I tried to do a manul install via the system interface after a long period without updates and ran into this error. I did a ssh into the device and tried
sudo apt-get dist-upgrade
which resulted in resposes like
Err:1 {LINK REMOVED} bullseye-security/main armhf dpkg armhf 1.20.14
404 Not Found [IP: 151.101.130.132 443]
Err:2 {LINK REMOVED} bullseye-security/main armhf perl-base armhf 5.32.1-4+deb11u5
404 Not Found [IP: 151.101.130.132 443]
Ign:3 {LINK REMOVED} bullseye-security/main armhf libpam-runtime all 1.4.0-9+deb11u2
Err:4 {LINK REMOVED} bullseye-security/main armhf systemd-sysv armhf 247.3-7+deb11u8
404 Not Found [IP: 151.101.130.132 443]
Err:5 {LINK REMOVED} bullseye-security/main armhf libtasn1-6 armhf 4.16.0-2+deb11u2
404 Not Found [IP: 151.101.130.132 443]
Err:6 {LINK REMOVED} bullseye-security/main armhf samba-common-bin armhf 2:4.13.13+dfsg-1~deb11u8"
…….
The above pasted links could not be posted on this form.
The only references I found to the istall error message on the wiki were old and didn’t seem to fit my situation.
This is due to the fact that the Debian version on which OSMC is based (Bullseye) already reached End of Life at the end of last month, as discussed on the dedicated thread. Many packages cannot be installed now, and packages which users already installed are not receiving security updates.
Where are users getting updates for packages installed from Debian repositories that become vulnerable? Debian itself is no longer providing updates. The only continuing support for Bullseye I can see is Freexian’s LTS, which is commercial, requires adding new repos to /etc/apt/, and doesn’t even cover the whole range of Debian packages. You can hardly commit yourself to providing updates for all of Debian’s non-OSMC-related packages through your own project’s repo.
Moving to Trixie in the future (even if “soon”) doesn’t help fix the problem that right now, all these OSMC installations are on an unsupported and insecure distro that isn’t getting security updates. And this is a distro where almost everyone is connected to the internet and passing downloaded and often dubious-origin media files through potentially exploitable libs (so even if not running a server directly connected to the open internet, they could be vulnerable). I’m just aghast that you would have let such a gap between releases happen. Really should be talked about more widely as a reason that maybe this project can’t be trusted for one’s media center.
They will get security updates imminently when we move to Tixie.
OSMC shouldn’t be publicly facing on the Internet. We’ve always made this clear.
You can also update to Bookworm or Trixie today by adjusting the sources.list.
I think you are concern trolling here and making an issue where there isn’t one.
I think that’s a huge blanket assumption.
That repository stopped serving updates on 7th September (yesterday). It’s been a day, not a huge gap
Fortunately, you are able to use something else if you prefer.
The repository stopped serving updates the other day, but it stopped getting updates to serve well before that. I have already seen some security announcements potentially relevant to what was already on my OSMC installation.
With regard to upgrading to Trixie, that still gives this error from apt-get update (which also wants to remove 46 vital OSMC-related packages when doing an upgrade):
Ign:3 trixie InRelease
Err:5 trixie Release
404 Not Found [IP: 131.188.12.211 443]
[...]
E: The repository 'https://apt.osmc.tv trixie Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
This completely breaks apt updates on both vero 4k+ and vero v that I have, which is really annoying - not really sams fault though, I think debian did something dumb
There is a work around, but it needs shell access
change this line deb https://security.debian.org/ bullseye-security main contrib non-free
to this deb [check-valid-until=no] https://security.debian.org/ bullseye-security main contrib non-free
Question I have for @sam_nazarko is , once Vero V moves to Trixie, is there any way to somewhat keep Vero 4k+ functional and somewhat up to date with other packages, etc? even if in an unofficial, unsupported manner? i.e. can we manually move it to Trixie? will it still somewhat continue to work, just without support and guarantees, etc?
You can’t use trixie as the release for apt.osmc.tv because it does not have that disribution. You will have to keep that repository on bullseye.
I tested updating the Debian packages on my Vero V to bookworm (I’m comfortable with breaking things and debugging issues by myself); it still works, but since OSMC packages are for bullseye, it did break some extensions in Kodi. I do not recommend anyone else to do it. Just stay on bullseye and keep the system out of reach from the internet until official updates are available. Downgrading will not be possible so if you break something, you will need to wipe the system and reinstall.
Updating packages from bookworm to trixie does not work without breaking things as you said.
I did this. Besides Kodi plugin-related issues which must be related to Python, a system on Bookworm with a OSMC built for Bullseye appears to have broken automount of external drives.
It feels pretty unrealistic to tell users to keep an OSMC device off the internet until security updates are available again. (And mind you, we’ve been promised an updated Debian “soon” for years now on this forum.) Fetching external content is a standard use of a media center.
