When apt update fails on Debian 11 Bullseye, APT, Debian’s package manager, may be unable to reach repositories at their usual locations or may reject expired repository metadata. APT downloads package indexes, which list available packages, and checks repository information. It does not upgrade installed packages.
Bullseye’s Long Term Support (LTS), Debian’s final phase of security maintenance for a release, ended on August 31, 2026. As of November 10, 2026, its packages are available in Debian’s archive, but that archive does not mean Debian still provides new security fixes for Bullseye. For a regular installation, plan to upgrade to a supported Debian release. If you need Bullseye temporarily, point APT to the archive and disable the metadata-expiration check only for those archive entries.
First confirm that the machine runs Bullseye and inspect every APT source. APT reads repository addresses and settings, called source definitions, from /etc/apt/sources.list and files in /etc/apt/sources.list.d/. A vendor repository or an old backports entry can still fail after you change the main file.
cat /etc/debian_version
grep -R -E '^(deb |deb-src |Types:|URIs:|Suites:|Components:)' \
/etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/nullThe command shows traditional .list entries and the fields used by newer Deb822 .sources files. Review the output for Bullseye and old mirrors. Also check for backports and third-party repositories. Debian’s upgrade notes also recommend checking all source files before an upgrade, because inconsistent entries can cause APT to fetch packages from unintended releases.
The exact error helps identify what to fix:
| APT message | What it indicates |
|---|---|
404 Not Found |
The configured server or path does not provide the requested suite or file. |
Release file is expired |
APT considers the repository’s signed metadata too old under its Valid-Until check. |
does not have a Release file |
The requested suite or component path is wrong, or the server does not publish metadata for it. |
NO_PUBKEY or a signature error |
APT cannot verify the repository’s signing key or signature. |
An expired Release file and a missing Release file need different fixes. APT’s expiration check helps detect old metadata or metadata served again from an earlier point. A wrong path needs a corrected source entry. For signature errors, check the keyring, system clock, and repository identity. Do not mark a source as trusted or turn off signature verification to silence these errors. APT’s authentication documentation explains how signed repository metadata protects package integrity.
For an ordinary machine, upgrade to a supported Debian release. Debian’s release status page lists Debian 13 Trixie as stable and Debian 12 Bookworm as oldstable as of November 10, 2026. Use the official release notes for each upgrade step. Debian’s Bookworm notes explain how to upgrade from Bullseye. For later upgrades, follow the notes for each step instead of changing repository names without checking.
If you must keep Bullseye for a short time, use Debian’s archive to retrieve its historical packages and indexes. The following traditional .list entries point to the archive’s Bullseye suites and components:
deb [check-valid-until=no] https://archive.debian.org/debian bullseye main contrib non-free
deb [check-valid-until=no] https://archive.debian.org/debian bullseye-updates main contrib non-free
deb [check-valid-until=no] https://archive.debian.org/debian-security bullseye-security updates/main updates/contrib updates/non-freeReplace the old Bullseye entries rather than leaving duplicates. If you use a Deb822 .sources file, express the same archive locations, suites, components, and per-source expiration setting in that format. You can omit components your installation does not use. The archived Bullseye metadata identifies the main suite and its components; the Bullseye security metadata lists the security suite’s component names.
The check-valid-until=no option tells APT to skip the expiration check for that source. The archive remains available even when its metadata has passed its expiration date; Debian’s FTP team documents this issue and the per-source setting. Keep the check enabled for actively maintained repositories. Do not disable signature verification.
Then refresh the indexes:
sudo apt updateIf APT reports a missing Release file or component, compare the source entry with the archive’s suite and component names. Changing the expiration setting will not fix an incorrect path. As of November 10, 2026, the Bullseye security archive is present, but its availability does not mean Debian still issues Bullseye security fixes. Its metadata date reflects repository information, not a continuation of LTS.
A successful apt update means APT retrieved and processed repository metadata. It does not mean Bullseye is supported or that the listed packages receive current security maintenance. Debian’s release information gives Bullseye’s LTS end date as August 31, 2026. Debian also lists an Extended LTS offering from a third party, separate from Debian LTS. Before relying on it, check which packages and computer architectures the provider supports.
Before upgrading, review third-party sources and packages. A vendor repository that targets Bullseye may not support the Debian release you plan to install. Debian’s upgrade notes recommend checking non-Debian sources and keeping source entries consistent. Use a release codename such as bookworm or trixie when you want a source to stay tied to that release; the moving name stable changes when Debian promotes a new stable release.
What I'm buildingGive Vroni a GitHub issue, bug report, spec, or rough idea. It reads the repo, plans the change, writes code, runs checks, and works toward a review-ready pull request.
Take a look at vroni.com
