Followup-For: Bug #1143813
Package: apt-cacher-ng
X-Debbugs-Cc: Tj <[email protected]>, Russell King <[email protected]>
Russell: David (penguin42) pinged me on Matrix about this and I've done
some digging.
I used your 2026-08-06 trixie-security bad/good and compared against
the copies on snapshot.debian.org [0] because snapshot no longer
collects debian-backports so unable to compare those.
The obvious issue is the SHA's seen in the 'bad' file are actually from
the previous day but something has altered the header fields - that
explains the failed signature.
$ diff -u InRelease.snapshot.20260805-215856.txt InRelease.bad
--- InRelease.snapshot.20260805-215856.txt 2026-08-11
17:39:44.590066986 +0000
+++ InRelease.bad 2026-08-11 17:38:51.632581770 +0000
@@ -6,8 +6,8 @@
Suite: stable-security
Version: 13
Codename: trixie-security
-Date: Wed, 05 Aug 2026 21:58:30 UTC
-Valid-Until: Wed, 12 Aug 2026 21:58:30 UTC
+Date: Thu, 06 Aug 2026 09:33:27 UTC
+Valid-Until: Thu, 13 Aug 2026 09:33:27 UTC
Acquire-By-Hash: yes
Architectures: amd64 arm64 armel armhf i386 ppc64el riscv64 s390x
Components: updates/main updates/contrib updates/non-free-firmware
updates/non-free
I do not see anything in apt-cacher-ng source that could be doing this
so I suspect this is being done by an upstream server. If
/etc/apt-cacher-ng/acng.conf is unchanged and has:
$ grep 'Remap-secdeb' /etc/apt-cacher-ng/acng.conf
Remap-secdeb: security.debian.org security.debian.org/debian-security
deb.debian.org/debian-security /debian-security
cdn-fastly.deb.debian.org/debian-security ;
deb.debian.org/debian-security security.debian.org
cdn-fastly.deb.debian.org/debian-security
Then the list after the semi-colon is the remote servers contacted, and
according to the code and docs the first is used until it returns a
vital error (but not 404s) and moves on to the next
I wonder if enabling (un-commenting) Debug will add sufficient data to
/var/log/apt-cacher-ng/*.{log,err} to identify the target server (by IP
address).
$ grep 'Debug' /etc/apt-cacher-ng/acng.conf
# it's a convenience alias for the Debug option, see below for details.
# Debug:3
It rather looks like a Fastly issue since all the IP addresses are
Fastly regardless of the name (security doesn't CNAME but has the
addresses as A/AAAA resource records):
$ resolvectl query -t CNAME deb.debian.org
deb.debian.org IN CNAME debian.map.fastlydns.net
$ resolvectl query deb.debian.org
deb.debian.org: 151.101.194.132 -- link: SUNNY
151.101.130.132 -- link: SUNNY
151.101.2.132 -- link: SUNNY
151.101.66.132 -- link: SUNNY
2a04:4e42::644 -- link: SUNNY
2a04:4e42:400::644 -- link: SUNNY
2a04:4e42:200::644 -- link: SUNNY
2a04:4e42:600::644 -- link: SUNNY
(debian.map.fastlydns.net)
$ resolvectl query security.debian.org
security.debian.org: 2a04:4e42::644 -- link: SUNNY
2a04:4e42:200::644 -- link: SUNNY
2a04:4e42:400::644 -- link: SUNNY
2a04:4e42:600::644 -- link: SUNNY
151.101.2.132 -- link: SUNNY
151.101.66.132 -- link: SUNNY
151.101.130.132 -- link: SUNNY
151.101.194.132 -- link: SUNNY
I'm not quite sure who to talk to about this or how to prove for sure
how the CDN is doing this.
[0]
https://snapshot.debian.org/archive/debian-security/20260805T215856Z/dists/trixie-security/
