Why does my system download directly from security-cdn.debian.org?
I have started noticing something odd with the way apt on my systems
downloads some security updates.
First, I run an instance of apt-cacher-ng on my local network and I have
backends configured for both the normal archive and also the security
archive. My sources.list looks like this:
deb http://apt-cache.localdomain:3142/security/ stretch/updates main contrib non-free
deb http://apt-cache.localdomain:3142/debian/ stretch main non-free contrib
The corresponding configurations for apt-cacher-ng are:
However, recent kernel updates have instead been retrieved from
security-cdn.debian.org, like this from my cron-apt log:
Get:7 http://apt-cache.localdomain:3142/security stretch/updates/main amd64 samba-common all 2:4.5.12+df
sg-2+deb9u3 [172 kB]
Get:8 http://security-cdn.debian.org stretch/updates/main amd64 linux-image-4.9.0-7-amd64 amd64 4.9.110-3+deb9u2 [39.0 MB]
What is even more unusual is that other security updates seem to come
from my apt-cacher-ng instance, as I would expect for all packages.
This is happening now on all of my machines. I have grepped the /etc
directories looking for instances of security-cdn.debian.org and the
other Debian redirectors but I have found none. Has anybody else
Roberto C. Sánchez