Switched the bullseye security repository to archive.debian.org

snapshot.debian.org returns 503 for every archive path, which broke the
build. archive.debian.org now hosts bullseye-security with the same final
package versions, and its Release file has no Valid-Until, so the
check-valid-until override is no longer needed.

Author: Ilyes512

Dockerfile.tmpl

@@ -29,14 +29,12 @@ ARG PHP_REDIS_VERSION=6.3.0
 # Latest version of amqp-extension: https://pecl.php.net/package/amqp
 ARG PHP_AMQP_VERSION=2.2.0
 
-ARG DEBIAN_SECURITY_SNAPSHOT=20260901T000000Z
-
 WORKDIR /var/www
 
 RUN --mount=type=bind,from=php_extension_installer,source=/usr/bin/install-php-extensions,target=/usr/local/bin/install-php-extensions \
     # Bullseye is EOL:
-    sed -i -E "s|^deb http://deb.debian.org/debian-security (.*)|deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/$DEBIAN_SECURITY_SNAPSHOT \1|" /etc/apt/sources.list \
-    && grep -q snapshot.debian.org /etc/apt/sources.list \
+    sed -i -E "s|^deb http://deb.debian.org/debian-security (.*)|deb http://archive.debian.org/debian-security \1|" /etc/apt/sources.list \
+    && grep -q archive.debian.org /etc/apt/sources.list \
     && apt-get update \
     && apt-get install --assume-yes --no-install-recommends \
         apt-transport-https \

README.md

@@ -45,31 +45,16 @@ Building `builder`-target:
 docker build --tag ghcr.io/specsnl/php74/builder:latest --file fpm/Dockerfile --target builder .
 ```
 
-## Debian bullseye is EOL (`DEBIAN_SECURITY_SNAPSHOT`)
+## Debian bullseye is EOL
 
 PHP 7.4 images are only published for Debian 11 (bullseye), which is past end-of-life. Its security
-suite has stopped being maintained, and the mirrors have moved on in a way that breaks `apt-get`:
+suite has stopped being maintained, and `deb.debian.org` still serves the `bullseye-security` package
+index while the `.deb` pool behind it has been purged — every package download returns a 404.
 
-- `deb.debian.org` still serves the `bullseye-security` package index, but the `.deb` pool behind it
-  has been purged — every package download returns a 404.
-- `archive.debian.org`, where EOL suites normally end up, does not have `bullseye-security` yet. As
-  of this writing it only goes up to `buster`.
-- The final `Release` file (published 2026-08-31) carries a 7-day `Valid-Until` that has long since
-  lapsed, so `apt` rejects the repository as expired even where it is reachable.
-
-To still get the last published security updates, the runtime stage rewrites the `bullseye-security`
-entry in `/etc/apt/sources.list` to point at [snapshot.debian.org](https://snapshot.debian.org),
-which keeps every historical mirror state permanently. The build arg pins which state is used:
-
-```
-ARG DEBIAN_SECURITY_SNAPSHOT=20260901T000000Z
-```
-
-That timestamp sits just after the final security publish, so the image gets the complete, final set
-of bullseye security updates. Because the snapshot is immutable, this does not break when Debian
-finishes moving bullseye to `archive.debian.org`. The rewrite also disables `apt`'s freshness check
-for that one repository — signatures are still verified, only the "is this recent?" assertion is
-skipped, which is unavoidable for a deliberately frozen suite.
+To still get the final published security updates, the runtime stage rewrites the `bullseye-security`
+entry in `/etc/apt/sources.list` to point at `archive.debian.org`, where Debian keeps EOL suites
+permanently. The archived `Release` file carries no `Valid-Until`, so no `apt` freshness override is
+needed.
 
 A `grep` guard follows the rewrite so the build fails loudly if the base image ever changes its
 `sources.list` format, rather than silently falling back to building without security updates.

apache/Dockerfile

@@ -29,14 +29,12 @@ ARG PHP_REDIS_VERSION=6.3.0
 # Latest version of amqp-extension: https://pecl.php.net/package/amqp
 ARG PHP_AMQP_VERSION=2.2.0
 
-ARG DEBIAN_SECURITY_SNAPSHOT=20260901T000000Z
-
 WORKDIR /var/www
 
 RUN --mount=type=bind,from=php_extension_installer,source=/usr/bin/install-php-extensions,target=/usr/local/bin/install-php-extensions \
     # Bullseye is EOL:
-    sed -i -E "s|^deb http://deb.debian.org/debian-security (.*)|deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/$DEBIAN_SECURITY_SNAPSHOT \1|" /etc/apt/sources.list \
-    && grep -q snapshot.debian.org /etc/apt/sources.list \
+    sed -i -E "s|^deb http://deb.debian.org/debian-security (.*)|deb http://archive.debian.org/debian-security \1|" /etc/apt/sources.list \
+    && grep -q archive.debian.org /etc/apt/sources.list \
     && apt-get update \
     && apt-get install --assume-yes --no-install-recommends \
         apt-transport-https \

fpm/Dockerfile

@@ -29,14 +29,12 @@ ARG PHP_REDIS_VERSION=6.3.0
 # Latest version of amqp-extension: https://pecl.php.net/package/amqp
 ARG PHP_AMQP_VERSION=2.2.0
 
-ARG DEBIAN_SECURITY_SNAPSHOT=20260901T000000Z
-
 WORKDIR /var/www
 
 RUN --mount=type=bind,from=php_extension_installer,source=/usr/bin/install-php-extensions,target=/usr/local/bin/install-php-extensions \
     # Bullseye is EOL:
-    sed -i -E "s|^deb http://deb.debian.org/debian-security (.*)|deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/$DEBIAN_SECURITY_SNAPSHOT \1|" /etc/apt/sources.list \
-    && grep -q snapshot.debian.org /etc/apt/sources.list \
+    sed -i -E "s|^deb http://deb.debian.org/debian-security (.*)|deb http://archive.debian.org/debian-security \1|" /etc/apt/sources.list \
+    && grep -q archive.debian.org /etc/apt/sources.list \
     && apt-get update \
     && apt-get install --assume-yes --no-install-recommends \
         apt-transport-https \