linux-image-3.16.0-10-amd64 missing on security.debian.org

[mabi]

Hello,

I still have an older Debian 8.11 system running and would like to apply the latest security patches. Unfortunately it seems like some packages are missing from http://security.debian.org as you can see in the apt-get update/upgrade" below:

$ sudo apt-get update
Ign http://ftp.ch.debian.org jessie InRelease
Hit http://ftp.ch.debian.org jessie Release.gpg
Hit http://ftp.ch.debian.org jessie Release
Get:1 http://security.debian.org jessie/updates InRelease [44.9 kB]
Hit http://ftp.ch.debian.org jessie/main amd64 Packages
Hit http://ftp.ch.debian.org jessie/non-free amd64 Packages
Hit http://ftp.ch.debian.org jessie/contrib amd64 Packages
Get:2 http://security.debian.org jessie/updates/main amd64 Packages [781 kB]
Hit http://ftp.ch.debian.org jessie/contrib Translation-en
Hit http://ftp.ch.debian.org jessie/main Translation-en
Hit http://ftp.ch.debian.org jessie/non-free Translation-en
Get:3 http://security.debian.org jessie/updates/contrib amd64 Packages [2,506 B]
Get:4 http://security.debian.org jessie/updates/non-free amd64 Packages [4,702 B]
Get:5 http://security.debian.org jessie/updates/contrib Translation-en [1,211 B]
Get:6 http://security.debian.org jessie/updates/main Translation-en [401 kB]
Get:7 http://security.debian.org jessie/updates/non-free Translation-en [11.8 kB]
Fetched 1,247 kB in 2s (512 kB/s)
Reading package lists... Done

$ sudo apt-get upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
The following packages have been kept back:
linux-image-amd64 xen-linux-system-amd64
The following packages will be upgraded:
linux-image-3.16.0-10-amd64 xen-linux-system-3.16.0-10-amd64
2 upgraded, 0 newly installed, 0 to remove and 2 not upgraded.
Need to get 35.0 MB of archives.
After this operation, 27.6 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Err http://security.debian.org/ jessie/updates/main xen-linux-system-3.16.0-10-amd64 amd64 3.16.81-1
404 Not Found [IP: 151.101.2.132 80]
Err http://security.debian.org/ jessie/updates/main linux-image-3.16.0-10-amd64 amd64 3.16.81-1
404 Not Found [IP: 151.101.2.132 80]
E: Failed to fetch http://security.debian.org/pool/updates/main/l/linux/xen-linux-system-3.16.0-10-amd64_3.16.81-1_amd64.deb 404 Not Found [IP: 151.101.2.132 80]

E: Failed to fetch http://security.debian.org/pool/updates/main/l/linux/linux-image-3.16.0-10-amd64_3.16.81-1_amd64.deb 404 Not Found [IP: 151.101.2.132 80]

E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

I have the following entries in my /etc/apt/sources.list file:

deb http://ftp.ch.debian.org/debian jessie main non-free contrib
deb http://security.debian.org/ jessie/updates main contrib non-free

Any idea how I can fix that?

Thank you very much in advance.

Best regards,
Mabi

[Dan Ritter]

mabi wrote:
> Hello,
>
> I still have an older Debian 8.11 system running and would like to apply the latest security patches. Unfortunately it seems like some packages are missing from http://security.debian.org as you can see in the apt-get update/upgrade" below:
>

There are no "latest security patches":

In a few weeks Bullseye, Debian 11 will be stable.
Debian 10 is currently stable.
Debian 9 is currently oldstable, and has some security support,
mostly from the donation-accepting Long-Term-Support team

Debian 8 is before that.

If you have any interest in system security at all, please upgrade. You
should be able to upgrade in place without reinstalling from 8 to 9 to
10 and then to 11 in a few weeks.

PS the packages you are looking for are archived:
https://www.debian.org/distrib/archive

-dsr-

[Georgi Naplatanov]

Hi mabi,

Debian Jessie's support has ended even as LTS.

https://wiki.debian.org/LTS

Kind regards
Georgi

[mabi]

Thank you Dan for your hint regarding the archive.debian.org APT repo. I have now the following in my sources.list file:

deb http://archive.debian.org/debian/ jessie contrib main non-free

deb http://security.debian.org/ jessie/updates main contrib non-free

Unfortunately it still does not work as you can see below:

$ sudo apt-get update
Hit http://security.debian.org jessie/updates InRelease
Ign http://archive.debian.org jessie InRelease
Get:1 http://archive.debian.org jessie Release.gpg [2,420 B]
Hit http://archive.debian.org jessie Release
Hit http://security.debian.org jessie/updates/main amd64 Packages
Ign http://archive.debian.org jessie Release
Hit http://security.debian.org jessie/updates/contrib amd64 Packages
Ign http://archive.debian.org jessie/contrib amd64 Packages/DiffIndex
Hit http://security.debian.org jessie/updates/non-free amd64 Packages
Hit http://security.debian.org jessie/updates/contrib Translation-en
Ign http://archive.debian.org jessie/main amd64 Packages/DiffIndex
Hit http://security.debian.org jessie/updates/main Translation-en
Hit http://security.debian.org jessie/updates/non-free Translation-en
Ign http://archive.debian.org jessie/non-free amd64 Packages/DiffIndex
Hit http://archive.debian.org jessie/contrib Translation-en
Hit http://archive.debian.org jessie/main Translation-en
Hit http://archive.debian.org jessie/non-free Translation-en
Hit http://archive.debian.org jessie/contrib amd64 Packages
Hit http://archive.debian.org jessie/main amd64 Packages
Hit http://archive.debian.org jessie/non-free amd64 Packages
Ign http://archive.debian.org jessie/contrib Translation-en_US
Ign http://archive.debian.org jessie/main Translation-en_US
Ign http://archive.debian.org jessie/non-free Translation-en_US
Fetched 2,420 B in 2s (841 B/s)
Reading package lists... Done
W: GPG error: http://archive.debian.org jessie Release: The following signatures were invalid: KEYEXPIRED 1587841717

$ sudo apt-get dist-upgrade

Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done

The following packages will be upgraded:
linux-image-3.16.0-10-amd64
1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 34.6 MB of archives.
After this operation, 14.3 kB of additional disk space will be used.

Do you want to continue? [Y/n] y

Err http://security.debian.org/ jessie/updates/main linux-image-3.16.0-10-amd64 amd64 3.16.81-1
404 Not Found [IP: 151.101.2.132 80]

E: Failed to fetch http://security.debian.org/pool/updates/main/l/linux/linux-image-3.16.0-10-amd64_3.16.81-1_amd64.deb 404 Not Found [IP: 151.101.2.132 80]

E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

[David Wright]

On Mon 12 Jul 2021 at 19:47:37 (+0000), mabi wrote:
> Thank you Dan for your hint regarding the archive.debian.org APT repo. I have now the following in my sources.list file:
>
> deb http://archive.debian.org/debian/ jessie contrib main non-free
> deb http://security.debian.org/ jessie/updates main contrib non-free
>
> Unfortunately it still does not work as you can see below:

Change http://security.debian.org/
to http://security.debian.org/debian-security

Your sources.list generated the URL:
http://security.debian.org/pool/updates/main/l/linux/linux-image-3.16.0-10-amd64_3.16.81-1_amd64.deb
whereas this file is available through https://packages.debian.org/ links:
http://security.debian.org/debian-security/pool/updates/main/l/linux/linux-image-3.16.0-10-amd64_3.16.81-1_amd64.deb

I think this change may have come with stretch, but seems to have been
enacted retrospectively. (I haven't found a reference to the change.)

BTW it might be worth posting why you're still running jessie.
People may be able to advise on how you might deal with what
you see as reasons not to change.

Cheers,
David.

[mabi]

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

On Tuesday, July 13th, 2021 at 3:29 AM, David Wright <deb...@lionunicorn.co.uk> wrote:

> Your sources.list generated the URL:
>
> http://security.debian.org/pool/updates/main/l/linux/linux-image-3.16.0-10-amd64_3.16.81-1_amd64.deb
>
> whereas this file is available through https://packages.debian.org/ links:
>
> http://security.debian.org/debian-security/pool/updates/main/l/linux/linux-image-3.16.0-10-amd64_3.16.81-1_amd64.deb
>
> I think this change may have come with stretch, but seems to have been
>
> enacted retrospectively. (I haven't found a reference to the change.)

Thank you David for your answer, unfortunately even with /debian-security/ in the URL, the package is still missing. If you browse that directory you can see that the package is missing 3.16.0-10 is missing but 3.16.0-11 is available.

> BTW it might be worth posting why you're still running jessie.
>
> People may be able to advise on how you might deal with what
>
> you see as reasons not to change.

I think this is irrelevant to the fact that a package is missing from the Debian security APT repository and I don't want to clutter this mailing list with any discussions about why I can't upgrade yet.

[Michael Lange]

Hi,

On Tue, 13 Jul 2021 04:29:59 +0000
mabi <ma...@protonmail.ch> wrote:

> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
>
> On Tuesday, July 13th, 2021 at 3:29 AM, David Wright
> <deb...@lionunicorn.co.uk> wrote:
>
> > Your sources.list generated the URL:
> >
> > http://security.debian.org/pool/updates/main/l/linux/linux-image-3.16.0-10-amd64_3.16.81-1_amd64.deb
> >
> > whereas this file is available through https://packages.debian.org/
> > links:
> >
> > http://security.debian.org/debian-security/pool/updates/main/l/linux/linux-image-3.16.0-10-amd64_3.16.81-1_amd64.deb
> >
> > I think this change may have come with stretch, but seems to have been
> >
> > enacted retrospectively. (I haven't found a reference to the change.)
>
> Thank you David for your answer, unfortunately even
> with /debian-security/ in the URL, the package is still missing. If you
> browse that directory you can see that the package is missing 3.16.0-10
> is missing but 3.16.0-11 is available.

I know this does not answer your question about the sources.list, but if
it is only about the linux-image package and for some reason you cannot
use a kernel newer than 3.16, maybe instead of struggling with
sources.list to get the 3.16.81 kernel you may be better off just going to

https://packages.debian.org/jessie/linux-image-3.16.0-11-amd64

and manually download the debian package of the 3.16.84 kernel. This is
the last from the 3.16 series, so if you are stuck with 3.16 there won't
be any future updates anyway.

Best regards

Michael

.-.. .. ...- . .-.. --- -. --. .- -. -.. .--. .-. --- ... .--. . .-.

It is undignified for a woman to play servant to a man who is not hers.
-- Spock, "Amok Time", stardate 3372.7

[mabi]

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

On Tuesday, July 13th, 2021 at 10:26 AM, Michael Lange <klap...@freenet.de> wrote:

> I know this does not answer your question about the sources.list, but if
>
> it is only about the linux-image package and for some reason you cannot
>
> use a kernel newer than 3.16, maybe instead of struggling with
>
> sources.list to get the 3.16.81 kernel you may be better off just going to
>
> https://packages.debian.org/jessie/linux-image-3.16.0-11-amd64
>
> and manually download the debian package of the 3.16.84 kernel. This is
>
> the last from the 3.16 series, so if you are stuck with 3.16 there won't

Thank you for your answer.

So I can simply skip upgrading to 3.16.0-10 and upgrading directly to 3.16.0-11 by downloading the .deb package as you suggest?

Then is it simply a matter of running "dpkg -i linux-image-3.16.0-11-amd64_3.16.84-1_amd64.deb" and that's it?

[Michael Lange]

Hi,

On Tue, 13 Jul 2021 09:27:35 +0000
mabi <ma...@protonmail.ch> wrote:

(...)

> So I can simply skip upgrading to 3.16.0-10 and upgrading directly to
> 3.16.0-11 by downloading the .deb package as you suggest?
>
> Then is it simply a matter of running "dpkg -i
> linux-image-3.16.0-11-amd64_3.16.84-1_amd64.deb" and that's it?
>

yes, I think so.
Since it is a different package than 3.16.0-10 this should keep your
currently installed kernel intact, so if for some reason the new kernel
doesn't work the old one should still be there.

Best regards

Michael


.-.. .. ...- . .-.. --- -. --. .- -. -.. .--. .-. --- ... .--. . .-.

Madness has no purpose. Or reason. But it may have a goal.
-- Spock, "The Alternative Factor", stardate 3088.7

[David Wright]

On Tue 13 Jul 2021 at 12:09:13 (+0200), Michael Lange wrote:

> On Tue, 13 Jul 2021 09:27:35 +0000 mabi wrote:
>
> (...)
> > So I can simply skip upgrading to 3.16.0-10 and upgrading directly to
> > 3.16.0-11 by downloading the .deb package as you suggest?

"Skipping" isn't a useful concept with respect to kernel versions.
Always run the newest you can. For example, there are 40 CVEs fixed
between versions 10(81) and 11(84), and it brings you up to June 2020,
buying you and extra six months of security.

Some Debian releases can run two completely different kernel versions,
like buster with 4.19 and 5.10. IIRC jessie could run 4.9 kernels from
backports.

> > Then is it simply a matter of running "dpkg -i
> > linux-image-3.16.0-11-amd64_3.16.84-1_amd64.deb" and that's it?

You might try:

apt-get install /path-to/linux-image-3.16.0-11-amd64_3.16.84-1_amd64.deb

so that APT remains aware of what's installed, and will inform you of
any dependencies. (You must include the path, not just a filename.)

On Tue 13 Jul 2021 at 04:29:59 (+0000), mabi wrote:

> On Tuesday, July 13th, 2021 at 3:29 AM, David Wright wrote:

> > BTW it might be worth posting why you're still running jessie.
> > People may be able to advise on how you might deal with what
> > you see as reasons not to change.
>
> I think this is irrelevant to the fact that a package is missing from the Debian security APT repository and I don't want to clutter this mailing list with any discussions about why I can't upgrade yet.

I was unaware that the metadata is not up-to-date on the web, but no
package is "missing", it's just been upgraded.

As for "cluttering" this list, the question of upgrading your
distribution is likely of far more security value than upgrading
just the kernel.

But bear in mind that this is where "skipping" /is/ relevant. Whenever
you decide to upgrade, make sure to go one step at a time, through
stretch to buster, using the Release Notes as a guide.

Cheers,
David.

[Greg Wooledge]

On Tue, Jul 13, 2021 at 10:34:24AM -0500, David Wright wrote:
> Some Debian releases can run two completely different kernel versions,
> like buster with 4.19 and 5.10. IIRC jessie could run 4.9 kernels from
> backports.

The possible range of kernels is quite large. You can actually run a
kernel *much* older or newer than the one which comes with your Debian
release.

Buster (Debian 10) ships with a 4.19 kernel, but you can run it with a
3.2 kernel. Debian 9 can run with a kernel even older than that; my VPS
for example is on a 2.6 kernel, and I've got it up to Debian 9, which is
as far as I can go on that kernel.

https://www.debian.org/releases/buster/amd64/release-notes/ch-information.en.html#glibc-and-linux