From 02fe12a144801f1391eedad7415918c6eb4681cf Mon Sep 17 00:00:00 2001
From: Sam Heinz <sam@samheinz.com>
Date: Fri, 24 Jul 2026 16:53:22 +1000
Subject: [PATCH] Pin Alpine apk repositories to targeted version instead of
 latest-stable

---
 misc/alpine-install.func |  7 +++++--
 misc/build.func          | 11 ++++++-----
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/misc/alpine-install.func b/misc/alpine-install.func
index 695a55b1d..b913b65b5 100644
--- a/misc/alpine-install.func
+++ b/misc/alpine-install.func
@@ -147,12 +147,15 @@ update_os() {
     msg_warn "apk update failed (dl-cdn.alpinelinux.org), trying alternate mirrors..."
     local alpine_mirrors="mirror.init7.net ftp.halifax.rwth-aachen.de mirrors.edge.kernel.org alpine.mirror.wearetriple.com mirror.leaseweb.com uk.alpinelinux.org dl-2.alpinelinux.org dl-4.alpinelinux.org"
     local apk_ok=false
+    local alpine_branch
+    alpine_branch="v$(. /etc/os-release 2>/dev/null; printf '%s' "${VERSION_ID:-}" | cut -d. -f1,2)"
+    [ "$alpine_branch" = "v" ] && alpine_branch="latest-stable"
     for m in $(printf '%s\n' $alpine_mirrors | shuf); do
       if timeout 2 bash -c "echo >/dev/tcp/$m/80" 2>/dev/null; then
         msg_custom "${INFO}" "${YW}" "Attempting mirror: ${m}"
         cat <<EOF >/etc/apk/repositories
-http://$m/alpine/latest-stable/main
-http://$m/alpine/latest-stable/community
+http://$m/alpine/${alpine_branch}/main
+http://$m/alpine/${alpine_branch}/community
 EOF
         if $STD apk -U upgrade; then
           msg_ok "CDN set to ${m}: tests passed"
diff --git a/misc/build.func b/misc/build.func
index 9b12cc564..1a2c9487f 100644
--- a/misc/build.func
+++ b/misc/build.func
@@ -4653,9 +4653,10 @@ EOF
   # Continue with standard container setup
   if [ "$var_os" == "alpine" ]; then
     sleep 3
+    local alpine_repo_branch="v${var_version}"
     pct exec "$CTID" -- /bin/sh -c 'cat <<EOF >/etc/apk/repositories
-https://dl-cdn.alpinelinux.org/alpine/latest-stable/main
-https://dl-cdn.alpinelinux.org/alpine/latest-stable/community
+https://dl-cdn.alpinelinux.org/alpine/'"${alpine_repo_branch}"'/main
+https://dl-cdn.alpinelinux.org/alpine/'"${alpine_repo_branch}"'/community
 EOF'
     pct exec "$CTID" -- ash -c 'set -a; [ -f /etc/profile.d/90-http-proxy.sh ] && . /etc/profile.d/90-http-proxy.sh; set +a; apk add bash newt curl openssh nano mc ncurses jq' >>"$BUILD_LOG" 2>&1 || {
       msg_warn "apk install failed (dl-cdn.alpinelinux.org), trying alternate mirrors..."
@@ -4666,11 +4667,11 @@ EOF'
         set +a
         ALPINE_MIRRORS="mirror.init7.net ftp.halifax.rwth-aachen.de mirrors.edge.kernel.org alpine.mirror.wearetriple.com mirror.leaseweb.com uk.alpinelinux.org dl-2.alpinelinux.org dl-4.alpinelinux.org"
         for m in $(printf "%s\n" $ALPINE_MIRRORS | shuf); do
-          if wget -q --spider --timeout=2 "http://$m/alpine/latest-stable/main/" 2>/dev/null; then
+          if wget -q --spider --timeout=2 "http://$m/alpine/'"${alpine_repo_branch}"'/main/" 2>/dev/null; then
             echo "  Attempting mirror: $m"
             cat <<EOF >/etc/apk/repositories
-http://$m/alpine/latest-stable/main
-http://$m/alpine/latest-stable/community
+http://$m/alpine/'"${alpine_repo_branch}"'/main
+http://$m/alpine/'"${alpine_repo_branch}"'/community
 EOF
             if apk update >/dev/null 2>&1 && apk add bash newt curl openssh nano mc ncurses jq >/dev/null 2>&1; then
               echo "  CDN set to $m: tests passed"