:01 UTC
Severity:
normal
#1147093#5
Date:
2026-09-07 12:51:40 UTC
From:
To:
Since today (7.9.) the bulls-eye security updates do not work properly anymore.
For example https://security.debian.org/debian-security/dists/bullseye-security/main/binary-amd64/Packages.gz
contains for "Package: systemd-sysv" the "Version: 247.3-7+deb11u8"
with "Filename:
pool/updates/main/s/systemd/systemd-sysv_247.3-7+deb11u8_amd64.deb",
but that directory only contains version
"systemd-sysv_252.38-1~deb12u1_amd64.deb".

On https://archive.debian.org/debian-security/dists/ there is also
neither "bullseye-security", nor "bullseye", and also
https://archive.debian.org/debian-security/pool/updates/main/s/systemd/
only has versions up to 241.7.

Yesterday, the update from security.debian.org still worked.

PS: I know Bullseye LTS support ended 31.8., but it would be nice if
either security.debian.org or archive.debian.org would still provide
the released updates, or at least not deliver broken metadata,
claiming a deb file that is no longer present. I'm maintainer of the
setup-wsl GitHub action which currently still has support for Bullseye
and currently fails to do an "apt-get update && apt-get upgrade --yes"
due to that.
#1147093#10
Date:
2026-09-07 15:54:28 UTC
From:
To:
Adding a data point that corroborates this report (package downloads via apt, not just Release/Packages metadata).

Since today (2026-09-07), `apt-get install` on Debian 11 (bullseye) fails  with 404 errors for several bullseye-security packages when fetched via  deb.debian.org

404 http://deb.debian.org/debian-security/pool/updates/main/v/vim/vim_8.2.2434-3+deb11u3_amd64.deb
404 http://deb.debian.org/debian-security/pool/updates/main/g/gnupg2/gnupg_2.2.27-2+deb11u3_all.deb
404 http://deb.debian.org/debian-security/pool/updates/main/g/glibc/libc-dev-bin_2.31-13+deb11u14_amd64.deb
#1147093#21
Date:
2026-09-13 15:13:54 UTC
From:
To:
http://snapshot.debian.org/archive/debian-security/20260903T220410Z
appears complete for bullseye-security.

Tim.
#1147093#31
Date:
2026-09-14 16:27:41 UTC
From:
To:
[...]

The semi-obvious answer is caching. The .deb is not present on any of
the back-end servers from which Fastly fetches content, so the only way
that URL continues to work is because the file is in Fastly's cache.

Regards,

Adam
#1147093#42
Date:
2026-09-18 13:23:15 UTC
From:
To:
Hi,

That could explain it (though I'm wondering how long this lasts, the
above link is still valid for me today).

What's less obvious to me (and users) is why we have a bullseye-security
dist that is valid (updated 2026-09-12), but that references deleted files.

Why were the packages removed before archival, in the first place? :/
This is unexpected.

Cheers!
Sylvain Beucler
Debian LTS Team
#1147093#49
Date:
2026-09-28 14:06:44 UTC
From:
To:
This bug still exists as of the 28th. Attempts on my Debian 11 machine
to say, install wireshark fail. And every apt usage reports errors with
the bullseye-security repos being missing.

I know this was a mistake. I know the packages are still on the snapshot
servers. This mistake is breaking thousands of exist Debian 11 installs.
Fixing the mistake by restoring the bullseye-security repos would not be
a change in policy but instead a continuation of the behavior of Debian
the last 20 years and in fact, the behavior of pretty much every
legitimate linux distro when a version goes end of life. No distro out
there just deletes the repos and tells users,

"<mjt> ok, this seems to be pointless really. I, as one of the people
behind debian, don't really care if people will stop using debian
because some ancient version has been removed from the official mirrors
- don't care at all :)"

Maintaining an archived copy of the packages does not really even rise
to the level of support. It's just not actively attacking your users.
It's the status quo. So I'm shocked that Debian is just letting this
happen and indeed not caring at all about it.

I can assure you that lots of users both human and corporate do care
that our installs no longer work. We care a lot and this behavior is ...
unprecedented.

- superkuh
#1147093#54
Date:
2026-09-29 17:18:46 UTC
From:
To:
Not just thousands of installs, but also every docker container that still
extends bullseye!

idk if it's a proper workaround but since you broke my databases I had to
add this to my dockerfile before apt:

RUN sed -e '/debian.org/ s/^#*/# /' -i /etc/apt/sources.list \
    && echo "deb http://archive.debian.org/debian bullseye main" >>
/etc/apt/sources.list \
    && echo "deb http://archive.debian.org/debian bullseye-updates
main" >> /etc/apt/sources.list \
    && echo "deb [check-valid-until=no]
http://snapshot.debian.org/archive/debian-security/20260903T220410Z/
bullseye-security main" >> /etc/apt/sources.list
#1147093#59
Date:
2026-10-03 16:23:39 UTC
From:
To:
FTR, we lost bullseye->upgrade upgrade tests in mariadb due to this:
https://salsa.debian.org/mariadb-team/mariadb-server/-/commit/bdd35953ec60cab2e0f5188aab08b865a2e68d3f

- Sylvain
#1147093#64
Date:
2026-10-04 11:46:27 UTC
From:
To:
bullseye-security and bullseye-security-debug are now available from
archive.d.o:

- https://archive.debian.org/debian-security/dists/bullseye-security/
- https://archive.debian.org/debian-security-debug/dists/bullseye-security-debug/

Ansgar
#1147093#81
Date:
2026-10-04 11:56:49 UTC
From:
To:
Dear Ansgar,

Thank you for archiving bullseye security. To understand, why is the path
https://archive.debian.org/debian-security/dists/bullseye-security/

Previous archives have a slightly different path
https://archive.debian.org/debian-security/dists/buster/updates/
#1147093#86
Date:
2026-10-04 12:03:50 UTC
From:
To:
archive.debian.org follows the paths from the archives that the
original files came from. The security suites have used the new paths
since the release of bullseye more than five years ago, so you're a
little late noticing...

See section 5.1.3 of the bullseye release notes.

Regards,

Adam