Debian Mirror repo.3cx.com inconsistent — grub-pc missing security updates — only base 2.06-13 available, breaks on upgrade

[PrismaComputer]

Hi,

we ran into a packaging inconsistency that indicates the Debian repository used by 3CX PhoneSystem VMs (repo.3cx.com/debian/2009, bookworm) is not maintained as a verbatim mirror of the upstream Debian archive, but through some form of selective, per-package curation — and that curation appears to have missed grub-pc. This can silently remove GRUB's bootloader-management package on any system that applies routine grub2 security updates via unattended-upgrades or manual apt upgrade.

Observed via apt-cache madison:

grub-common | 2.06-13+deb12u2 | repo.3cx.com/debian/2009 bookworm/main
grub-common | 2.06-13+deb12u1 | repo.3cx.com/debian/2009 bookworm/main
grub-common | 2.06-13+deb12u1 | repo.3cx.com/debian-security/2009 bookworm-security/main
grub-common | 2.06-13 | repo.3cx.com/debian/2009 bookworm/main
grub-pc-bin | 2.06-13+deb12u2 | repo.3cx.com/debian/2009 bookworm/main
grub-pc-bin | 2.06-13+deb12u1 | repo.3cx.com/debian/2009 bookworm/main
grub-pc-bin | 2.06-13+deb12u1 | repo.3cx.com/debian-security/2009 bookworm-security/main
grub-pc-bin | 2.06-13 | repo.3cx.com/debian/2009 bookworm/main
grub2-common | 2.06-13+deb12u2 | repo.3cx.com/debian/2009 bookworm/main
grub2-common | 2.06-13+deb12u1 | repo.3cx.com/debian/2009 bookworm/main
grub2-common | 2.06-13+deb12u1 | repo.3cx.com/debian-security/2009 bookworm-security/main
grub2-common | 2.06-13 | repo.3cx.com/debian/2009 bookworm/main
grub-pc | 2.06-13 | repo.3cx.com/debian/2009 bookworm/main

This can't happen with a real 1:1 archive mirror: grub-common, grub-pc-bin, grub2-common and grub-pc are all built from the same grub2 source package in a single upload, so a genuine mirror would carry all four at identical version numbers. The fact that three of them reached +deb12u2 while grub-pc is stuck at the bare 2.06-13 (not even +deb12u1) points to an incompletely curated package selection on the 3CX side, rather than a straightforward sync failure.

Impact: grub-pc declares an exact-version dependency on its siblings (Depends: grub-common (= X), grub-pc-bin (= X), grub2-common (= X)). The moment those three get security-patched to u2, grub-pc's dependency becomes unsatisfiable, and apt's resolver silently removes grub-pc entirely to keep the system consistent — even with a plain apt-get install --only-upgrade limited to the three sibling packages. On a system where unattended-upgrades applies this automatically, grub-pc (and with it, the package-managed hook that re-runs grub-install on future kernel/grub updates) disappears without any explicit warning in typical automated update logs.

We worked around it locally by fetching the matching grub-pc_2.06-13+deb12u2_amd64.deb directly from the official Debian archive and installing it manually — but that's a one-off patch, not a fix for the mirror itself, and it'll recur at the next point release unless the mirror carries a matching grub-pc alongside its siblings.

Ask: Could someone from 3CX ops please make sure grub-pc gets mirrored/curated at the same patch level as grub-common/grub-pc-bin/grub2-common in repo.3cx.com, ideally in both main and debian-security, so future point releases don't hit the same dependency break?

Happy to provide more detail if useful.

 

[NikosT_3CX]

@PrismaComputer I will send you a DM now so we can check this further.

 

[AndreasY_3CX]

Hi @PrismaComputer,

Thank you for reporting this and for providing the detailed information.

To clarify, our 3CX Debian repository is not a verbatim mirror of the upstream Debian repository. We identify new packages from the official Debian repositories, test them using our internal repository, and then publish the approved packages to our production repository.

Regarding the GRUB packages, the inconsistency you observed does not appear to be present in the repository anymore. We can currently see the following versions available in repo.3cx.com:

grub-pc      | 2.06-13+deb12u2 | repo.3cx.com/debian/2009 bookworm/main
grub-pc      | 2.06-13         | repo.3cx.com/debian/2009 bookworm/main

grub-common  | 2.06-13+deb12u2 | repo.3cx.com/debian/2009 bookworm/main
grub-common  | 2.06-13+deb12u1 | repo.3cx.com/debian/2009 bookworm/main

grub-pc-bin   | 2.06-13+deb12u2 | repo.3cx.com/debian/2009 bookworm/main
grub-pc-bin   | 2.06-13+deb12u1 | repo.3cx.com/debian/2009 bookworm/main

grub2-common  | 2.06-13+deb12u2 | repo.3cx.com/debian/2009 bookworm/main
grub2-common  | 2.06-13+deb12u1 | repo.3cx.com/debian/2009 bookworm/main

In particular, grub-pc 2.06-13+deb12u2 is now available alongside the corresponding grub-common, grub-pc-bin, and grub2-common packages.

It is possible that your original check was performed before grub-pc was published, or that the local APT package indexes have not yet been refreshed.

Could you please run:

apt-get update
apt-cache madison grub-pc grub-common grub-pc-bin grub2-common

and send us the resulting output?

This will allow us to confirm whether you are still seeing the older repository metadata or whether there is another issue we need to investigate.