From 296bb3767ada8cfbdfc38f6aa46adfb372af752f Mon Sep 17 00:00:00 2001 From: Alexandre <44178713+alexbelgium@users.noreply.github.com> Date: Sat, 5 Sep 2026 07:47:54 +0200 Subject: [PATCH] fix(linkwarden): stop installing packages Debian 11 no longer serves (#3047) * fix(linkwarden): stop installing packages Debian 11 no longer serves The 2.16.2 updater build failed in the first RUN layer: E: Failed to fetch .../sudo_1.9.5p2-3%2bdeb11u4_amd64.deb 404 Not Found E: Failed to fetch .../vim-runtime_8.2.2434-3%2bdeb11u3_all.deb 404 Not Found Debian 11 reached LTS end on 2026-08-31. Its bullseye-security index is frozen at that date and still lists debs that deb.debian.org no longer serves; sudo is one of them and still 404s on every deb.debian.org edge checked today, so the build fails deterministically rather than transiently. Every package in postgresql-16's own dependency chain that comes from bullseye-security was checked and does fetch, so removing this first install unblocks the build. None of the four packages is needed: - vim was never used by the add-on. - gnupg2 was only there for "gpg --dearmor"; apt reads the ASCII-armoured key from /etc/apt/trusted.gpg.d/postgresql.asc directly. - lsb-release was only there for "lsb_release -cs"; /etc/os-release carries VERSION_CODENAME. - sudo is replaced by su in the Postgres bootstrap, which is what the ente and postgres_15 add-ons already use for the same job. curl is already present in the upstream linkwarden image, so no install step is needed before the PGDG repository is configured. The su rewrite keeps the argv psql receives identical. Because "su -" starts a login shell, the service call now uses an absolute path (the login PATH has no /usr/sbin) and the bootstrap SQL is written to and read from /tmp rather than the script's working directory. Co-Authored-By: Claude Opus 5 * fix(linkwarden): fetch bullseye-security from its origin, not the CDN Dropping vim/gnupg2/lsb-release/sudo got the build past the first RUN, but "apt-get install -y postgresql-16" then 404'd on its own dependencies, on arm64: E: Failed to fetch .../glibc/libc-l10n_2.31-13%2bdeb11u14_all.deb 404 E: Failed to fetch .../exim4/exim4-base_4.94.2-7%2bdeb11u6_arm64.deb 404 E: Failed to fetch .../python3.9/libpython3.9-minimal_3.9.2-1%2bdeb11u7_arm64.deb 404 All three are 200 on security.debian.org, the origin that deb.debian.org is a CDN alias for. The rot is per-file and moves: exim4-base was 404 during the build and 200 minutes later, so retrying is a coin flip rather than a fix. Rewrite the security suite in /etc/apt/sources.list to security.debian.org before "apt-get update". The main suite is left on the CDN; it is intact, and bullseye main is already on archive.debian.org whereas bullseye-security is not. Co-Authored-By: Claude Opus 5 * fix(linkwarden): feed the bootstrap SQL on stdin, and fix two comments Review follow-up on the temp file, the Dockerfile comment and the CHANGELOG wording. The bootstrap SQL no longer goes through a file at all. Both reviewers objected to the predictable root-written /tmp path; passing the statements to psql on stdin removes the file rather than defending it, and is less code than either the version being reviewed or the suggested mktemp. It also restores what the original did before this branch: sudo ran "cat file | psql", so psql read the statements from stdin then too. The Dockerfile comment said "PGDATA repository" where it meant the PGDG apt repository; PGDATA is the data-directory env var set two lines above, so the wording was actively misleading. Co-Authored-By: Claude Opus 5 * chore: record the shipped upstream release in updater.json Each PR publishes an upstream version the updater bot had already selected before CI reverted its commit, but updater.json still recorded the previous one. The updater reads upstream_version as CURRENT and enters its update path whenever it differs from the latest tag, so its next run would process the same release again and derive a synthetic trailing-.1 version, producing a redundant release, a duplicate CHANGELOG entry and a wasted build. These values are exactly what the bot itself wrote in the reverted commit; this restores its own record for a release now being shipped rather than choosing a new one. Co-Authored-By: Claude Opus 5 * fix(linkwarden): keep the Postgres password out of process arguments CodeRabbit flagged that the password appears in the command string of the password-setting call, and that the database-creation call reaches Postgres over a TCP URI carrying the same password with sslmode=prefer. Both predate this branch, but both lines are touched here. Sending each statement to psql on stdin removes the password and the URI from argv, and is shorter than either form it replaces: the escaped-quote nesting on the ALTER USER call disappears with it. The connection method is unchanged for the ALTER USER call, which already went over the local socket as the postgres user. The database-creation call moves from TCP to that same socket. This is safe by construction rather than by assumption: the ALTER USER call runs first under "set -e" with no "|| true", so the container cannot reach the second call unless socket access already worked. Co-Authored-By: Claude Opus 5 --------- Co-authored-by: Claude Opus 5 --- linkwarden/CHANGELOG.md | 6 +++++ linkwarden/Dockerfile | 29 ++++++++++++++++++--- linkwarden/config.yaml | 2 +- linkwarden/rootfs/etc/cont-init.d/99-run.sh | 17 +++++++----- linkwarden/updater.json | 4 +-- 5 files changed, 46 insertions(+), 12 deletions(-) diff --git a/linkwarden/CHANGELOG.md b/linkwarden/CHANGELOG.md index eeab68d221..85c788afe9 100644 --- a/linkwarden/CHANGELOG.md +++ b/linkwarden/CHANGELOG.md @@ -1,4 +1,10 @@ +## 2.16.2 (2026-09-05) +- Update to latest version from linkwarden/linkwarden (changelog : https://github.com/linkwarden/linkwarden/releases) +- Stop installing vim, sudo, gnupg2 and lsb-release at build time. Debian 11 reached LTS end on 2026-08-31 and deb.debian.org no longer serves some of the debs that its frozen bullseye-security index still lists, which is what broke the 2.16.2 build. +- Run the Postgres bootstrap through su instead of sudo, as the ente and postgres_15 add-ons already do +- Fetch the bullseye-security suite from security.debian.org instead of the deb.debian.org CDN, which 404s on debs that suite still lists + ## 2.16.1 (2026-08-22) - Update to latest version from linkwarden/linkwarden (changelog : https://github.com/linkwarden/linkwarden/releases) diff --git a/linkwarden/Dockerfile b/linkwarden/Dockerfile index 5d7d534128..f96844e10a 100644 --- a/linkwarden/Dockerfile +++ b/linkwarden/Dockerfile @@ -30,15 +30,38 @@ ENV S6_CMD_WAIT_FOR_SERVICES=1 \ ENV PGDATA=/config/postgres # Adapt campaign +# +# Nothing is installed from the base image's own Debian suites before the PGDG +# repository is added. Debian 11 reached LTS end on 2026-08-31 and its frozen +# bullseye-security index still lists debs that deb.debian.org no longer serves +# (sudo 1.9.5p2-3+deb11u4 among them), so every avoidable package here is a +# build that fails for reasons unrelated to this add-on: +# - vim was never used by the add-on. +# - sudo is replaced by su in 99-run.sh, matching the ente and postgres_15 +# add-ons. +# - gnupg2 is unnecessary: apt has read ASCII-armoured keys since 1.4. +# - lsb-release is unnecessary: /etc/os-release carries the codename. +# curl is already present in the upstream linkwarden image. +# +# postgresql-16's own dependencies still come from bullseye-security, and +# deb.debian.org serves that suite inconsistently now: libc-l10n, exim4-base and +# libpython3.9-minimal all 404'd there during a build while every one of them was +# 200 on security.debian.org, the origin deb.debian.org is a CDN alias for. Point +# the security suite straight at the origin. If a future base image stops using +# /etc/apt/sources.list this sed fails the build loudly, which is the point: +# whoever rebases it has to revisit this. # hadolint ignore=DL3015 RUN \ # Change data directory mv /data /data_linkwarden && \ \ + # Fetch the security suite from its origin rather than the CDN + sed -i 's|deb.debian.org/debian-security|security.debian.org/debian-security|g' /etc/apt/sources.list && \ + \ # Install postgres - apt-get update && apt-get install vim gnupg2 lsb-release sudo curl -y && \ - curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc| gpg --dearmor -o /etc/apt/trusted.gpg.d/postgresql.gpg && \ - sh -c 'echo "deb https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list' && \ + curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc -o /etc/apt/trusted.gpg.d/postgresql.asc && \ + . /etc/os-release && \ + echo "deb https://apt.postgresql.org/pub/repos/apt ${VERSION_CODENAME}-pgdg main" > /etc/apt/sources.list.d/pgdg.list && \ apt-get update && apt-get install -y postgresql-16 && \ sed -i "/data_directory/c data_directory = '/config/postgres'" /etc/postgresql/*/main/postgresql.conf diff --git a/linkwarden/config.yaml b/linkwarden/config.yaml index 62a3479998..2aae5b049f 100644 --- a/linkwarden/config.yaml +++ b/linkwarden/config.yaml @@ -45,5 +45,5 @@ schema: STORAGE_FOLDER: str? slug: linkwarden url: https://github.com/alexbelgium/hassio-addons/tree/master/linkwarden -version: "2.16.1" +version: "2.16.2" webui: "[PROTO:ssl]://[HOST]:[PORT:3000]" diff --git a/linkwarden/rootfs/etc/cont-init.d/99-run.sh b/linkwarden/rootfs/etc/cont-init.d/99-run.sh index ac20ed97ec..e572198dac 100755 --- a/linkwarden/rootfs/etc/cont-init.d/99-run.sh +++ b/linkwarden/rootfs/etc/cont-init.d/99-run.sh @@ -62,23 +62,28 @@ if [[ "$DATABASE_URL" == *"localhost"* ]]; then # Create folder if [ ! -e /config/postgres/postgresql.conf ]; then echo "... init folder" - sudo -u postgres /usr/lib/postgresql/16/bin/initdb -D /config/postgres + su - postgres -c "/usr/lib/postgresql/16/bin/initdb -D /config/postgres" fi chown -R postgres:postgres /config/postgres chmod 0700 /config/postgres echo "... starting server" - sudo -u postgres service postgresql start + # su - resets PATH to the login default, which has no /usr/sbin + su - postgres -c "/usr/sbin/service postgresql start" sleep 5 echo "... create user and table" + # Both statements go to psql on stdin over the local socket, so neither the + # password nor a connection URI ends up in the process arguments # Set password - sudo -u postgres psql -c "ALTER USER postgres WITH PASSWORD 'homeassistant';" + su - postgres -c 'psql' <<'SQL' +ALTER USER postgres WITH PASSWORD 'homeassistant'; +SQL # Create database if does not exist - echo "CREATE DATABASE linkwarden; GRANT ALL PRIVILEGES ON DATABASE linkwarden to postgres; - \q" > setup_postgres.sql - sudo -u postgres bash -c 'cat setup_postgres.sql | psql "postgres://postgres:homeassistant@localhost:5432"' || true + su - postgres -c 'psql' <<'SQL' || true +CREATE DATABASE linkwarden; GRANT ALL PRIVILEGES ON DATABASE linkwarden to postgres; +SQL fi ######################## diff --git a/linkwarden/updater.json b/linkwarden/updater.json index e4aa3d3161..6a87eb0304 100644 --- a/linkwarden/updater.json +++ b/linkwarden/updater.json @@ -1,8 +1,8 @@ { - "last_update": "2026-08-22", + "last_update": "2026-09-05", "repository": "alexbelgium/hassio-addons", "slug": "linkwarden", "source": "github", "upstream_repo": "linkwarden/linkwarden", - "upstream_version": "2.16.1" + "upstream_version": "2.16.2" }