refactor(install_deps): unify bullseye with buster unconditional archive switch

Both buster and bullseye now switch unconditionally to archive.debian.org
(no probing). bullseye-security lines are commented out because
archive.debian.org does not carry bullseye-security yet (404), avoiding
apt update errors. _probe_url and all probe/revert logic removed (~60
lines). Docs updated accordingly.

AGENTS.md

@@ -32,7 +32,7 @@ docker build --build-arg BASE_IMAGE=ubuntu:noble -f docker/Dockerfile.deps -t <t
 `docker/Dockerfile.deps` uses BuildKit `--mount=type=bind` for `install_deps.sh` and `builddep/`, so neither lands in an image layer (BuildKit is required; it is the default in modern docker).
 
 > **EOL distro sources**: For EOL Debian releases (e.g. buster) the default
-> `deb.debian.org` no longer serves the repository. `install_deps.sh` now automatically switches EOL Debian sources to `archive.debian.org` (adding the `-backports` pocket) before apt operations; `switch_archive_sources.sh` has been removed; EOL handling (buster unconditional, bullseye probed via deb.debian.org Release check with fallback to archive.debian.org) is now fully inside `install_deps.sh`. `docker/Dockerfile.deps` and CI both invoke `install_deps.sh` directly.
+> `deb.debian.org` no longer serves the repository. `install_deps.sh` now automatically switches EOL Debian sources to `archive.debian.org` (adding the `-backports` pocket) before apt operations; `switch_archive_sources.sh` has been removed; EOL handling (buster and bullseye both switch unconditionally; bullseye-security is commented out as archive.debian.org does not carry it yet) is now fully inside `install_deps.sh`. `docker/Dockerfile.deps` and CI both invoke `install_deps.sh` directly.
 
 ## pullsrc on the host
 

README.md

@@ -206,7 +206,7 @@ The build starts from the unmodified Debian Sid source package and applies only
 - **Security-key / FIDO2** — if `libfido2-dev < 1.5.0`, removes it from build deps and flips `with-security-key-builtin` to `disable-security-key`.
 - **wtmpdb** — if `libwtmpdb-dev` is unavailable, strips it and `--with-wtmpdb`.
 - **init-system-helpers** — relaxes the versioned dependency from `1.66` to `1.50` when the installed version is older.
-- **EOL apt sources** — `install_deps.sh` automatically rewrites EOL Debian sources to `archive.debian.org` (including `-backports`), probing `deb.debian.org` first for `bullseye` and unconditionally for `buster`. The retired `switch_archive_sources.sh` is no longer needed.
+- **EOL apt sources** — `install_deps.sh` automatically rewrites EOL Debian sources to `archive.debian.org` (including `-backports`), unconditionally for both `buster` and `bullseye`; bullseye-security is commented out as archive.debian.org does not carry it yet. The retired `switch_archive_sources.sh` is no longer needed.
 - **Additional portability shims in `compile.sh`** — handles `libcrypt-dev`, `dh-runit`/`runit-helper`, `systemd` sysusers, and non-merged-`/usr` layouts as needed.
 
 ---

install_deps.sh

@@ -59,64 +59,32 @@ fix_apt_sources() {
             fi
         }
 
+        # Comment out debian-security lines (archive.debian.org does not carry
+        # bullseye-security yet; avoids apt update hitting a 404).
+        _mask_security() {
+            local f
+            for f in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
+                [[ -f "$f" ]] || continue
+                if grep -q "debian-security" "$f" 2>/dev/null; then
+                    echo "[fix-apt]   $f: commenting out debian-security line"
+                    sed -i '/debian-security/s/^/#/' "$f"
+                fi
+            done
+        }
+
         case "${codename}" in
-            buster)
+            buster|bullseye)
-                # buster is fully archived: main, updates, backports and
+                # buster and bullseye are fully archived on archive.debian.org
-                # security (buster/updates) are all on archive.debian.org, so
+                # (main, updates, backports and security), so switch
-                # switch unconditionally - no probing needed.
+                # unconditionally - no probing needed.
                 echo "[fix-apt] EOL codename detected: ${codename} (ID=debian), switching to archive.debian.org..."
                 _switch_to_archive
+                if [[ "$codename" == "bullseye" ]]; then
+                    _mask_security
+                fi
                 _add_backports
                 _fix_apt_eol_fixed=1
                 ;;
-            bullseye)
-                # Bullseye EOL transitional: probe official source first
-                # (wget→curl). If official still reachable, keep it;
-                # otherwise switch main to archive but keep security on
-                # official until archive actually carries bullseye-security
-                # (avoids 404 on archive.debian.org).
-                _probe_url() {
-                    local _pu_url="$1"
-                    # 1) wget (spider, timeout 5)
-                    if command -v wget >/dev/null 2>&1 && wget -q --spider --timeout=5 "$_pu_url" 2>/dev/null; then
-                        return 0
-                    fi
-                    # 2) curl (follow redirects, timeout 5)
-                    if command -v curl >/dev/null 2>&1 && curl -fsI --max-time 5 -L "$_pu_url" >/dev/null 2>&1; then
-                        return 0
-                    fi
-                    return 1
-                }
-                local _probe_ok=0
-                if _probe_url "http://deb.debian.org/debian/dists/bullseye/Release" 2>/dev/null || _probe_url "http://deb.debian.org/debian/dists/bullseye/InRelease" 2>/dev/null; then
-                    _probe_ok=1
-                fi
-                if [[ $_probe_ok -eq 1 ]]; then
-                    echo "[fix-apt] bullseye still served from deb.debian.org (probe succeeded), keeping official sources"
-                    # do NOT set _fix_apt_eol_fixed, remain on official
-                else
-                    echo "[fix-apt] bullseye official source not reachable (probe failed), switching to archive.debian.org..."
-                    _switch_to_archive
-                    # verify archive security actually exists; if 404, revert
-                    # security to official (keeps bullseye/bullseye-updates/backports on archive)
-                    local _archive_sec_ok=0
-                    if _probe_url "http://archive.debian.org/debian-security/dists/bullseye-security/Release" 2>/dev/null || _probe_url "http://archive.debian.org/debian-security/dists/bullseye-security/InRelease" 2>/dev/null; then
-                        _archive_sec_ok=1
-                    fi
-                    if [[ $_archive_sec_ok -eq 0 ]]; then
-                        echo "[fix-apt]   archive security not ready, keeping security on deb.debian.org"
-                        local f
-                        for f in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
-                            [[ -f "$f" ]] || continue
-                            if grep -q "archive\.debian\.org/debian-security" "$f" 2>/dev/null; then
-                                sed -i 's|archive\.debian\.org/debian-security|deb.debian.org/debian-security|g' "$f"
-                            fi
-                        done
-                    fi
-                    _add_backports
-                    _fix_apt_eol_fixed=1
-                fi
-                ;;
             *)
                 # Not an EOL codename - nothing to do.
                 ;;