diff --git a/baikal/CHANGELOG.md b/baikal/CHANGELOG.md index 329f9ce49c..18037c515b 100644 --- a/baikal/CHANGELOG.md +++ b/baikal/CHANGELOG.md @@ -1,3 +1,10 @@ +## 0.12.1 (2026-09-03) + +- Update to Baikal 0.12.1 from 0.10.1 (changelog : ). This includes the 0.12.1 fix for an XSS vulnerability that let an authenticated user take over the admin interface by renaming a calendar +- ⚠ After the update, open the Baikal web admin once : Baikal asks to confirm the upgrade before it serves calendars again +- The application is now taken from the release published by sabre-io instead of from the ckulka/baikal-docker image, which stopped at 0.10.1. The base image still provides nginx, php-fpm and msmtp. Automatic version tracking is enabled again, following sabre-io/Baikal +- The Baikal application files in the addon data folder are now replaced on every start instead of being kept. Calendars, contacts, users and the Baikal configuration are untouched ; any manual edit made inside the application folders themselves is lost + - The Home Assistant project has deprecated support for the armv7, armhf and i386 architectures. Support wil be fully dropped in the upcoming Home Assistant 2025.12 release ## 0.10.1-hafix4 (2025-11-18) diff --git a/baikal/Dockerfile b/baikal/Dockerfile index 741468f8d4..51323db5c1 100644 --- a/baikal/Dockerfile +++ b/baikal/Dockerfile @@ -16,7 +16,19 @@ ARG BUILD_FROM ARG BUILD_VERSION -ARG BUILD_UPSTREAM="0.10.1+hafix" +ARG BUILD_UPSTREAM="0.12.1" + +# ckulka/baikal-docker, which builds the base image, stopped publishing new +# Baikal versions at 0.10.1 : the base image is used for its runtime only +# (nginx, php-fpm, msmtp) and the application comes from the release published +# by sabre-io itself +FROM alpine:3.21 AS baikal +ARG BUILD_UPSTREAM +RUN apk add --no-cache curl unzip \ + && curl -f -s -S -L -o /tmp/baikal.zip "https://github.com/sabre-io/Baikal/releases/download/${BUILD_UPSTREAM}/baikal-${BUILD_UPSTREAM}.zip" \ + && unzip -q /tmp/baikal.zip -d / \ + && rm /tmp/baikal.zip + FROM ${BUILD_FROM} ################## @@ -28,6 +40,24 @@ ENV S6_CMD_WAIT_FOR_SERVICES=1 \ S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 \ S6_SERVICES_GRACETIME=0 +# Ship the Baikal release instead of the one bundled in the base image +RUN rm -rf /var/www/baikal +COPY --from=baikal --chown=nginx:nginx /baikal /var/www/baikal + +# Home Assistant asks for an expanded time range, and Baikal stores +# cal:calendar-timezone as a bare timezone name rather than as the VTIMEZONE +# object sabre/dav expects, so sabre/dav raises a ParseException and answers +# 500 (sabre-io/Baikal#1241 and sabre-io/dav#1318, both still open). Read the +# value as a timezone name instead. The two checks turn a release that moved +# this code into a failed build rather than into an addon that Home Assistant +# cannot read. +# hadolint ignore=SC2016 +RUN \ + DAVPLUGIN="/var/www/baikal/vendor/sabre/dav/lib/CalDAV/Plugin.php" \ + && sed -i '/^ \/\/ This property contains a VCALENDAR with a single$/,/^ \$vtimezoneObj->destroy();$/c\ $calendarTimeZone = new DateTimeZone($tzResult[$tzProp]);' "$DAVPLUGIN" \ + && grep -qxF ' $calendarTimeZone = new DateTimeZone($tzResult[$tzProp]);' "$DAVPLUGIN" \ + && ! grep -qxF ' $calendarTimeZone = $vtimezoneObj->VTIMEZONE->getTimeZone();' "$DAVPLUGIN" + # Image specific modifications # hadolint ignore=SC2015, SC2013, SC2086 RUN \ diff --git a/baikal/README.md b/baikal/README.md index 6eba6a443f..019e9ed54c 100644 --- a/baikal/README.md +++ b/baikal/README.md @@ -33,7 +33,9 @@ _Thanks to everyone having starred my repo! To star it click on the image below, --- [Baikal](https://sabre.io/baikal/) is a lightweight CalDAV+CardDAV server. It offers an extensive web interface with easy management of users, address books and calendars. It is fast and simple to install and only needs a basic php capable server. The data can be stored in a MySQL or a SQLite database. -It is based on the docker image : https://github.com/ckulka/baikal-docker +It ships the release published by [sabre-io](https://github.com/sabre-io/Baikal/releases), running on the nginx and php-fpm image built by . + +After an update of Baikal itself, open the web admin once : Baikal asks to confirm the upgrade before it serves calendars again. Calendars, contacts, users and the Baikal configuration are kept, but a manual edit made inside the application folders themselves is replaced on every start. ## Configuration diff --git a/baikal/build.json b/baikal/build.json index fd93fd6cfb..b379a5b7d6 100644 --- a/baikal/build.json +++ b/baikal/build.json @@ -1,6 +1,6 @@ { "build_from": { - "aarch64": "ghcr.io/mralucarddante/baikal-docker-hass:latest", - "amd64": "ghcr.io/mralucarddante/baikal-docker-hass:latest" + "aarch64": "ckulka/baikal:nginx-php8.2", + "amd64": "ckulka/baikal:nginx-php8.2" } } diff --git a/baikal/config.yaml b/baikal/config.yaml index 94ff2b3306..1ee7a636fa 100644 --- a/baikal/config.yaml +++ b/baikal/config.yaml @@ -84,5 +84,5 @@ schema: slug: baikal udev: true url: https://github.com/alexbelgium/hassio-addons -version: 0.10.1-hafix4 +version: "0.12.1" webui: "[PROTO:ssl]://[HOST]:[PORT:80]" diff --git a/baikal/rootfs/etc/cont-init.d/90-run.sh b/baikal/rootfs/etc/cont-init.d/90-run.sh index 84f9e684ef..6f6bdada89 100755 --- a/baikal/rootfs/etc/cont-init.d/90-run.sh +++ b/baikal/rootfs/etc/cont-init.d/90-run.sh @@ -1,7 +1,21 @@ #!/bin/bash +set -e -# Copy data -cp -rnf /var/www/baikal/* /data/ +# Baikal keeps its database in Specific and its configuration in config. The +# release ships both as empty folders, so they are created here rather than +# copied, and are then left alone : they hold the user's data +mkdir -p /data/config /data/Specific/db + +# Everything else is application code, and is replaced on every start so that a +# rebuilt image actually replaces the code that is served +for item in /var/www/baikal/*; do + name="$(basename "$item")" + case "$name" in + Specific | config) continue ;; + esac + rm -rf "/data/$name" + cp -rf "$item" /data/ +done # Fix permissions chown -R nginx:nginx /data diff --git a/baikal/updater.json b/baikal/updater.json index 55d37a8374..557b25b1ff 100644 --- a/baikal/updater.json +++ b/baikal/updater.json @@ -1,9 +1,9 @@ { - "github_exclude": "+", - "last_update": "26-04-2025", + "github_beta": "false", + "last_update": "2026-09-03", "repository": "alexbelgium/hassio-addons", "slug": "baikal", "source": "github", - "upstream_repo": "ckulka/baikal-docker", - "upstream_version": "0.10.1" + "upstream_repo": "sabre-io/Baikal", + "upstream_version": "0.12.1" }