[Please include my email address in any replies.] Hi Bob, Thanks for your quick reply.
I would verify that you are really at Sarge already and that these really are only security updates. As things download you can tell if they are coming from sarge/updates or not. If you pick a package in particular that it wants to upgrade and check you can tell where it wants to upgrade it from and what is where.
Ah, ok. My sarge install was from Feb. I did "apt-get dist-upgrade" in around May, so I think maybe the 500MB are since then..
apt-cache policy packagename It is somewhat concerning to me that there is such a large amount of upgrade. I fear you are doing a woody to sarge upgrade without realizing it. A good thing to do none the less. But not without knowing and actively thinking you want to do the upgrade. This is why many advocate to never say "stable" in the sources.list file but to always say explicitly "woody", "sarge", "etch", etcetera.
That is a good idea. I have changed it to say "sarge" in my /etc/apt/sources.list
Kind regards JG