Long Term Debian ISO mirror

[good_truffle]

So I'm wondering if there's a public link to a debian ISO that won't change in content or name over the lifetime of an entire release. The 'latest' release URL is sure handy for manually DLing the latest Debian which is obviously what anyone in their right mind would recommend. But I'm integrating with a software called `packer` that wants a URL and a SHA256 checksum in order to DL and cache a version of Debian, before conducting automated installation/ configurations (including package updates, etc.) on a VM and then export that image for deployment elsewhere. For a long while, pointing at https://cdimage.debian.org/mirror/cdima ... e-CD-1.iso worked like a charm (and since I have it cached, it still technically works. But that link stopped working some time over the past year.

There's lots I'm curious about here: do mirrors intentionally invalidate URLs if, say, there's a CVE issued against the Kernel; do mirrors only keep ISOs n minor releases in the past; is there a secret URL somewhere that I could use instead of the 9.0.0 version I went after? The issue this raises is really that it creates 'tech debt' for anyone building VM images. Over time, their projects will no longer build successfully. If it's a project that is their top priority, obviously this is a minor issue, but it becomes a major issue for devs who have lots of other projects that they're trying to wrangle simultaneously and also creates an issue for others as they attempt to run the project and it fails.

Also, hello everyone, it's my Debian Forums firstie!

[ruwolf]

I think it is specific question for https://wiki.debian.org/Teams/DebianCd

[Head_on_a_Stick]

https://cdimage.debian.org/mirror/cdimage/archive/