Source: cloud-init Version: 20.4.1-2+deb11u1 Severity: important Cloud-init has the ability to generate apt sources when provisioning a system. It does this based on a template installed at /etc/cloud/templates/sources.list.debian.tmpl. The template currently in bullseye results in an incorrect sources.list configuration for a couple of reasons:
1. The security repository is incorrect, resulting in a system that's not configured to install security updates by default. 2. The bullseye-backports repository is enabled by default, but it no longer exists. root@bullseye-tmp:~# dpkg -s cloud-init | grep Vers Version: 20.4.1-2+deb11u1 root@bullseye-tmp:~# apt update Hit:1 http://deb.debian.org/debian bullseye InRelease Ign:2 http://security.debian.org bullseye/updates InRelease Hit:3 http://deb.debian.org/debian bullseye-updates InRelease Err:4 http://security.debian.org bullseye/updates Release 404 Not Found [IP: 2a04:4e42:46::644 80] Ign:5 http://deb.debian.org/debian bullseye-backports InRelease Err:6 http://deb.debian.org/debian bullseye-backports Release 404 Not Found [IP: 2a04:4e42:46::644 80] Reading package lists... Done E: The repository 'http://security.debian.org bullseye/updates Release' does not have a Release file. N: Updating from such a repository can't be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details. E: The repository 'http://deb.debian.org/debian bullseye-backports Release' does not have a Release file. N: Updating from such a repository can't be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details. -- System Information: Debian Release: 13.0 APT prefers testing-security APT policy: (500, 'testing-security'), (500, 'testing') Architecture: amd64 (x86_64) Kernel: Linux 6.12.38+deb13-amd64 (SMP w/4 CPU threads; PREEMPT) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled
