Pin Alpine apk repositories to targeted version instead of latest-stable

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -505,6 +505,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-07-23
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - update authentik to 2026.5.6 [@thieneret](https://github.com/thieneret) ([#15973](https://github.com/community-scripts/ProxmoxVE/pull/15973))
+
 ## 2026-07-22
 
 ### 🆕 New Scripts

ct/authentik.sh

@@ -43,7 +43,7 @@ function update_script() {
   RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
   setup_yq
 
-  AUTHENTIK_VERSION="version/2026.5.5"
+  AUTHENTIK_VERSION="version/2026.5.6"
   # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
   XMLSEC_VERSION="1.3.12"
 
@@ -105,7 +105,7 @@ function update_script() {
     $STD go build -o /opt/authentik/radius ./cmd/radius
     msg_ok "Updated go proxy"
 
-    msg_info "Building worker"
+    msg_info "Building worker. It may take more than 10 minutes, please be patient."
     export AWS_LC_FIPS_SYS_CC="clang"
     cd /opt/authentik
     $STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1

install/authentik-install.sh

@@ -59,7 +59,7 @@ PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 
 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.5.5"
+AUTHENTIK_VERSION="version/2026.5.6"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
@@ -109,7 +109,7 @@ EOF
 
 echo "#39 19 * * 6,4 /usr/bin/geoipupdate -f /usr/local/etc/GeoIP.conf" | crontab -
 
-msg_info "Building worker"
+msg_info "Building worker. It may take more than 10 minutes, please be patient."
 export AWS_LC_FIPS_SYS_CC="clang"
 cd /opt/authentik
 $STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1

misc/alpine-install.func

@@ -147,12 +147,15 @@ update_os() {
     msg_warn "apk update failed (dl-cdn.alpinelinux.org), trying alternate mirrors..."
     local alpine_mirrors="mirror.init7.net ftp.halifax.rwth-aachen.de mirrors.edge.kernel.org alpine.mirror.wearetriple.com mirror.leaseweb.com uk.alpinelinux.org dl-2.alpinelinux.org dl-4.alpinelinux.org"
     local apk_ok=false
+    local alpine_branch
+    alpine_branch="v$(. /etc/os-release 2>/dev/null; printf '%s' "${VERSION_ID:-}" | cut -d. -f1,2)"
+    [ "$alpine_branch" = "v" ] && alpine_branch="latest-stable"
     for m in $(printf '%s\n' $alpine_mirrors | shuf); do
       if timeout 2 bash -c "echo >/dev/tcp/$m/80" 2>/dev/null; then
         msg_custom "${INFO}" "${YW}" "Attempting mirror: ${m}"
         cat <<EOF >/etc/apk/repositories
-http://$m/alpine/latest-stable/main
-http://$m/alpine/latest-stable/community
+http://$m/alpine/${alpine_branch}/main
+http://$m/alpine/${alpine_branch}/community
 EOF
         if $STD apk -U upgrade; then
           msg_ok "CDN set to ${m}: tests passed"

misc/build.func

@@ -4653,9 +4653,10 @@ EOF
   # Continue with standard container setup
   if [ "$var_os" == "alpine" ]; then
     sleep 3
+    local alpine_repo_branch="v${var_version}"
     pct exec "$CTID" -- /bin/sh -c 'cat <<EOF >/etc/apk/repositories
-https://dl-cdn.alpinelinux.org/alpine/latest-stable/main
-https://dl-cdn.alpinelinux.org/alpine/latest-stable/community
+https://dl-cdn.alpinelinux.org/alpine/'"${alpine_repo_branch}"'/main
+https://dl-cdn.alpinelinux.org/alpine/'"${alpine_repo_branch}"'/community
 EOF'
     pct exec "$CTID" -- ash -c 'set -a; [ -f /etc/profile.d/90-http-proxy.sh ] && . /etc/profile.d/90-http-proxy.sh; set +a; apk add bash newt curl openssh nano mc ncurses jq' >>"$BUILD_LOG" 2>&1 || {
       msg_warn "apk install failed (dl-cdn.alpinelinux.org), trying alternate mirrors..."
@@ -4666,11 +4667,11 @@ EOF'
         set +a
         ALPINE_MIRRORS="mirror.init7.net ftp.halifax.rwth-aachen.de mirrors.edge.kernel.org alpine.mirror.wearetriple.com mirror.leaseweb.com uk.alpinelinux.org dl-2.alpinelinux.org dl-4.alpinelinux.org"
         for m in $(printf "%s\n" $ALPINE_MIRRORS | shuf); do
-          if wget -q --spider --timeout=2 "http://$m/alpine/latest-stable/main/" 2>/dev/null; then
+          if wget -q --spider --timeout=2 "http://$m/alpine/'"${alpine_repo_branch}"'/main/" 2>/dev/null; then
             echo "  Attempting mirror: $m"
             cat <<EOF >/etc/apk/repositories
-http://$m/alpine/latest-stable/main
-http://$m/alpine/latest-stable/community
+http://$m/alpine/'"${alpine_repo_branch}"'/main
+http://$m/alpine/'"${alpine_repo_branch}"'/community
 EOF
             if apk update >/dev/null 2>&1 && apk add bash newt curl openssh nano mc ncurses jq >/dev/null 2>&1; then
               echo "  CDN set to $m: tests passed"