Package: vagrant Version: 2.2.14+dfsg-2 Severity: serious Hi,
It looks like a change in HCP (HashiCorp Cloud Platform, the replacement for Vagrant Cloud to host Vagrant boxes images), introduced around 2025-01-09, broke versions of Vagrant below 2.4.0 (2.4.0 being the first release of Vagrant under the 'Business Source License'). As a result, this makes it impossible to download images from HCP using free versions of Vagrant (the versions packaged in Debian). In detail (according to vagrant up --debug): Up to Vagrant 2.3.7, vagrant fetches box metadata using: /opt/vagrant/embedded/bin/curl -q -I --fail --location --max-redirs 10 --verbose --user-agent "Vagrant/2.3.7 (+https://www.vagrantup.com; ruby3.1.4)" --continue-at - -H "Accept: application/json" https://vagrantcloud.com/debian/bookworm64 and then: opt/vagrant/embedded/bin/curl -q --fail --location --max-redirs 10 --verbose --user-agent "Vagrant/2.3.7 (+https://www.vagrantup.com; ruby3.1.4)" --continue-at - -H "Accept: application/json" https://vagrantcloud.com/debian/bookworm64 (without -I to fetch the actual data) Since Vagrant 2.4.0, vagrant tries both: /opt/vagrant/embedded/bin/curl -q -I --fail --location --max-redirs 10 --verbose --user-agent "Vagrant/2.4.0 (+https://www.vagrantup.com; ruby3.1.4)" --continue-at - -H "Accept: application/json" https://vagrantcloud.com/api/v2/vagrant/debian/bookworm64 and /opt/vagrant/embedded/bin/curl -q -I --fail --location --max-redirs 10 --verbose --user-agent "Vagrant/2.4.0 (+https://www.vagrantup.com; ruby3.1.4)" --continue-at - -H "Accept: application/json" https://vagrantcloud.com/debian/bookworm64 then decides to use /opt/vagrant/embedded/bin/curl -q --fail --location --max-redirs 10 --verbose --user-agent "Vagrant/2.4.0 (+https://www.vagrantup.com; ruby3.1.4)" --continue-at - -H "Accept: application/json" https://vagrantcloud.com/api/v2/vagrant/debian/bookworm64 As one can see, curl --location --verbose -H "Accept: application/json" https://vagrantcloud.com/debian/bookworm64 no longer returns a JSON document, so Vagrant <2.4.0 fails to fetch box metadata (and thus check for updates, get download link, etc.) There are various reports of breakage on https://github.com/hashicorp/vagrant/issues, most notably https://github.com/hashicorp/vagrant/issues/13571 . At this point, it's not clear if this change is intentional, so let's not discuss consequences at this point. I opened a ticket on HashiCorp's ZenDesk (https://support.hashicorp.com/hc/en-us/requests/171591) Lucas
