Pin PG10 Debian repositories to a consistent snapshot (v0.16.2)

Use the 2026-09-01 Debian snapshot for the PostgreSQL 10 test image so archived security indexes and package files remain available together. Preserve APT signature verification and document the snapshot configuration.

Author: O2eg

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pg-diag"
-version = "0.16.1"
+version = "0.16.2"
 description = "PostgreSQL diagnostics with host metrics and portable JSON/HTML reports"
 readme = "README.md"
 requires-python = ">=3.10"

src/pg_diag/__init__.py

@@ -1,3 +1,3 @@
 """pg_diag package."""
 
-__version__ = "0.16.1"
+__version__ = "0.16.2"

tests/README.md

@@ -165,10 +165,12 @@ utilities, and the matching `postgresql-<major>-pg-wait-sampling` package. Set
 The PostgreSQL 10 image intentionally retains Bullseye's legacy
 `lshw 02.18.x` and `sysstat/iostat 12.5.x`; the test asserts those package
 generations so compatibility is not accidentally proved with newer binaries.
-Bullseye LTS ended on 2026-08-31. For the PostgreSQL 10 test image only, the
-frozen `bullseye-security` source uses `check-valid-until=no`; APT signature
-verification remains enabled. Other package sources and PostgreSQL majors
-retain their normal expiry checks.
+Bullseye LTS ended on 2026-08-31. The PostgreSQL 10 test image pins its Debian
+repositories (`bullseye`, `bullseye-updates`, and `bullseye-security`) to the
+`20260901T000000Z` snapshot on `snapshot.debian.org`, keeping indexes and package
+files consistent when live mirrors remove old packages. These snapshot sources
+use `check-valid-until=no`; APT signature verification remains enabled. The PGDG
+source and PostgreSQL 11-18 images retain their existing repository configuration.
 
 For every PostgreSQL major, one module-scoped container is prepared and reused
 by both report tests. Preparation is mandatory and verifies all of the

tests/integration/docker/Dockerfile

@@ -3,10 +3,14 @@ FROM postgres:${PG_IMAGE_TAG}
 
 ARG PG_MAJOR
 
-# Bullseye LTS ended on 2026-08-31; PG10 needs its frozen security index.
-# Relax only that index's expiry check, retaining signature verification.
+# Keep PG10's legacy packages and their indexes together after Bullseye LTS.
+# Snapshot expiry is expected; APT signature verification remains enabled.
 RUN if [ "$PG_MAJOR" = "10" ]; then \
-        sed -i '/^deb .* bullseye-security /s/^deb /deb [check-valid-until=no] /' /etc/apt/sources.list; \
+        printf '%s\n' \
+            'deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20260901T000000Z/ bullseye main' \
+            'deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20260901T000000Z/ bullseye-updates main' \
+            'deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/20260901T000000Z/ bullseye-security main' \
+            > /etc/apt/sources.list; \
     fi \
     && apt-get update \
     && apt-get install -y --no-install-recommends \