Hi Sylvain, Thanks a lot for the detailed explanation and the workarounds — the -o Acquire::Check-Valid-Until=false option and the ELTS path are both clear and helpful. That said, I'd like to raise a concern about the process itself. Since security.debian.org is signed with a short-term Valid-Until, halting these updates *before* the bullseye-security repositories have actually been transitioned to the archive infrastructure leaves the metadata in an expired state. This doesn't just affect a single setup — it impacts *every user still relying on bullseye-security*, who will now hit Valid-Until errors even though the packages are still being served. Ideally the signatures would keep being refreshed until the move to archive.debian.org is complete, so there's no gap where the repository is served but no longer considered valid. I understand this is outside the scope of the Debian LTS team, so I'd like to follow up with the right people. Could you point me to which team is responsible for the archival / transition to archive.debian.org (I'm guessing the ftp-master or DSA team?), and the best channel to raise this with them (mailing list, bug report against a specific pseudo-package, etc.)? Thanks again for your help. Best regards, Deli, Du From: "Sylvain Beucler"<[email protected]> Date: Wed, Sep 9, 2026, 04:15 Subject: [External] Re: bullseye-security Valid-Until expiry after Debian 11 LTS EOL To: "杜德利"<[email protected]>, "[email protected]"< [email protected]> Cc: "佘开锐"<[email protected]>, "雷玉亚"<[email protected]>, "张延枫"< [email protected]>, "鲍海亭"<[email protected]> Hi,
On 07/09/2026 07:16, 杜德利 wrote: > Dear Debian LTS Team, > I would like to confirm whether the current bullseye-security repository > state after Debian 11 LTS end-of-life is expected, and what the > recommended handling is. > Debian 11 bullseye LTS reached end-of-life on 31 August 2026. > Environment: > > * Debian 11 (bullseye) > * Mirror: http://mirrors.cloud.aliyuncs.com/debian-security <http:// > mirrors.cloud.aliyuncs.com/debian-security> > * Test method: set system date to 2026-09-09 and run apt-get update > > *Observed error:* > ** > As additional context, the security InRelease metadata we checked from > the Debian side is already for Debian 11 / bullseye-security: > We are also seeing that some packages are no longer available from the > bullseye-security repository. > We have seen that Debian 10 security content was eventually moved to > archive infrastructure, so we would like to understand whether Debian 11 > bullseye-security is expected to follow the same transition path, and if > so, what repository configuration users should adopt. > Could you please clarify: > > 1. whether the current behavior is the expected post-EOL state for > bullseye-security; AFAICS security.debian.org is always signed with a short-term Valid-Until, and regenerated often. When bullseye-lts got EOL this stopped being updated, which seems consistent, if a little inconvenient, resulting in your error. If you need to keep using bullseye-lts, you could: - use '-o Acquire::Check-Valid-Until=false' to bypass the error - switch to bullseye ELTS and keep getting security updates https://www.freexian.com/lts/extended/ > 2. whether Debian 11 bullseye-security is expected to move to archive > infrastructure, and what the recommended handling is for systems > that still need final migration / verification work. From prior experience, moving to archive.debian.org can take months and is not scheduled precisely, so you should have the time to finish handling the final migrations. This is not handled by the Debian LTS team so I can't help you more there. Cheers! Sylvain Beucler Debian LTS Team
