Repository navigation
fix(debian-11): install without the bullseye-security suite - #36
Merged
ericwang401 merged 2 commits intoSep 29, 2026
Merged
Conversation
Debian has removed every bullseye binary from security.debian.org, but the bullseye-security index still lists them. With the security suite selected, pkgsel fetches those packages, gets 404 for each, and the install stops at "Select and install software" (pkgsel exit 100). archive.debian.org has not received bullseye-security yet, so no official mirror serves it. Pass apt-setup/services-select=updates on the boot command so the installer uses main and bullseye-updates only. It goes there rather than in preseed.cfg because the Debian preseeds stay byte-identical across releases. Bullseye's cloud.cfg sets apt_preserve_sources_list, so clones keep this sources.list and Proxmox's default package_upgrade does not hit the dead suite on first boot.
gabbelitoV2
marked this pull request as ready for review
September 25, 2026 18:27
bullseye's LTS has ended, so deb.debian.org will drop it for archive.debian.org, and the build would fail again the day it does. Install from the archive now; it already serves bullseye and bullseye-updates and keeps them. The mirror cannot go on the boot command like services-select does. The installer loads preseed.cfg with debconf-set-selections after applying boot parameters, and the shared preseed sets mirror/http/hostname, so a boot-command value would be silently overridden. The preseed now carries a __PACKER_DEBIAN_MIRROR__ placeholder that inject-placeholders.sh fills from the recipe's `# mirror:` header, defaulting to deb.debian.org; the Debian preseeds stay byte-identical. A fallback to deb.debian.org would build fine today and fail later, so the build asserts sources.list points at the archive and omits bullseye-security.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Debian has pulled every bullseye binary from security.debian.org, but the bullseye-security index (Release dated 2026-09-12) still lists them. With the installer's default
apt-setup/services-selectofsecurity, updates, pkgsel fetches those packages, gets a 404 for each, and the debian-11 install stops at "Select and install software" (pkgsel exits 100). Checked 2026-09-25: the security pool'sglibcdirectory holds no deb11.debat all, only source files, and archive.debian.org has no bullseye-security yet, so no official mirror serves the suite.The recipe now passes
apt-setup/services-select=updateson the boot command, so the installer uses main and bullseye-updates only. It goes there rather than inpreseed.cfgbecause the Debian preseeds stay byte-identical across releases (tests/recipe-consistency.test.ts);docs/recipes.mdnow says that a release-only answer belongs on the boot command.Clones don't pick the suite back up. Bullseye's packaged cloud-init (20.4.1-2+deb11u1) sets
apt_preserve_sources_list: truein/etc/cloud/cloud.cfg, so the installer'ssources.listsurvives first boot, and Proxmox's defaultpackage_upgrade: trueruns against main and updates only.The tradeoff: the image carries no bullseye LTS security updates. Debian no longer serves those binaries anywhere, so no bullseye guest can install them either way. Once archive.debian.org hosts bullseye-security, pointing
apt-setup/security_hostthere would bring them back. Retiring debian-11 now that its LTS has ended is the other option, if you prefer it.bun test: 523 pass, 0 fail.bun run typecheckis clean. Verified with a full debian-11 build from this branch on a two-node PVE 9.2 cluster: the install completed past the package step, and the template was created on both nodes.