I hit this bug as well with our debian mirror, mirrors.wikimedia.org.
We also use nginx to serve our mirror and bullseye clients frequently
receive resets while pulling down packages. I tested reverting commit,
fa375493c5a4ed9c10d4e5257ac82c6e687862d3, and it does indeed stop the
connection resets. I also tested against apache2, but I was unable to
reproduce the issue, so it seems to be nginx specific. I am happy to provide
pcaps as well.
Here is the script I used to reproduce:
#!/bin/bash
set -o errexit
if [[ $EUID -ne 0 ]]; then
printf 'MUST BE ROOT\n' >&2
exit 1
fi
sed -i 's/deb.debian.org/mirrors.wikimedia.org/' /etc/apt/sources.list
apt-get update
while true; do
apt-get clean
declare -a install_opts=(--yes --download-only --no-install-recommends)
declare -a install_pkgs=(firefox-esr chromium)
if ! apt-get install "${install_opts[@]}" "${install_pkgs[@]}"; then
printf 'ERROR: We caught a fish!\n' >&2
tput bel
exit 1
fi
done
Here is how I built apt to test the revert:
#!/bin/bash
set -o errexit
echo 'deb-src http://deb.debian.org/debian bullseye main'
apt-get update
apt-get install --yes git build-essential
apt-get build-dep --yes apt
git clone https://salsa.debian.org/apt-team/apt.git
git config --global user.email "jhathaway@wikimedia.org"
git config --global user.name "Jesse Hathaway"
pushd apt
git checkout 2.2.4
git checkout -b butter
git revert --no-edit fa375493c5a4ed9c10d4e5257ac82c6e687862d3
dpkg-buildpackage -jauto -us -nc -b
popd
dpkg -i -- *.deb
I tested with buildah and this Dockerfile:
FROM docker.io/debian:bullseye
ENV LANG C.UTF-8
COPY build /root/
COPY resets /root/