apt-get fails on Community Cloud: bullseye-security Release file expired — all apps with packages.txt

Community Cloud
,
1

My app has been failing to build for over 17 hours. The apt step fails because
the base image’s Debian sources have expired metadata:

E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease
is expired (invalid since 17h 38min 48s). Updates for this repository will not be applied.
[installer returned a non-zero exit code]
[Error during processing dependencies! Please fix the error and push an update, or try restarting the app.]

App: aula-de-ingles-7565.streamlit.app

This is not caused by my repository:

  • packages.txt has been unchanged for 23 days (libgl1, libglib2.0-0t64, libgomp1)
  • requirements.txt has been unchanged for 13 days
  • The build succeeded normally until two days ago
  • The failure happens during apt-get update, before apt even reads packages.txt,
    so the contents are irrelevant

What I have already tried, all without effect:

  • Reboot (several times)
  • Switching Python version between 3.11 and 3.12 in app settings

One detail that may help: the sources list mixes bullseye and trixie:

Hit:1 Index of /debian-security bullseye-security InRelease
Hit:2 Index of /debian trixie InRelease
Hit:4 Index of /debian-security trixie-security InRelease

Back in August I had to change libglib2.0-0 to libglib2.0-0t64 because the base
image had moved to Trixie. The bullseye-security entry appears to be a leftover
that is now expired and breaking the build.

This should affect every Community Cloud app that has a packages.txt, regardless
of its contents. Has anyone else hit this?

2

Hey there, thanks for sharing such a detailed report and for troubleshooting so thoroughly! :rocket: You’re absolutely right—this isn’t an issue with your code or packages.txt, but with the Streamlit Community Cloud build environment itself. The error E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is expired means the Debian security repo metadata is out of date, and apt-get update fails before it even tries to install your listed packages. This is a platform-level problem and has affected many users recently.

When the base image’s sources expire or are misconfigured (like mixing bullseye and trixie), there’s nothing you can do from your repo to fix it. The only workaround that’s sometimes helped in similar past incidents is to delete and redeploy the app, but often the fix must come from the Streamlit team updating their build images or apt sources. This issue has been reported and resolved in the past by the platform maintainers after similar Debian repo transitions or metadata expirations (see forum threads, see another example). Keep an eye on the Streamlit Community Cloud status page and the forum for updates. If you haven’t already, you can try deleting and recreating your app, but most likely this needs a fix from the Streamlit Cloud team.

Sources:

3

Hey @Luiz5

Thanks so much for flagging. The team is aware of this issue and currently have a fix in flight! :rocket:

4

Hey @Luiz5 , thanks for reporting the issue to us! We have rolled out a new version to prod which should fix the issue! Please let us know if something is still not working and sorry for the inconvenience :slight_smile: