Thanks so much for reporting this issue! I'll look into it and get back to you ASAP.

FWIW - I couldn't reproduce it initially, but I've managed to so will follow up and post back.

In the meantime, if you want to install software, so long as you don't need to install any TurnKey specific packages, you can (temporarily) disable the TurnKey repo like this:

sed -i.bak "\|archive.turnkeylinux.org| s|^|#|" /etc/apt/sources.list.d/*sources.list

That will create backup files (same name with '.bak' appended) of /etc/apt/sources.list.d/sources.list & /etc/apt/sources.list.d/security-sources.list and comment out the turnkey lines in the original files.

To revert, just copy the backups back over the top of the commented files:

mv /etc/apt/sources.list.d/sources.list.bak /etc/apt/sources.list.d/sources.list
mv /etc/apt/sources.list.d/security.sources.list.bak /etc/apt/sources.list.d/security.sources.list

I just wanted to give you a quick update and apologise that it's not fixed yet.

Other than sleeping on it, I have spent most of the time since I first replied investigating what happened. Before I did anything, I needed to know the scope of what I'd potentially need to do. I wanted to be sure that I understood what had happened. It was especially important to be able to rule out something malicious (because I'd need to rotate keys if that was the case).

Turns out that the cause was an assumption that I made and the fact that I only tested on existing VM servers that were already running. I didn't test on a new instance and/or on LXC. That was an oversight and I deeply apologize.

Beyond investigation, yesterday I confirmed how I could recreate the issue on a server that wasn't previously experiencing it. I also set up a local apt repo test environment, so I will be able to minimize the chance of making things worse (I need to fix it for you guys, without breaking it for existing users). After sleeping on it, I have a plan!

I'll report back once I have something to share (hopefully good news...). Thanks for your patience.

Ok, so my testing indicates that it's now fixed. Can anyone who was having the issue please confirm that it no longer occurs? If you disabled the TurnKey repo, please be sure to re-enable that first. E.g.:

mv /etc/apt/sources.list.d/sources.list.bak /etc/apt/sources.list.d/sources.list
mv /etc/apt/sources.list.d/security.sources.list.bak /etc/apt/sources.list.d/security.sources.list

To test, all you need to do is run apt update, the output should now look like to this:

Hit:1 http://security.debian.org bullseye-security InRelease
Hit:2 http://deb.debian.org/debian unstable InRelease            
Hit:3 http://deb.debian.org/debian bullseye InRelease            
Ign:4 http://archive.turnkeylinux.org/debian bullseye-security InRelease
Ign:5 http://archive.turnkeylinux.org/debian bullseye InRelease
Ign:6 http://archive.turnkeylinux.org/debian bullseye-testing InRelease
Hit:7 http://archive.turnkeylinux.org/debian bullseye-security Release
Get:9 http://archive.turnkeylinux.org/debian bullseye Release [5659 B]
Hit:11 http://archive.turnkeylinux.org/debian bullseye-testing Release
Fetched 5659 B in 2s (2370 B/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up to date.

(Obviously yours may be a little different, but showing no errors or warnings)