Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #245593 > unrolled thread

Definitive instructions for Buster LTS security updates

Back to article view | Back to linux.debian.user

Contents

  Definitive instructions for Buster LTS security updates Keith Christian <keith1christian@gmail.com> - 2022-02-21 14:30 +0100
    Re: Definitive instructions for Buster LTS security updates Greg Wooledge <greg@wooledge.org> - 2022-02-21 14:40 +0100
      Re: Definitive instructions for Buster LTS security updates David Wright <deblis@lionunicorn.co.uk> - 2022-02-21 15:50 +0100
        Re: Definitive instructions for Buster LTS security updates Christian Britz <cbritz@t-online.de> - 2022-02-21 16:30 +0100
          Re: Definitive instructions for Buster LTS security updates "Andrew M.A. Cater" <amacater@einval.com> - 2022-02-21 21:00 +0100
      Re: Definitive instructions for Buster LTS security updates Keith Christian <keith1christian@gmail.com> - 2022-02-21 16:20 +0100
        Re: Definitive instructions for Buster LTS security updates Tixy <tixy@yxit.co.uk> - 2022-02-21 16:50 +0100
          Re: Definitive instructions for Buster LTS security updates Tixy <tixy@yxit.co.uk> - 2022-02-21 17:00 +0100
    Re: Definitive instructions for Buster LTS security updates Tixy <tixy@yxit.co.uk> - 2022-02-21 15:40 +0100
      Re: Definitive instructions for Buster LTS security updates Keith Christian <keith1christian@gmail.com> - 2022-02-22 14:10 +0100
        Re: Definitive instructions for Buster LTS security updates Greg Wooledge <greg@wooledge.org> - 2022-02-22 14:30 +0100
        Re: Definitive instructions for Buster LTS security updates Tixy <tixy@yxit.co.uk> - 2022-02-22 15:00 +0100
          Re: Definitive instructions for Buster LTS security updates David Wright <deblis@lionunicorn.co.uk> - 2022-02-22 16:20 +0100
            Re: Definitive instructions for Buster LTS security updates Keith Christian <keith1christian@gmail.com> - 2022-02-22 20:20 +0100

#245593 — Definitive instructions for Buster LTS security updates

I plan to bring a Buster machine which has been shut down for quite a
while online again.
Before connecting it to the internet, I looked for instructions on how
to add the LTS security updates entries to sources.list.

My first search brought me to wiki.debian.org, where I landed on the
/LTS/Using page, but it contained no Buster-specific instructions.

After more searches, I saw numerous posts containing messages like
these, and I decided to double check the procedure to obtain LTS
updates.

E: The repository 'http://deb.debian.org/debian buster/updates
Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is
therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user
configuration details.

Seeing the above, I decided to ask here for the latest info.

Thanks!

[toc] | [next] | [standalone]

#245594

On Mon, Feb 21, 2022 at 06:25:35AM -0700, Keith Christian wrote:
> My first search brought me to wiki.debian.org, where I landed on the
> /LTS/Using page, but it contained no Buster-specific instructions.

See also <https://wiki.debian.org/DebianBuster> which says:

Q) Where do I get buster packages?
    Use the following sources for buster:

    deb http://deb.debian.org/debian/ buster main
    deb http://security.debian.org/debian-security buster/updates main

> E: The repository 'http://deb.debian.org/debian buster/updates
> Release' does not have a Release file.

You've got an error here.  Either you meant this to be a security line,
and you've forgotten to use "debian-security" at the tail end of the
URL field, or else you meant this to be a "buster-updates" line, and
accidentally used a / instead of a - character in the third field.

(I'm not sure if a  buster-updates repository section still exists for
that release, but if it does, it'll be spelled with a hyphen.)

[toc] | [prev] | [next] | [standalone]

#245596

[Multipart message — attachments visible in raw view] — view raw

On Mon 21 Feb 2022 at 08:30:54 (-0500), Greg Wooledge wrote:
> On Mon, Feb 21, 2022 at 06:25:35AM -0700, Keith Christian wrote:
> > My first search brought me to wiki.debian.org, where I landed on the
> > /LTS/Using page, but it contained no Buster-specific instructions.
> 
> See also <https://wiki.debian.org/DebianBuster> which says:
> 
> Q) Where do I get buster packages?
>     Use the following sources for buster:
> 
>     deb http://deb.debian.org/debian/ buster main
>     deb http://security.debian.org/debian-security buster/updates main
> 
> > E: The repository 'http://deb.debian.org/debian buster/updates
> > Release' does not have a Release file.
> 
> You've got an error here.  Either you meant this to be a security line,
> and you've forgotten to use "debian-security" at the tail end of the
> URL field, or else you meant this to be a "buster-updates" line, and
> accidentally used a / instead of a - character in the third field.
> 
> (I'm not sure if a  buster-updates repository section still exists for
> that release, but if it does, it'll be spelled with a hyphen.)

AFAICT, running buster, nothing has yet changed. My sources.list
is attached (ignore the first line), and as of this morning it
yields:

 Feb 21 02:17 deb.debian.org_debian_dists_buster-updates_InRelease
 Jan 24 14:34 deb.debian.org_debian_dists_buster-updates_main_Contents-amd64.diff_Index
 Jan 24 14:34 deb.debian.org_debian_dists_buster-updates_main_Contents-amd64.lz4
 Jan 24 14:34 deb.debian.org_debian_dists_buster-updates_main_binary-amd64_Packages
 Jan 24 14:34 deb.debian.org_debian_dists_buster-updates_main_binary-amd64_Packages.diff_Index
 Jan 24 14:34 deb.debian.org_debian_dists_buster-updates_main_i18n_Translation-en
 Jan 24 14:34 deb.debian.org_debian_dists_buster-updates_main_i18n_Translation-en.diff_Index
 Jan 24 14:34 deb.debian.org_debian_dists_buster-updates_main_source_Sources
 Jan 24 14:34 deb.debian.org_debian_dists_buster-updates_main_source_Sources.diff_Index
 Oct  9 05:55 deb.debian.org_debian_dists_buster_InRelease
 Feb  6  2021 deb.debian.org_debian_dists_buster_contrib_Contents-amd64.lz4
 Oct  9 05:19 deb.debian.org_debian_dists_buster_contrib_binary-amd64_Packages
 Feb  6  2021 deb.debian.org_debian_dists_buster_contrib_i18n_Translation-en
 Oct  9 05:19 deb.debian.org_debian_dists_buster_contrib_source_Sources
 Oct  9 05:22 deb.debian.org_debian_dists_buster_main_Contents-amd64.lz4
 Oct  9 05:19 deb.debian.org_debian_dists_buster_main_binary-amd64_Packages
 Oct  9 05:19 deb.debian.org_debian_dists_buster_main_i18n_Translation-en
 Oct  9 05:19 deb.debian.org_debian_dists_buster_main_source_Sources
 Oct  9 05:20 deb.debian.org_debian_dists_buster_non-free_Contents-amd64.lz4
 Oct  9 05:19 deb.debian.org_debian_dists_buster_non-free_binary-amd64_Packages
 Oct  9 05:19 deb.debian.org_debian_dists_buster_non-free_i18n_Translation-en
 Oct  9 05:19 deb.debian.org_debian_dists_buster_non-free_source_Sources
 Feb 20 06:12 security.debian.org_debian-security_dists_buster_updates_InRelease
 Feb 19 13:44 security.debian.org_debian-security_dists_buster_updates_main_binary-amd64_Packages
 Feb 18 12:55 security.debian.org_debian-security_dists_buster_updates_main_i18n_Translation-en
 Feb 19 21:32 security.debian.org_debian-security_dists_buster_updates_main_source_Sources
 Jun 26  2021 security.debian.org_debian-security_dists_buster_updates_non-free_binary-amd64_Packages
 Nov 13  2019 security.debian.org_debian-security_dists_buster_updates_non-free_i18n_Translation-en
 Jun 26  2021 security.debian.org_debian-security_dists_buster_updates_non-free_source_Sources

(Contents files courtesy of apt-file, I assume.)

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#245598

On 2022-02-21 15:45 UTC+0100, David Wright wrote:

> AFAICT, running buster, nothing has yet changed. My sources.list
> is attached (ignore the first line), and as of this morning it
> yields:
And I think nothing will change in the future. Take the Stretch example
at https://wiki.debian.org/LTS/Using. The sources.list stayed the same.
Maybe buster-updates will disappear, I do not know how this is handled.

IMO it makes totally sense to leave this unchanged - every system will
automatically benefit from LTS.

-- 
http://www.cb-fraggle.de

[toc] | [prev] | [next] | [standalone]

#245604

On Mon, Feb 21, 2022 at 04:28:33PM +0100, Christian Britz wrote:
> 
> 
> On 2022-02-21 15:45 UTC+0100, David Wright wrote:
> 
> > AFAICT, running buster, nothing has yet changed. My sources.list
> > is attached (ignore the first line), and as of this morning it
> > yields:
> And I think nothing will change in the future. Take the Stretch example
> at https://wiki.debian.org/LTS/Using. The sources.list stayed the same.
> Maybe buster-updates will disappear, I do not know how this is handled.
> 
> IMO it makes totally sense to leave this unchanged - every system will
> automatically benefit from LTS.
> 

Things may change in the future - but as it stands, Buster is oldstable
and therefore supported for a year after the release of Bullseye with
no change in sources.list.

It should stay supported until 20220714 this way.

All the very best, as ever,

Andy Cater


> -- 
> http://www.cb-fraggle.de
> 

[toc] | [prev] | [next] | [standalone]

#245597

On Mon, Feb 21, 2022 at 6:31 AM Greg Wooledge <greg@wooledge.org> wrote:
>
> On Mon, Feb 21, 2022 at 06:25:35AM -0700, Keith Christian wrote:
> > My first search brought me to wiki.debian.org, where I landed on the
> > /LTS/Using page, but it contained no Buster-specific instructions.
>
> See also <https://wiki.debian.org/DebianBuster> which says:
>
> Q) Where do I get buster packages?
>     Use the following sources for buster:
>
>     deb http://deb.debian.org/debian/ buster main
>     deb http://security.debian.org/debian-security buster/updates main
>
> > E: The repository 'http://deb.debian.org/debian buster/updates
> > Release' does not have a Release file.
>
> You've got an error here.  Either you meant this to be a security line,
> and you've forgotten to use "debian-security" at the tail end of the
> URL field, or else you meant this to be a "buster-updates" line, and
> accidentally used a / instead of a - character in the third field.
>
> (I'm not sure if a  buster-updates repository section still exists for
> that release, but if it does, it'll be spelled with a hyphen.)
>


Thanks Greg,
The Buster machine I'm planning to re-activate is still powered off
until I find the exact security update lines for sources.list.
This error that you mention below is an example from my "pre-startup
research," showing a user's report.
When I find the correct sources.list lines I'll verify them with your
suggestions below.

> > E: The repository 'http://deb.debian.org/debian buster/updates
> > Release' does not have a Release file.
>
> You've got an error here.  Either you meant this to be a security line,
> and you've forgotten to use "debian-security" at the tail end of the
> URL field, or else you meant this to be a "buster-updates" line, and
> accidentally used a / instead of a - character in the third field.

Keith

[toc] | [prev] | [next] | [standalone]

#245599

On Mon, 2022-02-21 at 08:16 -0700, Keith Christian wrote:
> The Buster machine I'm planning to re-activate is still powered off
> until I find the exact security update lines for sources.list.

These won't have changed since you first installed Buster. As I said in
my other reply, Buster isn't yet in Long Term Support, it's still
getting updates from Debian's security team in the same way it did the
very day after it was first released.

-- 
Tixy

[toc] | [prev] | [next] | [standalone]

#245600

On Mon, 2022-02-21 at 15:48 +0000, Tixy wrote:
> On Mon, 2022-02-21 at 08:16 -0700, Keith Christian wrote:
> > The Buster machine I'm planning to re-activate is still powered off
> > until I find the exact security update lines for sources.list.
> 
> These won't have changed since you first installed Buster. As I said in
> my other reply, Buster isn't yet in Long Term Support, it's still
> getting updates from Debian's security team in the same way it did the
> very day after it was first released.

If you want to know what to know what to put in sources.list, here's
what's in mine...

deb http://ftp.debian.org/debian/ buster main
#deb-src http://ftp.debian.org/debian/ buster main

deb http://security.debian.org/ buster/updates main
#deb-src http://security.debian.org/ buster/updates main

-- 
Tixy

[toc] | [prev] | [next] | [standalone]

#245595

On Mon, 2022-02-21 at 06:25 -0700, Keith Christian wrote:
> I plan to bring a Buster machine which has been shut down for quite a
> while online again.
> Before connecting it to the internet, I looked for instructions on how
> to add the LTS security updates entries to sources.list.
> 
> My first search brought me to wiki.debian.org, where I landed on the
> /LTS/Using page, but it contained no Buster-specific instructions.

I assume because Buster isn't in Long Term Support yet, it's still in
normal support by the security team. From the schedule on the wiki,
it's due to go into LTS this July.

-- 
Tixy

[toc] | [prev] | [next] | [standalone]

#245613

On Mon, Feb 21, 2022 at 7:33 AM Tixy <tixy@yxit.co.uk> wrote:
> I assume because Buster isn't in Long Term Support yet, it's still in
> normal support by the security team. From the schedule on the wiki,
> it's due to go into LTS this July.

Thanks Tixy,

I remembered that I made a copy of the original sources.list file on
the day of install.
Here it is, I wonder why the security line failed to verify (Line 11) ?
The entire sources.list appears below.

# Line commented out by installer because it failed to verify:
#deb http://security.debian.org/debian-security buster/updates main

It seems this line should be uncommented?

#deb http://security.debian.org/debian-security buster/updates main

=============LISTING START
$ cat /etc/apt/sources.list.orig
#

# deb cdrom:[Official Debian GNU/Linux Live 10.0.0 kde
2019-07-06T10:52]/ buster main

#deb cdrom:[Official Debian GNU/Linux Live 10.0.0 kde
2019-07-06T10:52]/ buster main

deb http://deb.debian.org/debian/ buster main
deb-src http://deb.debian.org/debian/ buster main

# Line commented out by installer because it failed to verify:
#deb http://security.debian.org/debian-security buster/updates main
# Line commented out by installer because it failed to verify:
#deb-src http://security.debian.org/debian-security buster/updates main

# buster-updates, previously known as 'volatile'
# Line commented out by installer because it failed to verify:
#deb http://deb.debian.org/debian/ buster-updates main
# Line commented out by installer because it failed to verify:
#deb-src http://deb.debian.org/debian/ buster-updates main

# This system was installed using small removable media
# (e.g. netinst, live or single CD). The matching "deb cdrom"
# entries were disabled at the end of the installation process.
# For information about how to configure apt package sources,
# see the sources.list(5) manual.
=============LISTING END

Keith

[toc] | [prev] | [next] | [standalone]

#245614

On Tue, Feb 22, 2022 at 06:00:53AM -0700, Keith Christian wrote:
> On Mon, Feb 21, 2022 at 7:33 AM Tixy <tixy@yxit.co.uk> wrote:
> > I assume because Buster isn't in Long Term Support yet, it's still in
> > normal support by the security team. From the schedule on the wiki,
> > it's due to go into LTS this July.
> 
> Thanks Tixy,
> 
> I remembered that I made a copy of the original sources.list file on
> the day of install.
> Here it is, I wonder why the security line failed to verify (Line 11) ?
> The entire sources.list appears below.
> 
> # Line commented out by installer because it failed to verify:
> #deb http://security.debian.org/debian-security buster/updates main

Only someone who was present for the installation would know for sure,
but at the time, the installer was unable to contact that web site.
Could have been due to missing network interface firmware, or a transient
DNS problem, or ... who knows?

> It seems this line should be uncommented?
> 
> #deb http://security.debian.org/debian-security buster/updates main

Yes.

> 
> =============LISTING START
> $ cat /etc/apt/sources.list.orig
> #
> 
> # deb cdrom:[Official Debian GNU/Linux Live 10.0.0 kde
> 2019-07-06T10:52]/ buster main
> 
> #deb cdrom:[Official Debian GNU/Linux Live 10.0.0 kde
> 2019-07-06T10:52]/ buster main
> 
> deb http://deb.debian.org/debian/ buster main
> deb-src http://deb.debian.org/debian/ buster main

But that one worked?  Interesting.  That points more toward an issue
with DNS or with the (small) set of security.debian.org servers, rather
than something like missing firmware which would have affected all
network activity during the installation.

[toc] | [prev] | [next] | [standalone]

#245616

On Tue, 2022-02-22 at 06:00 -0700, Keith Christian wrote:
> On Mon, Feb 21, 2022 at 7:33 AM Tixy <tixy@yxit.co.uk> wrote:
> > I assume because Buster isn't in Long Term Support yet, it's still in
> > normal support by the security team. From the schedule on the wiki,
> > it's due to go into LTS this July.
> 
> Thanks Tixy,
> 
> I remembered that I made a copy of the original sources.list file on
> the day of install.
> Here it is, I wonder why the security line failed to verify (Line 11) ?
> The entire sources.list appears below.
> 
> # Line commented out by installer because it failed to verify:
> #deb http://security.debian.org/debian-security buster/updates main
> 
> It seems this line should be uncommented?
> 
> #deb http://security.debian.org/debian-security buster/updates main

I just tried that URL and did an 'apt update' and it seemed to work,
there were no errors and seemed to be download a new package list.
Interesting that the one I had doesn't have the 'debian-security' bit.

Also, the online examples of sources.list for Buster have the URL
'http://deb.debian.org/debian-security', I beleive that uses the CDN.

So, for me, all three of these seem work...

deb http://security.debian.org/ buster/updates main
deb http://security.debian.org/debian-security buster/updates main
deb http://deb.debian.org/debian-security buster/updates main

-- 
Tixy 

[toc] | [prev] | [next] | [standalone]

#245618

On Tue 22 Feb 2022 at 13:50:20 (+0000), Tixy wrote:
> On Tue, 2022-02-22 at 06:00 -0700, Keith Christian wrote:
> > On Mon, Feb 21, 2022 at 7:33 AM Tixy <tixy@yxit.co.uk> wrote:
> > > I assume because Buster isn't in Long Term Support yet, it's still in
> > > normal support by the security team. From the schedule on the wiki,
> > > it's due to go into LTS this July.
> > 
> > I remembered that I made a copy of the original sources.list file on
> > the day of install.
> > Here it is, I wonder why the security line failed to verify (Line 11) ?
> > The entire sources.list appears below.
> > 
> > # Line commented out by installer because it failed to verify:
> > #deb http://security.debian.org/debian-security buster/updates main
> > 
> > It seems this line should be uncommented?
> > 
> > #deb http://security.debian.org/debian-security buster/updates main
> 
> I just tried that URL and did an 'apt update' and it seemed to work,
> there were no errors and seemed to be download a new package list.
> Interesting that the one I had doesn't have the 'debian-security' bit.
> 
> Also, the online examples of sources.list for Buster have the URL
> 'http://deb.debian.org/debian-security', I beleive that uses the CDN.
> 
> So, for me, all three of these seem work...
> 
> deb http://security.debian.org/ buster/updates main
> deb http://security.debian.org/debian-security buster/updates main
> deb http://deb.debian.org/debian-security buster/updates main

The OP is tilting at windmills.

The example I posted has been used every three hours of my waking day
for the past 2½ years. It fails when my cable company fails.

The OP has quoted some hearsay off the web, period. And not a single
reference with it. The OP calls this "pre-startup research", and
will "verify [ … ] your suggestions" when the Oracle has handed down
"the correct sources.list".

Until then, the Buster machine will stay de-activated, the OP remains
safe, and we await the Oracle.

(Those who know their Classical history will realise that advice
pulled from the Internet can be as ambiguous as the Oracle always was.)

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#245626

> The OP is tilting at windmills.
>
> The example I posted has been used every three hours of my waking day
> for the past 2½ years. It fails when my cable company fails.
>
> The OP has quoted some hearsay off the web, period. And not a single
> reference with it. The OP calls this "pre-startup research", and
> will "verify [ … ] your suggestions" when the Oracle has handed down
> "the correct sources.list".
>
> Until then, the Buster machine will stay de-activated, the OP remains
> safe, and we await the Oracle.
>
> (Those who know their Classical history will realise that advice
> pulled from the Internet can be as ambiguous as the Oracle always was.)
>
> Cheers,
> David.

David,

Windmills, LOL.  I've always liked that one.
I brought up the old Buster machine and it's working fine with one mod
to he original sources list, uncommenting this line:
           deb http://security.debian.org/debian-security buster/updates main
Since I didn't know that Buster was not yet in LTS, and that there are
no changes needed, I thought I should ask first in case there were
repo changes.
Thanks for your comments.

Keith

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web