Confirming the stale servers in #15, with one difference. As of 21:06
UTC on 2026-10-15, 185.125.190.23 and .24 aren't only missing the esm5
.debs. They're serving the whole bionic-infra-security snapshot from
2026-10-14 20:10, before esm5 existed. Their index doesn't list esm5 at
all.

InRelease Date and Last-Modified per server:

  185.125.190.23  Date: Wed, 14 Oct 2026 20:10:48 UTC  Last-Modified: Wed, 14 
Oct 2026 22:10:19 GMT
  185.125.190.24  Date: Wed, 14 Oct 2026 20:10:48 UTC  Last-Modified: Wed, 14 
Oct 2026 21:10:24 GMT
  185.125.190.75  Date: Thu, 15 Oct 2026 12:10:18 UTC  Last-Modified: Thu, 15 
Oct 2026 20:10:22 GMT
  91.189.91.46    Date: Thu, 15 Oct 2026 12:10:18 UTC  Last-Modified: Thu, 15 
Oct 2026 20:10:22 GMT
  91.189.91.47    Date: Thu, 15 Oct 2026 12:10:18 UTC  Last-Modified: Thu, 15 
Oct 2026 20:10:22 GMT

The healthy three update about hourly. .23 and .24 stopped around
21:00-22:00 UTC on the 14th.

Authenticated HEAD on systemd_237-3ubuntu10.57+<ver>_amd64.deb:

  185.125.190.23  esm4 200  esm5 404
  185.125.190.24  esm4 200  esm5 404
  185.125.190.75  esm4 404  esm5 200
  91.189.91.46    esm4 404  esm5 200
  91.189.91.47    esm4 404  esm5 200

All five are still in the A records from ns1-3.canonical.com. A machine
that refreshes against .23/.24 still sees esm4 as the candidate and
keeps the broken resolved. One that refreshes against a healthy server
and then downloads from .23/.24 gets the 404.

Repro, no credentials needed:

  for ip in $(dig +short esm.ubuntu.com); do echo -n "$ip  "; curl -s
--resolve esm.ubuntu.com:443:$ip
https://esm.ubuntu.com/infra/ubuntu/dists/bionic-infra-
security/InRelease | grep '^Date:'; done

Pinning esm.ubuntu.com to 91.189.91.46 in /etc/hosts for both apt-get
update and the upgrade works.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170538

Title:
  Ubuntu 24.04: systemd-resolved DNSSEC fails after root KSK rollover;
  built-in trust anchor lacks key 38696

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/2170538/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to