On Sun, 2026-09-20 at 20:00 +0100, Chris Boot wrote: > Err:1 http://deb.debian.org/debian-security bullseye-security/main arm64 > dpkg arm64 1.20.14 > 404 Not Found [IP: 151.101.62.132 80] > [...] > > This is what's broken.
A situation like this could be handled better if we used a more precise HTTP status code after removing stuff from the repository. I think HTTP 410 "Gone" would be helpful: • it informs the user that the package or release metadata they're looking for *was* here, but it is no longer and won't be coming back, and this is intentional; and • it informs HTTP caching proxies that the resource they're looking for is gone and won't be coming back, so they may refuse repeated requests for obsolete resources and discard pertinent already-cached data Also, GET requests that return 410 "Gone" can still return an informative message body, which could be a plain text string as simple as "This suite is obsolete and has been removed from the Debian archive; see https://.../"; This distinction is good practice and RFC 9110 §15.5.5 says such: > A 404 status code does not indicate whether this lack of representation is > temporary or permanent; the 410 (Gone) status code is preferred over 404 if > the origin server knows, presumably through some configurable means, that the > condition is likely to be permanent. This could communicate the change in a more human-readable and more machine-readable way.
signature.asc
Description: This is a digitally signed message part
