debuerreotype, the tool we use to create our container images build reproducible container images. Since Debian stable releases are still to some extent volatile (security updates, point releases) it doesn't fetch packages from the regular debian.org mirrors, but instead from snapshot.debian.org.

snapshot.d.o however configures a more strict Valid-Until setting compared to main Debian, quoting from the home page:

To access snapshots of suites using Valid-Until that are older than a dozen days, it is necessary to ignore the Valid-Until header within Release files, in order to prevent apt from disregarding snapshot entries ("Release file expired"). Use aptitude -o Acquire::Check-Valid-Until=false update or apt-get -o Acquire::Check-Valid-Until=false update for this purpose.

Valid-Until protects against outdated mirrors, which is valid for some use cases, but not needed here since we are in full control of the build and distribution of our internal images. And notably the current behaviour prevents us from using older container images if e.g. the weekly rebuild failed (as it happened in T437829, from which this task is spun off) and also from intentionally using older images where needed (as requested in https://phabricator.wikimedia.org/T437994#12345753).

@tstarling submitted an upstream pull request to configure the generated images to ignore V-U: https://github.com/debuerreotype/debuerreotype/issues/201

While this hasn't been merged upstream, it looks fine to me and I'll patch debuerreotype internally with that patch for now.