Commit 5ce57ab932 for openssl.org

commit 5ce57ab932b70e030249190a4b5a02232c080eea
Author: Dmitry Misharov <dmitry@openssl.org>
Date:   Tue Sep 8 09:56:51 2026 +0200

    Fix Debian 11 build in OS Zoo CI

    Debian 11 is EOL and we have to switch to snapshot.debian.org to
    install required packages. When bullseye-security will appear in
    archive.debian.org we should switch to it.

    Fixes: #32735
    Reviewed-by: Norbert Pocs <norbertp@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Merge-date: Tue Sep  8 15:09:36 2026
    Merged-from: https://github.com/openssl/openssl/pull/32736

diff --git a/.github/workflows/os-zoo.yml b/.github/workflows/os-zoo.yml
index 00421d23c4..84e725d3f9 100644
--- a/.github/workflows/os-zoo.yml
+++ b/.github/workflows/os-zoo.yml
@@ -103,7 +103,14 @@ jobs:
       matrix:
         zoo:
           - image: docker.io/library/debian:11
-            install: apt-get update && apt-get install -y gcc make perl
+            # Debian 11 LTS ended 2026-08-31: bullseye-security metadata is
+            # expired and its pool has been pruned.  Use the snapshot repos
+            # the image pins itself.
+            install: |
+              sed -i -e 's|^deb |#deb |' \
+                    -e 's|^# deb http://snapshot|deb http://snapshot|' /etc/apt/sources.list && \
+              apt-get -o Acquire::Check-Valid-Until=false update && \
+              apt-get install -y gcc make perl
           - image: docker.io/library/debian:12
             install: apt-get update && apt-get install -y gcc make perl
           - image: docker.io/library/debian:trixie