[bug]: pkg.claude-desktop-debian.dev is unaccessible

[vbatts]

Version (claude-desktop --doctor output)

This error began around 2026-04-22

Err:9 https://aaddrick.github.io/claude-desktop-debian stable Release                                                                
  Redirection from https to 'http://pkg.claude-desktop-debian.dev/dists/stable/Release' is forbidden [IP: 2606:50c0:8002::153 443]

What happened

the host for the debian repo is returning 400 errors

Steps to reproduce

apt update

Expected behavior

successfully checking for updated builds of this claude-desktop project

Logs / errors

Anything else

No response

[github-actions]

Automated draft — AI analysis, not maintainer judgment. This bot won't close issues, apply labels beyond triage routing, or claim fixes are shipped. Findings below are starting points; the code citations are what to verify first.

Looks like the apt update failure is a known, documented side effect of the Phase 4a Worker migration — users whose sources.list still points at the legacy aaddrick.github.io URL hit a GitHub Pages 301 that emits http:// in the Location header, which APT refuses as a security downgrade, and the fix is a one-liner already in the README.

• Looks like the redirect chain for users on the legacy https://aaddrick.github.io/claude-desktop-debian sources.list URL passes through a GitHub Pages 301 that emits http:// (not https://) in the Location header, and APT then refuses this scheme downgrade with the exact error the reporter sees (docs/learnings/apt-worker-architecture.md:38-50)
• Appears to be that GitHub Pages emits http:// in its 301 Location header because https_enforced cannot be enabled — Pages cannot provision a Let's Encrypt cert for pkg.claude-desktop-debian.dev while Cloudflare's Worker custom_domain = true owns the DNS record and blocks the HTTP-01 ACME challenge (docs/learnings/apt-worker-architecture.md:74-90)
• Looks like custom_domain = true in wrangler.toml causes Cloudflare to auto-create and own the DNS record for pkg.claude-desktop-debian.dev, which is why GitHub Pages can never complete domain verification and is forced to emit http:// in its redirect (worker/wrangler.toml:17-17)
• Appears to be that APT's rejection of the https→http redirect is a non-configurable security policy, meaning any user still pointing at the legacy aaddrick.github.io URL will see the error until they update sources.list (docs/learnings/apt-worker-architecture.md:92-95)
• Looks like the user-facing migration fix is already documented in the README, including a sed one-liner that updates sources.list to point directly at https://pkg.claude-desktop-debian.dev and bypass the GitHub Pages hop that introduces the scheme downgrade (README.md:71-77)
• Worth checking first: the known-gotchas section of the architecture learnings doc explicitly records that APT's https→http redirect refusal is non-configurable and that affected users must migrate sources.list, indicating this was an anticipated side effect of the Phase 4a Worker migration (docs/learnings/apt-worker-architecture.md:183-185)

Related: #493 — related

Full investigation artifacts (investigation.json, validation.json) are attached to the triage workflow run.

[aaddrick]

Hey @vbatts, this is the legacy URL hitting the scheme-downgrade refusal that came in with the Phase 4a Worker migration (#493 / #498 / #514). #519 is the same root cause.

What's happening: the old aaddrick.github.io/claude-desktop-debian path 301s to pkg.claude-desktop-debian.dev, but GitHub Pages emits http:// in the Location header because it can't issue a TLS cert for that hostname (Cloudflare owns the DNS via the Worker's custom_domain = true). apt refuses https→http redirects as a security policy, so the update bails before it ever reaches the Worker.

The fix is a sources.list update. Running this should resolve it:

sudo sed -i 's|https://aaddrick\.github\.io/claude-desktop-debian|https://pkg.claude-desktop-debian.dev|g' \
  /etc/apt/sources.list.d/claude-desktop.list
sudo apt update

See Migrating from the old aaddrick.github.io URL for the full background. Next on my list is reworking the bug-report template so anyone hitting this gets pointed at the migration before they file — your report (and #519) is what surfaced that gap. Can you confirm the migration worked on your end? Then we can close this out.

[raven223344]

Hi,

same issue here On Mint 22.3.

W: Failed to fetch https://pkg.claude-desktop-debian.dev/dists/stable/InRelease Could not resolve 'pkg.claude-desktop-debian.dev' W: Some index files failed to download. They have been ignored, or old ones used instead.

I did what you said above but didn't help.

What could be the issue?

Thanks.

[kagebarton]

I'm stuck on the same error even after the migration fix as well.

[aaddrick]

Hey!

Can you run resolvectl status or nmcli dev show | grep DNS and let me know if you see 9.9.9.9 listed?

New domain serving over apt got flagged by ThreatSTOP and anyone using Quad9 DNS will fail to resolve.

Ticket submitted to Quad9 and ThreatSTOP, ThreatSTOP has cleared the issue on their side and we're just waiting for propagation to Quad9.

You can flip your DNS to 9.9.9.10 temporarily to hit Quad9's non-filtering DNS if you're in a pinch, but I'm not a huge fan of the concept.

No timeline currently. I expect another day or two based on strangers on the Internet.

Discussion: #521

Tracking: #524

[kagebarton]

They show my router address but I do use 9.9.9.9 on my router. I'll wait a few days and let you know. Thanks!

[vbatts]

thanks @aaddrick