Debian 11 has reached end-of-life: what this means for OSMC, and how to fix it
Every OSMC device installed before now needs a one-off fix. Until you apply it, updates
will not install and the App Store will not install anything. Both have the same cause.
Fresh installs from the new images are not affected — see below.
The fix: My OSMC → Updates → Manual Controls → Apply Hotfix, and enter updates2026fix.
You only need to do it once.
What is broken
Two things, and you may have hit either or both:
- Updates fail. My OSMC may report “Connectivity issue while checking for updates”, or
appear to check and then do nothing. Attempting to update pulls around fifty packages and
fails partway because most of the files it needs no longer exist. - App Store installs fail with “Error Installing — Please report on the OSMC Forum”. Samba
is the most reported, but it affects any app.
Neither will start working on its own. Both are fixed by the hotfix.
What happened
OSMC’s current release is built on Debian 11 (“bullseye”), which reached end-of-life on
31 August 2026, five years after release.
Debian signs its security repository with a short validity window and re-signs it continuously.
When a release retires, that stops. The final signature expired on 7 September at 21:13 UTC
and apt began rejecting the repository outright:
E: Release file for https://security.debian.org/dists/bullseye-security/InRelease
is expired (invalid since ...). Updates for this repository will not be applied.
On 12 September Debian re-signed that index with no expiry date, so that particular error
stopped. But re-signing the listing did not bring back the packages it lists. Those have
been removed from Debian’s servers, and the listing still advertises them. So apt now reads a
perfectly valid index, asks for the files it names, and is told they do not exist:
E: Failed to fetch .../dpkg_1.20.14_armhf.deb 404 Not Found
E: Failed to fetch .../libpam-modules_1.4.0-9+deb11u2_armhf.deb 404 Not Found
A single missing file aborts the whole operation, installing nothing. That is why updates and
App Store installs both fail, and why the App Store cannot name the package that caused it —
the failure happens before installation begins.
This is not caused by anything on your device and it is not a network problem, despite what the
error says. That “connectivity” wording is ours and it is being fixed.
It was not just us
Every Debian 11 system hit this simultaneously, including some very large operations. Ubiquiti’s
UniFi users ran into the identical failure and were advised to disable the repository’s validity
check as a workaround (UniFi Community).
Streamlit’s Community Cloud broke the same week and had to rebuild its container images (thread).
I mention it not to deflect — the date was known and we should have acted on it — but because it
explains why this appeared everywhere at once, and why waiting will not fix it.
The fix
- My OSMC → Updates → Manual Controls → Apply Hotfix
- Enter:
updates2026fix - Let it finish, then check for updates or try the App Store again.
If you prefer SSH, the hotfix does the equivalent of repointing one line in
/etc/apt/sources.list from Debian’s retired security repository to OSMC’s copy of it. Your
other repositories are untouched, a backup is kept at /etc/apt/sources.list.osmc-eol-backup,
and running it twice is harmless.
Installing fresh instead?
New images — OSMC 2026.05-2, available shortly — ship pointing at the right place already.
A fresh install from those needs no hotfix and is not affected by any of this.
You do not need to reinstall. The hotfix leaves an existing device in the same state as a fresh
2026.05-2 install, so reinstalling gains you nothing. If you are installing from an image
downloaded before 2026.05-2, apply the hotfix once afterwards.
OSMC is now maintaining Debian 11 security updates
Debian will publish no further security updates for Debian 11 — that is what end-of-life means.
OSMC has taken custody of them. We now host the complete final set of Debian 11 security
packages on our own servers, and will keep serving them for as long as devices are running this
release. That is what the hotfix points your device at. Nothing that existed is lost, and the
packages are exactly as Debian published them — same versions, same contents, nothing of ours
added. The corresponding source code is published alongside, so the licensing obligations that
come with redistributing it are met.
Your device keeps working, stays updatable, and keeps the security updates it already had. Where
a security issue arises that affects OSMC users, we will address it rather than leave it. Longer
term the right answer is a base that is still actively maintained upstream, which is what the
next section is about.
Debian 13 (“trixie”) is underway
Work on the next OSMC is already in progress. It will be based on Debian 13 (“trixie”) and
will be 64-bit.
Moving from 32-bit to 64-bit cannot be done in place — it is a change of architecture, not a
version bump — so it will need a fresh installation. My OSMC’s backup and restore will carry
your settings across, and the process will be documented properly before release. Your device
continues to work in the meantime, with security updates served from our repository.
No date yet. When there is one it will be announced.
If you are still stuck
Please start a new thread with:
- your device and OSMC version (My OSMC → About)
- logs uploaded with My OSMC → Logs, or
grab-logs -Aover SSH
Include whether you edited sources.list yourself, as that changes what the logs will show.
Apologies for the disruption. The expiry was not something we acted on in time, and the
misleading “connectivity” error made it harder to diagnose than it should have been. Both that
error message and the underlying behaviour — where one unavailable repository stops everything —
are being fixed, so that the next time a Debian release retires this is a footnote rather than an
outage.
