Removal of jessie-updates and jessie-backports from Debian mirrors

If you are still running jessie you probably noticed that the jessie-updates and jessie-backports suites have been removed from mirrors, because you got those error messages:

W: Failed to fetch http://ftp.debian.org/debian/dists/jessie-updates/main/binary-amd64/Packages 404 Not Found [IP: 130.89.148.12 80]
W: Failed to fetch http://ftp.debian.org/debian/dists/jessie-backports/main/binary-amd64/Packages 404 Not Found [IP: 130.89.148.12 80]

I was not involved in that decision (which was made by the FTP masters team), but since there is some confusion around it, I will try to give my understanding of the resulting issues.

The typical /etc/apt/sources.list file for a jessie system with backports enabled is:

deb http://ftp.debian.org/debian jessie main
deb-src http://ftp.debian.org/debian jessie main

deb http://security.debian.org/debian-security jessie/updates main
deb-src http://security.debian.org/debian-security jessie/updates main

deb http://ftp.debian.org/debian jessie-updates main
deb-src http://ftp.debian.org/debian jessie-updates main

deb http://ftp.debian.org/debian/ jessie-backports main contrib non-free
deb-src http://ftp.debian.org/debian/ jessie-backports main contrib non-free

Debian packages are distributed using suites (which can be understood as channels). The global picture looks like this:

(This is slide 42 of the Debian Packaging Tutorial.)

deb http://deb.debian.org/debian jessie main is the easy one. It contains the bulk of packages. It is initialized by copying the content of the testing suite when a new stable release happens, approximately every two years. It is then updated from stable-new (an internal suite) when stable point releases happen (see below).

deb http://security.debian.org/debian-security jessie/updates main is the security suite in the figure above. It is used by the Debian security team to provide security updates. They are announced on the debian-security-announce mailing list.

deb http://ftp.debian.org/debian jessie-updates main (stable-updates above) is a suite used to distribute important updates that are unrelated to security, and that cannot wait the next stable point release. They are announced on the debian-stable-announce mailing list. Interestingly, a large proportion of those updates are related to changes to daylight-saving-time rules that are sometimes made very late by some countries.

stable point releases happen every few months (see for example the Debian 8.11 stable point release). They consist in updating the stable suite by copying important updates that were submitted to stable-proposed-updates. Security updates are also included.

backports follow an entirely different path. They are new versions of packages, based on the version currently in the testing suite. See the backports team website.

So, what happened?

In June 2018…

Debian 8.11 (in June 2018) was the final update for Debian 8. As stated in its announcement:

After this point release, Debian's Security and Release Teams will no
longer be producing updates for Debian 8. Users wishing to continue to
receive security support should upgrade to Debian 9, or see
https://wiki.debian.org/LTS for details about the subset of
architectures and packages covered by the Long Term Support project.

In other words: jessie and jessie-updates won’t receive any update. The only updates will be through the security suite, by the Debian Long Term Support project.

At about the same time (I think – I could not find an announcement — Update: announcement), the maintenance of backports for jessie was also stopped. Which makes sense, because the backports team provides backports for the current release, and stretch was released in June 2017.

In March 2019…

The FTP masters team decided to remove the jessie-updates and jessie-backports suite from the mirrors. This was announced on debian-devel-announce, resulting in the errors quoted above.

How to solve this?

For the jessie-updates suite, you can simply remove it from your /etc/apt/sources.list. It is useless, because all packages that were in jessie-updates were merged into jessie when Debian 8.11 was released.

The jessie-backports suite was archived on archive.debian.org, so you can use:

deb http://archive.debian.org/debian/ jessie-backports main contrib non-free
deb-src http://archive.debian.org/debian/ jessie-backports main contrib non-free

But then you will run into another issue:

E: Release file for http://archive.debian.org/debian/dists/jessie-backports/InRelease is expired (invalid since 36d 1h 9min 51s). Updates for this repository will not be applied.

Unfortunately, with the APT version in jessie, this cannot be ignored on a per source basis (it can with the APT version from stretch, using the deb [check-valid-until=no] ... syntax). So you need to disable this check globally, using:

echo 'Acquire::Check-Valid-Until no;' > /etc/apt/apt.conf.d/99no-check-valid-until

After that, apt-get update just works.

(There are some discussions about resurrecting the jessie-updates suite to avoid the above errors, but it is probably getting less and less useful as time passes.)

11 thoughts on “Removal of jessie-updates and jessie-backports from Debian mirrors

  1. “… all packages that were in jessie-updates were merged into jessie when Debian 8.11 was released.”

    Nope. Try to install debhelper >= 10.

  2. Thanks for the info. Server farm errors were driving me nuts. I really dislike how debian does this with their distros. I’ve used debian exclusively in my server environments for over a decade and find it troubling to have to keep changing apt source entries on these machines. Now take Ubuntu. I’ve never touched a single ubuntu apt source entry after initial config as long as I’ve used the machine that running it. Why doesn’t Ubuntu make their users jump through the same hoops?

  3. I am very surprised that jessie-backports got removed. Given a fresh Debian release already has obsolete packages when it is released, the backports are definitely useful. We have ended up with multiple issues on production systems due to the removal.

    Point taken / lesson learned, I will no more use Debian backports in the future and use our own apt repository to manage backports :]

  4. I think it is a pity that this is happening. Is a bit of FTP space so expensive these days?
    The fact that the repository is no longer updated is no reason to remove it, some people
    need it to rebuild systems or to keep existing procedures working.
    Now there are issues with running systems that somehow have to be fixed, which wastes
    effort that could otherwise be spent on upgrading the systems…

  5. I am having this error as well, however when I look at my sources.list, I see no mention of jessie. Any idea how I can fix this on my system? Here is my sources file:

    #

    # deb cdrom:[Debian GNU/Linux 9.5.0 _Stretch_ – Official amd64 xfce-CD Binary-1 20180714-10:25]/ stretch main

    # deb cdrom:[Debian GNU/Linux 9.5.0 _Stretch_ – Official amd64 xfce-CD Binary-1 20180714-10:25]/ stretch main

    deb http://ftp.us.debian.org/debian/ stretch main non-free contrib
    deb-src http://ftp.us.debian.org/debian/ stretch main non-free contrib

    deb http://security.debian.org/debian-security stretch/updates main contrib non-free
    deb-src http://security.debian.org/debian-security stretch/updates main contrib non-free

    # stretch-updates, previously known as ‘volatile’
    deb http://ftp.us.debian.org/debian/ stretch-updates main contrib non-free
    deb [arch=amd64] https://download.docker.com/linux/debian/ stretch stable
    # deb-src [arch=amd64] https://download.docker.com/linux/debian/ stretch stable
    deb-src http://ftp.us.debian.org/debian/ stretch-updates main contrib non-free
    deb http://ftp.debian.org/debian stretch-backports main

Comments are closed.