Package: security.debian.org Severity: normal The Debian 11 (Bullseye) security repository currently appears to be inconsistent.
The package index published under: http://security.debian.org/debian-security/dists/bullseye-security/main/binary-amd64/Packages.gz contains package entries whose Filename fields point to package files that are not present on the server. For example: Package: linux-image-amd64 Version: 5.10.262-1 Filename: pool/updates/main/l/linux-signed-amd64/linux-image-amd64_5.10.262-1_amd64.deb However, fetching the referenced file returns HTTP 404: wget -S -O /dev/null \ http://security.debian.org/debian-security/pool/updates/main/l/linux-signed-amd64/linux-image-amd64_5.10.262-1_amd64.deb Show more lines Result: HTTP/1.1 404 Not Found The same issue was observed for additional packages: pool/updates/main/g/grub2/grub-common_2.06-3~deb11u7_amd64.deb pool/updates/main/n/nss/libnss3_3.61-1+deb11u7_amd64.deb pool/updates/main/p/python-httplib2/python3-httplib2_0.18.1-3+deb11u1_all.deb All of the above are referenced in the published package metadata but return HTTP 404 when requested directly from security.debian.org. At the same time, other packages from the same repository are downloadable successfully, for example: pool/updates/main/l/linux-signed-amd64/linux-image-5.10.0-46-amd64_5.10.262-1_amd64.deb This leads to upgrade failures such as: E: Failed to fetch ... 404 Not Found E: Unable to fetch some archives Additionally, the currently published InRelease file contains: Date: Mon, 31 Aug 2026 21:13:04 UTC Valid-Until: Mon, 07 Sep 2026 21:13:04 UTC which is already expired. Best regards -- Atreo Rossol System Administration Cognitec Systems GmbH · Grossenhainer Str. 101 · 01127 Dresden, Germany Phone: +49-351-862-92695 · Mobile: +49-175-7557-146 www.cognitec.com VAT ID: DE222661897 · Amtsgericht Dresden · HRB 20776 · Managing Director: Alfredo Herrera
