Security.debian.org confused?

[Andrew Reid <reidac@bellatlantic.net>]

  Hi all --

  I'm having trouble with what seems like it should be a routine
security update on "lenny" -- I did "apt-get update; apt-get upgrade"
as per usual, and got this:

> mec:~# apt-get upgrade
> Reading package lists... Done
> Building dependency tree
> Reading state information... Done
> The following packages will be upgraded:
>   libexpat1 libmozjs1d xulrunner-1.9
> 3 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
> Need to get 8233kB of archives.
> After this operation, 28.7kB disk space will be freed.
> Do you want to continue [Y/n]?
> Err http://security.debian.org lenny/updates/main libexpat1 2.0.1-4+lenny1
>   404 Not Found [IP: 128.101.240.212 80]
   ....
> Failed to fetch 
http://security.debian.org//srv/security-master.debian.org/ftp/pool/updates/main/e/expat/libexpat1_2.0.1-4+lenny1_amd64.deb 
404 Not Found [IP: 128.101.240.212 80]
   ...
> E: Unable to fetch some archives, maybe run apt-get update or try 
with --fix-missing?

  The elipses conceal the fact that all three files had the
not-found problem.  

  I tried re-updating and --fix-missing, no joy.

  Doing host security.debian.org gets this:

> mec:~# host security.debian.org
> security.debian.org has address 149.20.20.6
> security.debian.org has address 128.31.0.36
> security.debian.org has address 128.101.240.212
> security.debian.org has IPv6 address 2001:4f8:8:36::6
> security.debian.org mail is handled by 10 klecker.debian.org.

  The fetch URL looks wrong to me, and manually trying it
in the browser seems to confirm that it's mangled.

  However, I can manually go to 
http://security.debian.org/pool/updates/main, and the stuff
is in there.
  
  I haven't changed my configuration, but I'm willing to believe
I missed a memo and have drifted out of date.

  Anyone got any clues?

				-- A.
-- 
Andrew Reid / reidac@bellatlantic.net