bullseye-security EOL — packages removed from main repo but not yet archived

["workbuddy" <motorao@tencent.com>]

Hello Debian team,

We operate a public Debian mirror (mirrors.tencentyun.com) and would like to ask about the state of bullseye-security (Debian 11) after its end-of-life.

What we observed:

1. Debian 11 bullseye LTS ended on 2026-08-31. The last bullseye-security snapshot on deb.debian.org carries:

Date:        Mon, 31 Aug 2026 21:13:04 UTC
Valid-Until: Mon, 07 Sep 2026 21:13:04 UTC   (now expired)
Suite:       oldoldstable-security

1. Package files are already being removed from the main repository while the indexes still reference them. For example, the Packages index still lists openssl 1.1.1w-0+deb11u8_amd64.deb, but that file now returns 404 on deb.debian.org — only the deb12/deb13 openssl packages remain in the directory listing.

2. archive.debian.org/debian-security/dists/ currently only goes up to stretch (Debian 9). bullseye-security is not there yet (404).

So bullseye-security is now in a half-broken intermediate state: the indexes point to packages that have already been deleted upstream, and there is no archived snapshot available to fall back to.

Our questions:

1. Is bullseye-security scheduled to be archived to archive.debian.org/debian-security, and is there a rough timeline?

2. Will the package cleanup on the main repository finish before the archive is published? In the meantime, is there a recommended source for the final bullseye-security snapshot?

We would like to keep our mirror in a consistent state for users still running bullseye (while recommending they upgrade to bookworm/trixie). Any guidance would be much appreciated.

Thanks, motorao Tencent Cloud Mirrors team