From d7872a824044a5e5b2cc238be395e5ecc3b0914a Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 2 Feb 2026 17:03:02 +0100
Subject: [PATCH] Use temp dir for Web-Vault deployment

Deploy the Web-Vault release into a temporary directory before moving it into /opt/vaultwarden. The change creates a mktemp -d directory, passes that to fetch_and_deploy_gh_release, moves the extracted web-vault into /opt/vaultwarden/web-vault, and removes the temp dir. This prevents partial or mixed artifacts in /opt during the fetch/extract step and keeps the existing ownership/chown behavior.
---
 ct/vaultwarden.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/ct/vaultwarden.sh b/ct/vaultwarden.sh
index ade857bcf..d12cbc979 100644
--- a/ct/vaultwarden.sh
+++ b/ct/vaultwarden.sh
@@ -75,7 +75,10 @@ function update_script() {
       msg_info "Updating Web-Vault to $WVRELEASE"
       rm -rf /opt/vaultwarden/web-vault
 
-      fetch_and_deploy_gh_release "vaultwarden_webvault" "dani-garcia/bw_web_builds" "prebuild" "latest" "/opt/vaultwarden" "bw_web_*.tar.gz"
+      TEMP_DIR=$(mktemp -d)
+      fetch_and_deploy_gh_release "vaultwarden_webvault" "dani-garcia/bw_web_builds" "prebuild" "latest" "$TEMP_DIR" "bw_web_*.tar.gz"
+      mv "$TEMP_DIR/web-vault" /opt/vaultwarden/web-vault
+      rm -rf "$TEMP_DIR"
 
       chown -R root:root /opt/vaultwarden/web-vault/
       msg_ok "Updated Web-Vault to ${WVRELEASE}"