apt.postgresql.org CDN ignores If-Range (206 on stale validator), breaks apt-cacher-ng

Hi,

The CDN in front of apt.postgresql.org does not honour the If-Range request header. When the validator sent in If-Range does not match the current representation, it still answers 206 Partial Content for the requested range, instead of ignoring the Range header and returning the full representation with 200, as required by RFC 9110 section 13.1.5.

REPRODUCTION

At the time of testing, resolute-pgdg/InRelease had Last-Modified: Thu, 12 Nov 2026 15:41:40 GMT and Content-Length: 189081.
URL=http://apt.postgresql.org/pub/repos/apt/dists/resolute-pgdg/InRelease

1.
Matching validator (correct behaviour):

curl -s -o /dev/null -D - "$URL" -H 'Range: bytes=189080-' -H 'If-Range: Thu, 12 Nov 2026 15:41:40 GMT'
-> HTTP/1.1 206 Partial Content
-> Content-Range: bytes 189080-189080/189081

2.
Stale validator (incorrect behaviour):

curl -s -o /dev/null -D - "$URL" -H 'Range: bytes=2324-' -H 'If-Range: Tue, 10 Nov 2026 15:46:31 GMT'
-> HTTP/1.1 206 Partial Content
-> Content-Range: bytes 2324-189080/189081

Expected for test 2: HTTP/1.1 200 OK with the complete file.

Responses carry "Via: 1.1 varnish, 1.1 varnish" and "X-Cache: HIT, HIT", so the behaviour most likely comes from the CDN layer rather than the origin. For comparison, the same test returns 200 on archive.ubuntu.com, security.ubuntu.com, packages.sury.org and nginx.org.

Compare with others repos :
    for URL in \
     http://archive.ubuntu.com/ubuntu/dists/resolute/InRelease \
     http://security.ubuntu.com/ubuntu/dists/resolute-security/InRelease \
     http://packages.sury.org/php/dists/resolute/InRelease \
     http://nginx.org/packages/ubuntu/dists/resolute/InRelease \
     http://apt.blendbyte.net/nginx/dists/resolute/InRelease \
     http://apt.postgresql.org/pub/repos/apt/dists/resolute-pgdg/InRelease
    do
     printf '%-75s ' "$URL"
     curl -Ls -o /dev/null -w '%{http_code}\n' "$URL" \
     -H 'Range: bytes=10-' -H 'If-Range: Mon, 01 Jan 2024 00:00:00 GMT'
    done
Results :
    http://archive.ubuntu.com/ubuntu/dists/resolute/InRelease 200
    http://security.ubuntu.com/ubuntu/dists/resolute-security/InRelease 200
    http://packages.sury.org/php/dists/resolute/InRelease 200
    http://nginx.org/packages/ubuntu/dists/resolute/InRelease 200
    http://apt.blendbyte.net/nginx/dists/resolute/InRelease 200
    http://apt.postgresql.org/pub/repos/apt/dists/resolute-pgdg/InRelease 206

IMPACT

apt-cacher-ng revalidates cached index files with a Range request on the last byte combined with If-Range. With the response above it receives a range it cannot reconcile with its cached copy and fails with "503 Server reports unexpected range" (see also Debian bug #1053833). As a result, apt update through apt-cacher-ng fails for the -pgdg suites every time an InRelease or Packages file changes.
Observed with apt-cacher-ng 3.7.5 on noble-pgdg and resolute-pgdg.

The client-side workaround is to disable range requests for volatile files (VfileUseRangeOps: 0), but fixing If-Range handling on the CDN would solve it for every apt-cacher-ng user.

Thanks for maintaining the repository.

Regards,
Antoine

Bien à vous,

Antoine

[cid:59d29442-5ee3-4941-9d06-d84edf10bb38]

Antoine Gauthier
Deployment & Delivery Manager / DevOps Lead
+33 7 62 12 21 25
www.ignimission.com<http://www.ignimission.com/>