Debian Security does not have a release file

If you are updating from Debian Buster to Debian Bullseye, you may notice the message in the title when editing you sources.list file. This is because the repository has changed.

In buster it was:

deb http://security.debian.org/ buster/updates main contrib non-free

deb http://deb.debian.org/debian buster/security main

In bullseye it is

deb http://deb.debian.org/debian-security/ bullseye-security main 

or  

deb http://security.debian.org/debian-security bullseye-security main

depending on where you look. (Debian Security Information or Debian SourcesList.)

Simply replacing Buster with Bullseye gives the error in the title.

Edit: changed the Buster repository because I think I misremembered the address. I changed to one I blogged about before as working after a similar issue.

Debian seems to be trying to make the security repository address as confusing as possible, and succeeding.

An update on Debian updates

I recently wrote several posts on updates in Debian, on XFCE and Gnome, Bullseye and Buster.

The default, I wrote, was no notifications of updates by default on XFCE in Bullseye, and no automatic updates, and notification of updates and automatic installation of security updates in Gnome on Buster.

However, after applying the same default to XFCE, I noticed that I was actually getting automatic updates to all packages.

Sure enough, Gnome on Buster was also getting more than security updates.

It turns out that unattended-upgrades (the package which installs automatic updates in Debian,  actually updates all packages by default in Debian Buster and later. (The default in previous version of Debian was security updates only.)

I discovered this in a post on the Debian User Forum, which linked to the Debian Buster release information page. I found the NEWS.Debian file thanks to Debian documentation. 

It reads: 

Unattended-upgrades in previous versions defaulted to install security updates only on Debian by using the label=Debian-Security origin pattern. Now it is changed to allow updates with label=Debian, which allows applying stable updates in stable releases and following all package updates in testing and unstable. 

In stable releases this unlocks installation of security updates depending on package versions present only in stable updates. 

Note that testing and unstable can often contain packages for which installation or upgrade performed by unattended-upgrades fails and requires the administrator to fix the system later.

My fault then for not reading the release information when I upgraded from Stretch.

The Debian Wiki page says:

The purpose of unattended-upgrades is to keep the computer current with the latest security (and other) updates automatically.

Which to me implies that other updates are optional, but obviously not.

I have updated the post on automatic updates in XFCE.  As I am currently using XFCE on Debian Testing, I have disabled updates to all packages by commenting out the line:

//      "origin=Debian,codename=${distro_codename},label=Debian";

I have checked my Gnome installation on Debian Buster, and it also contains the line above, which means that "stable updates" are applied automatically. I've also updated my post on automatic updates in Gnome.

Interestingly, the Gnome Blog states that Gnome will not install updates automatically. unattended-upgrades is a system package and overrides Gnome in Debian, which explains why Gnome notifies me of available updates, but they often disappear before I can install them, with the exception of Chrome, whose repository is not included in unattended-upgrades. NB unattended-upgrades is triggered to run within a randomised period, so the time that update notifications, whether those displayed by default in Gnome, or by the options I described in XFCE (Conky, Genmon), may appear for a few minutes or a few hours before disappearing if you have unattended-upgrades installed.

I hope this post helps anybody struggling, like me, to work out how automatic updates happen in Debian. Apologies for any confusion caused previously.

 

 

Configure automatic updates Gnome

If you search for "configure automatic updates gnome" (without the quotes), the third result will be from help.gnome.org, which you'd think might be useful, but isn't. The Gnome Help site is rubbish, not by virtue of being badly written or designed, but by virtue of being thirteen years out of date. It refers to Gnome 2 (does anybody use Gnome 2 in 2021) and is not relevant today.

The Gnome Blog states that Gnome allows the automatic installation of updates, with configuration options in Gnome Software for installation and notification of installation, for but this turns out to be for Flatpacks only.

So here is a quick guide to configuring automatic updates in Gnome - in this case on Debian Buster.

The Gnome Help page refers to PackageKit being updated by a cron-job. (PackageKit being an update system that works in different distributions and cron being a job-scheduler.)

This was true in 2007, but today it's the Systemd scheduler that triggers updates, as I wrote about here. In XFCE this is not enabled by default, but in Gnome it is, because the package unattended-upgrades is installed, which sets a configuration file which tells APT (the Debian package manager) to check for updates and automatically install security updates when it is triggered by the Systemd timer.

Configuration is done via launching Software & Updates, or  Synaptic > Settings > Repositories (it's the same window).

We can confirm that configuration settings are set in the unattended-upgrades configuration file 20auto-upgrades by watching it as we change the check interval.

 

You can of course change the configuration directly by editing the file in etc/apt/apt.conf.d if you wish. It's also possible to turn automatic installation of security updates off via the GUI or the configuration file.

If you look in that folder you will also notice a file called 20packagekit, which is there to make sure PackageKit knows about updates too.

I presume it is still PackageKit that Gnome Software uses to notify you of available updates. I will have to leave that for another investigation. I don't use Gnome Software because it always asks to restart the computer to install updates even through this is not necessary. Maybe it's possible to configure that too.

For now, I hope this post is useful to somebody like me who has observed updates in Gnome 3 and wondered what was happening.

[Edited for accuracy and clarity.]

[Corrected to reflect the fact that Unattended Upgrades actually installs all packages by default in Debian Buster and later.

The default setting for Unattended Upgrades was changed in Buster. The previous default was to apply security updates, but the default now is to update all packages.

I found a note in the "News" file (found in /usr/share/doc/unattended-upgrades) which states:

Unattended-upgrades in previous versions defaulted to install security updates only on Debian by using the label=Debian-Security origin pattern. Now it is changed to allow updates with label=Debian, which allows applying stable updates in stable releases and following all package updates in testing and unstable. 

In stable releases this unlocks installation of security updates depending on package versions present only in stable updates.]

SourcesList in Debian Wiki wrong?

I had the following in my sources.list file:

deb http://ftp.uk.debian.org/debian-security buster/updates main contrib non-free

Based on the example sources.list entry at the Debian Wiki:

deb http://deb.debian.org/debian-security/ buster/updates main contrib non-free

But this got me the following warning:

E: The repository 'http://ftp.uk.debian.org/debian-security buster/updates Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default. 
N: See apt-secure(8) manpage for repository creation and user configuration details

I changed the line to the following after reading a post at Stack Exchange (changing stretch for buster):

deb http://security.debian.org/ buster/updates main contrib non-free

Which worked -  Thanks Stephen Kitt.

Stephen's source link however goes to the security information page at debian.org which has the following example:

deb http://security.debian.org/debian-security buster/updates main contrib non-free

I admit to being a bit confused. But I am also tired and my brain isn't working - it's end of term and I have young children.

So I am just going to post this and hope that either somebody will clear up the mystery or I can come back to it later when my brain is working and clear it up.

How to Run Firefox on Wayland in Debian Buster

Debian Buster has an option to run Gnome on Wayland (a replacement for X*). As indeed did Stretch, but in Buster, it's possibly going to be the default.

I had assumed that, if I selected Wayland, all applications would use it, but apparently not. Applications that can't use Wayland can use a compatibility layer called XWayland.

It seems Firefox has had Wayland support since version 65, but the default is still for the program to use XWayland.

Debian Buster of course has ESR 60 at the time of writing, but I have been trying out Firefox downloaded from the Mozilla website from my /home directory, and that is currently at version 67. (That's to say, downloaded from Mozilla, to my /home directory, and run from there, if the previous sentence didn't make sense.)

Thanks to a post on the Debian User Forums, I discovered I could launch Firefox on Wayland using this command:

$ MOZ_ENABLE_WAYLAND=1 ~/Downloads/firefox-67.0/firefox/firefox

Of course, if you have unpacked Firefox to a different location, use that location.

Firefox runs (with some weird error messages in the terminal:

IPDL protocol Error: Received an invalid file descriptor ###!!! [Child][RunMessage] Error: Channel closing: too late to send/recv, messages will be lost

But is it running on Wayland?

I found a suggestion to use Xeyes because, being based on X, Xeyes won't work on Wayland Windows. Indeed, the eyes follow the mouse cursor in the Firefox window when launched normally, but not with Wayland enabled.

*What do you mean, that doesn't explain anything? Well, if you want the full explanation of what Wayland is, it's here.

Things that are broken in Debian Buster

Bottom controls don't work in Videos (Totem) in Wayland in Buster. They work OK in Xorg. Clicking a video file will start the player, but it's not possible to interact with the progress bar, menu or volume buttons.

I'm not the first to notice this, and its not confined to Debian. The Antergos forum has a post on the issue.

Is my computer up to it?

Firefox with a few tabs open:

CPU maxing out? 70% RAM usage?
OK let's close Firefox:

Well, that dropped off!
And open Chrome:

CPU maxed out! Ram a little lower.
And let it settle down with a few tabs open:

OK, so I need to get scientific and open Firefox and Chrome with the same tabs open, but it seems that I've found the reason why my installation of Debian Buster (Testing as of time of writing) runs slow.

Back in 2015 when I bought this laptop, many reviews complained of mouse pointer lag - in Windows. An update seemed to fix it, but today it's back to the same condition- laggy mouse,and slow to open programs.

Have web browser become heavier? Has Debian become more bloated?

To me it looks like the web browsers are the culprit.

Things that are fixed in Debian Buster - Cancel print job in Gnome

In over two years of using Debian Stretch, I only encountered one bug. It wasn't possible to cancel a print job from the Printers dialogue in Gnome.

I am happy to report it is possible to cancel a print job from the Printers dialogue in Gnome in Buster.

Yay.

Here's hoping that Buster is as bug free. (Just to be clear, I'm testing the pre-release version, called, appropriately, Testing.)

Debian Buster preview

Two and a half years ago, I updated this computer to Debian Stretch while it was still Testing (the pre-release version) but in freeze (a stage when no new packages are added and bugs are ironed out).

Stretch has been a rock solid and reliable Debian release, both on this machine and on a later purchase, now the main family computer. But with a new version approaching, I always get the urge to try it out.

So, a few days ago, I updated the older computer, now rarely used, to Buster, which again is still strictly Testing but in freeze.

I'll make the same warning as I did at that time: Buster is still in Testing and can break. If it breaks, you get to keep the pieces.

So here is Debian Buster:

I have to confess I ditched the doggy wallpaper straight away and used the Moonlight wallpaper by Juliette Taka Belin.

Back in 2016 I wrote "The update was pleasantly painless with no issues". This time I wasn't quite so lucky. I ran out of disk space during the installation, and got this message:

No space left on device

I had tried to check if there was enough space for the upgrade using a command I found here (which suggested I had just barely enough). This computer has a separate root partition, given the default size of 10GB by the installer. This default size is really too small nowadays- at least for a Gnome install update.

Luckily I was able to run apt-get clean and apt-get autoclean to make enough space to finish the upgrade. Although I was given an error message before I could continue:

dpkg was interrupted, you must manually run 'dpkg --configure -a' to correct the problem 

When the upgrade completed, I rebooted the computer but it froze with just the cursor visible in the top left of the screen. That's my installation borked, I though, and went to bed.

However, the next morning I found I could boot into Rescue Mode and get a command prompt. I cleaned up the disc and found I could load the default installation. Hurrah!

Now I have Gnome running reasonably well. It does seem a bit slower than Stretch at times, despite the claim that Gnome 3.30 is lighter on resources. I may try a clean install at some point to see if that makes any improvement. This is a very low spec machine, it has to be said.

The most obvious change in is a switch from an icon grid to a sidebar list in Gnome settings. There are also minor changes to the file manager, and the addition of a Night Light mode, which changes the screen to a sepia tone, which apparently reduces eye stain at night.

One bug I have found so far is that the Gnome file manager does not create thumbnails for image files. This is a known bug, and quite easy to rectify by installing libgdk-pixbuf2.0-bin.

For me,  Stretch was a big improvement over Jessie. This update by comparison seems to add only minor improvements. My impressions so far are good, but I can live with my Stretch install on my main computer for a while. I will see what bugs get knocked out of Buster (a few fleas?) before updating it.

At least having an old laptop around I can scratch my update itch without inflicting those fleas on the family.