fix(linkwarden): stop installing packages Debian 11 no longer serves (#3047)

* fix(linkwarden): stop installing packages Debian 11 no longer serves

The 2.16.2 updater build failed in the first RUN layer:

  E: Failed to fetch .../sudo_1.9.5p2-3%2bdeb11u4_amd64.deb  404  Not Found
  E: Failed to fetch .../vim-runtime_8.2.2434-3%2bdeb11u3_all.deb  404  Not Found

Debian 11 reached LTS end on 2026-08-31. Its bullseye-security index is frozen
at that date and still lists debs that deb.debian.org no longer serves; sudo is
one of them and still 404s on every deb.debian.org edge checked today, so the
build fails deterministically rather than transiently. Every package in
postgresql-16's own dependency chain that comes from bullseye-security was
checked and does fetch, so removing this first install unblocks the build.

None of the four packages is needed:

  - vim was never used by the add-on.
  - gnupg2 was only there for "gpg --dearmor"; apt reads the ASCII-armoured key
    from /etc/apt/trusted.gpg.d/postgresql.asc directly.
  - lsb-release was only there for "lsb_release -cs"; /etc/os-release carries
    VERSION_CODENAME.
  - sudo is replaced by su in the Postgres bootstrap, which is what the ente and
    postgres_15 add-ons already use for the same job.

curl is already present in the upstream linkwarden image, so no install step is
needed before the PGDG repository is configured.

The su rewrite keeps the argv psql receives identical. Because "su -" starts a
login shell, the service call now uses an absolute path (the login PATH has no
/usr/sbin) and the bootstrap SQL is written to and read from /tmp rather than
the script's working directory.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(linkwarden): fetch bullseye-security from its origin, not the CDN

Dropping vim/gnupg2/lsb-release/sudo got the build past the first RUN, but
"apt-get install -y postgresql-16" then 404'd on its own dependencies, on arm64:

  E: Failed to fetch .../glibc/libc-l10n_2.31-13%2bdeb11u14_all.deb          404
  E: Failed to fetch .../exim4/exim4-base_4.94.2-7%2bdeb11u6_arm64.deb       404
  E: Failed to fetch .../python3.9/libpython3.9-minimal_3.9.2-1%2bdeb11u7_arm64.deb  404

All three are 200 on security.debian.org, the origin that deb.debian.org is a
CDN alias for. The rot is per-file and moves: exim4-base was 404 during the
build and 200 minutes later, so retrying is a coin flip rather than a fix.

Rewrite the security suite in /etc/apt/sources.list to security.debian.org
before "apt-get update". The main suite is left on the CDN; it is intact, and
bullseye main is already on archive.debian.org whereas bullseye-security is not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(linkwarden): feed the bootstrap SQL on stdin, and fix two comments

Review follow-up on the temp file, the Dockerfile comment and the CHANGELOG
wording.

The bootstrap SQL no longer goes through a file at all. Both reviewers objected
to the predictable root-written /tmp path; passing the statements to psql on
stdin removes the file rather than defending it, and is less code than either
the version being reviewed or the suggested mktemp. It also restores what the
original did before this branch: sudo ran "cat file | psql", so psql read the
statements from stdin then too.

The Dockerfile comment said "PGDATA repository" where it meant the PGDG apt
repository; PGDATA is the data-directory env var set two lines above, so the
wording was actively misleading.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore: record the shipped upstream release in updater.json

Each PR publishes an upstream version the updater bot had already selected
before CI reverted its commit, but updater.json still recorded the previous one.
The updater reads upstream_version as CURRENT and enters its update path
whenever it differs from the latest tag, so its next run would process the same
release again and derive a synthetic trailing-.1 version, producing a redundant
release, a duplicate CHANGELOG entry and a wasted build.

These values are exactly what the bot itself wrote in the reverted commit; this
restores its own record for a release now being shipped rather than choosing a
new one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(linkwarden): keep the Postgres password out of process arguments

CodeRabbit flagged that the password appears in the command string of the
password-setting call, and that the database-creation call reaches Postgres over
a TCP URI carrying the same password with sslmode=prefer. Both predate this
branch, but both lines are touched here.

Sending each statement to psql on stdin removes the password and the URI from
argv, and is shorter than either form it replaces: the escaped-quote nesting on
the ALTER USER call disappears with it.

The connection method is unchanged for the ALTER USER call, which already went
over the local socket as the postgres user. The database-creation call moves
from TCP to that same socket. This is safe by construction rather than by
assumption: the ALTER USER call runs first under "set -e" with no "|| true", so
the container cannot reach the second call unless socket access already worked.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

linkwarden/CHANGELOG.md

@@ -1,4 +1,10 @@
  
+## 2.16.2 (2026-09-05)
+- Update to latest version from linkwarden/linkwarden (changelog : https://github.com/linkwarden/linkwarden/releases)
+- Stop installing vim, sudo, gnupg2 and lsb-release at build time. Debian 11 reached LTS end on 2026-08-31 and deb.debian.org no longer serves some of the debs that its frozen bullseye-security index still lists, which is what broke the 2.16.2 build.
+- Run the Postgres bootstrap through su instead of sudo, as the ente and postgres_15 add-ons already do
+- Fetch the bullseye-security suite from security.debian.org instead of the deb.debian.org CDN, which 404s on debs that suite still lists
+ 
 ## 2.16.1 (2026-08-22)
 - Update to latest version from linkwarden/linkwarden (changelog : https://github.com/linkwarden/linkwarden/releases)
  

linkwarden/Dockerfile

@@ -30,15 +30,38 @@ ENV S6_CMD_WAIT_FOR_SERVICES=1 \
 
 ENV PGDATA=/config/postgres
 # Adapt campaign
+#
+# Nothing is installed from the base image's own Debian suites before the PGDG
+# repository is added. Debian 11 reached LTS end on 2026-08-31 and its frozen
+# bullseye-security index still lists debs that deb.debian.org no longer serves
+# (sudo 1.9.5p2-3+deb11u4 among them), so every avoidable package here is a
+# build that fails for reasons unrelated to this add-on:
+#   - vim was never used by the add-on.
+#   - sudo is replaced by su in 99-run.sh, matching the ente and postgres_15
+#     add-ons.
+#   - gnupg2 is unnecessary: apt has read ASCII-armoured keys since 1.4.
+#   - lsb-release is unnecessary: /etc/os-release carries the codename.
+# curl is already present in the upstream linkwarden image.
+#
+# postgresql-16's own dependencies still come from bullseye-security, and
+# deb.debian.org serves that suite inconsistently now: libc-l10n, exim4-base and
+# libpython3.9-minimal all 404'd there during a build while every one of them was
+# 200 on security.debian.org, the origin deb.debian.org is a CDN alias for. Point
+# the security suite straight at the origin. If a future base image stops using
+# /etc/apt/sources.list this sed fails the build loudly, which is the point:
+# whoever rebases it has to revisit this.
 # hadolint ignore=DL3015
 RUN \
     # Change data directory
     mv /data /data_linkwarden && \
     \
+    # Fetch the security suite from its origin rather than the CDN
+    sed -i 's|deb.debian.org/debian-security|security.debian.org/debian-security|g' /etc/apt/sources.list && \
+    \
     # Install postgres
-    apt-get update && apt-get install vim gnupg2 lsb-release sudo curl -y && \
-    curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc| gpg --dearmor -o /etc/apt/trusted.gpg.d/postgresql.gpg && \
-    sh -c 'echo "deb https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list' && \
+    curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc -o /etc/apt/trusted.gpg.d/postgresql.asc && \
+    . /etc/os-release && \
+    echo "deb https://apt.postgresql.org/pub/repos/apt ${VERSION_CODENAME}-pgdg main" > /etc/apt/sources.list.d/pgdg.list && \
     apt-get update && apt-get install -y postgresql-16 && \
     sed -i "/data_directory/c data_directory = '/config/postgres'" /etc/postgresql/*/main/postgresql.conf
 

linkwarden/config.yaml

@@ -45,5 +45,5 @@ schema:
   STORAGE_FOLDER: str?
 slug: linkwarden
 url: https://github.com/alexbelgium/hassio-addons/tree/master/linkwarden
-version: "2.16.1"
+version: "2.16.2"
 webui: "[PROTO:ssl]://[HOST]:[PORT:3000]"

linkwarden/rootfs/etc/cont-init.d/99-run.sh

@@ -62,23 +62,28 @@ if [[ "$DATABASE_URL" == *"localhost"* ]]; then
     # Create folder
     if [ ! -e /config/postgres/postgresql.conf ]; then
         echo "... init folder"
-        sudo -u postgres /usr/lib/postgresql/16/bin/initdb -D /config/postgres
+        su - postgres -c "/usr/lib/postgresql/16/bin/initdb -D /config/postgres"
     fi
     chown -R postgres:postgres /config/postgres
     chmod 0700 /config/postgres
 
     echo "... starting server"
-    sudo -u postgres service postgresql start
+    # su - resets PATH to the login default, which has no /usr/sbin
+    su - postgres -c "/usr/sbin/service postgresql start"
     sleep 5
 
     echo "... create user and table"
+    # Both statements go to psql on stdin over the local socket, so neither the
+    # password nor a connection URI ends up in the process arguments
     # Set password
-    sudo -u postgres psql -c "ALTER USER postgres WITH PASSWORD 'homeassistant';"
+    su - postgres -c 'psql' <<'SQL'
+ALTER USER postgres WITH PASSWORD 'homeassistant';
+SQL
 
     # Create database if does not exist
-    echo "CREATE DATABASE linkwarden; GRANT ALL PRIVILEGES ON DATABASE linkwarden to postgres;
-    \q" > setup_postgres.sql
-    sudo -u postgres bash -c 'cat setup_postgres.sql | psql "postgres://postgres:homeassistant@localhost:5432"' || true
+    su - postgres -c 'psql' <<'SQL' || true
+CREATE DATABASE linkwarden; GRANT ALL PRIVILEGES ON DATABASE linkwarden to postgres;
+SQL
 fi
 
 ########################

linkwarden/updater.json

@@ -1,8 +1,8 @@
 {
-  "last_update": "2026-08-22",
+  "last_update": "2026-09-05",
   "repository": "alexbelgium/hassio-addons",
   "slug": "linkwarden",
   "source": "github",
   "upstream_repo": "linkwarden/linkwarden",
-  "upstream_version": "2.16.1"
+  "upstream_version": "2.16.2"
 }