avm/hassio-addons
1
0
Fork 0
mirror of https://github.com/alexbelgium/hassio-addons.git synced 2026-09-21 09:14:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix encryption key format and config migration safety in spotify_to_plex

Browse Source 
- Generate ENCRYPTION_KEY as 64 hex chars instead of base64: upstream reads
  it via Buffer.from(ENCRYPTION_KEY, 'hex') for aes-256-cbc, so a base64
  value silently broke Spotify token encryption for anyone leaving the
  option blank (the default path).
- Store the key without a trailing newline and chmod 600 it.
- Only delete /app/config after a successful copy into /config, so a
  failed migration (permissions, disk full) can't silently wipe the
  upstream default config.

Addresses review feedback from PR #2816.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NZTfSk3GQRU7oD85TnjsmW
This commit is contained in:
Claude
2026-07-06 07:14:29 +00:00
parent 725f42932d
commit 00e5e20175
1 changed files with 22 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
spotify_to_plex/rootfs/etc/cont-init.d/99-run.sh
View File

@@ -6,19 +6,30 @@ bashio::log.info "Starting Spotify to Plex"
# Persist the app's /app/config into the HA add-on config dir (/config) # Persist the app's /app/config into the HA add-on config dir (/config)
CONFIG_TARGET="/config" CONFIG_TARGET="/config"
mkdir -p "$CONFIG_TARGET" mkdir -p "$CONFIG_TARGET"
if [ -d /app/config ] && [ ! -L /app/config ]; then
cp -rn /app/config/. "$CONFIG_TARGET/" 2> /dev/null || true
rm -rf /app/config
fi
ln -sfn "$CONFIG_TARGET" /app/config
# Auto-generate a persistent ENCRYPTION_KEY when the user leaves it blank if [ -d /app/config ] && [ ! -L /app/config ]; then
if [ -z "${ENCRYPTION_KEY:-}" ]; then if cp -rn /app/config/. "$CONFIG_TARGET/"; then
if [ -f "$CONFIG_TARGET/.encryption_key" ]; then rm -rf /app/config
ENCRYPTION_KEY="$(cat "$CONFIG_TARGET/.encryption_key")"
else else
ENCRYPTION_KEY="$(head -c 32 /dev/urandom | base64)" bashio::log.error "Failed to migrate /app/config to $CONFIG_TARGET; leaving original config in place"
echo "$ENCRYPTION_KEY" > "$CONFIG_TARGET/.encryption_key" fi
fi
if [ ! -e /app/config ] || [ -L /app/config ]; then
ln -sfn "$CONFIG_TARGET" /app/config
fi
# Auto-generate a persistent ENCRYPTION_KEY when the user leaves it blank.
# Upstream reads this via Buffer.from(ENCRYPTION_KEY, 'hex') for aes-256-cbc,
# so it must be exactly 64 hex characters (not base64).
if [ -z "${ENCRYPTION_KEY:-}" ]; then
KEY_FILE="$CONFIG_TARGET/.encryption_key"
if [ -f "$KEY_FILE" ]; then
ENCRYPTION_KEY="$(cat "$KEY_FILE")"
else
ENCRYPTION_KEY="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
printf '%s' "$ENCRYPTION_KEY" > "$KEY_FILE"
chmod 600 "$KEY_FILE"
bashio::log.info "Generated a new ENCRYPTION_KEY (stored in the add-on config dir)" bashio::log.info "Generated a new ENCRYPTION_KEY (stored in the add-on config dir)"
fi fi
export ENCRYPTION_KEY export ENCRYPTION_KEY