infisical-core 1.0.0-1 APT package returns 403 – artifact missing on S3

[pluusla]

Product

Platform/Access controls/Other

Describe the bug

The APT package index lists infisical-core 1.0.0-1 as available with full metadata
(Filename, Size, SHA256, MD5), but the actual .deb file returns HTTP 403 from
CloudFront/S3. The artifact was either never uploaded or has been deleted from S3
after the index was published.

APT index entry (from local cache):
Package: infisical-core
Version: 1.0.0-1
Architecture: amd64
Filename: pool/stable/i/in/infisical-core_1.0.0-1_amd64.deb
Size: 279294220
SHA256: 1e88172773f75f160c72197684954ab4d3b72add2ecf6e280b94e845e1dd7045
MD5sum: faa78a9651699bb7ed169d67af4a23fa

To Reproduce

1. Install infisical-core via the official APT repository
2. Run: apt-get update && apt-get upgrade
3. APT detects 1.0.0-1 as candidate and tries to fetch the .deb
4. Download fails with 403 Forbidden

Expected behavior

The .deb file listed in the package index should be accessible and downloadable,
so that apt-get upgrade can successfully install infisical-core 1.0.0-1.

Screenshots

Direct curl against the .deb URL:

curl -I https://artifacts-infisical-core.infisical.com/deb/pool/stable/i/in/infisical-core_1.0.0-1_amd64.deb

HTTP/2 403
content-type: application/xml
server: AmazonS3
x-cache: Error from cloudfront
x-amz-cf-pop: ZRH52-P1

apt-cache policy output:
Installed: 0.160.11-1
Candidate: 1.0.0-1

Deployment Type

Self-hosted

Additional context

Issue present since at least 2026-06-13. Workaround: apt-mark hold infisical-core.
No existing GitHub issue found for this problem.

[linear]

ENG-5297