felhom.eu/documentation/audits/os-updates-spike-2026-10-04/partF/snapshot-debian-org.md

snapshot.debian.org from a box — 2026-10-04 (throwaway debian:trixie container on scratch guest 9202; no box source changed)

• https from the bare debian:trixie image fails (no ca-certificates in the image). http is enough: apt checks the Release signature with Debian's keyring either way. A real box has ca-certificates.
• Snapshot dated 20260927T000000Z (debian + debian-security): apt-get update rc 0, 2.3 s first run, 1.0 s second. madison openssl → 3.5.7-1~deb13u2 in both.
• Snapshot dated 20260701T000000Z: apt-get update rc 0, 3.0 s (Fetched 10.1 MB); madison openssl → 3.5.6-1~deb13u2 (security) and 3.5.6-1~deb13u1 (main).
• apt-get install --download-only openssl=3.5.6-1~deb13u1 → rc 0, 2.0 s, Get:1 http://snapshot.debian.org/archive/debian/20260701T000000Z trixie/main amd64 openssl amd64 3.5.6-1~deb13u1 [1503 kB]. The same exact version is GONE from the live archives (madison-demo-hp-host.txt: only 3.5.7-1~deb13u2 main, 3.5.7-1~deb13u3 security) — demo-hp's host runs it today and could not reinstall it from its own sources.
• Container removed (--rm), image debian:trixie removed from 9202.