Fixes, most of them found in a read-through of the whole code base rather than in use.
Your Home Assistant token stops leaving the house. The slideshow sent the device's long-lived
token with every photo it fetched, including to hosts you do not run — Jellyfin, Plex, Synology
Photos, a cloud photo service. That token opens the whole Home Assistant API. Only your own Home
Assistant is given it now. If you have ever run a slideshow from an external media source, consider
the token spent and issue a new one.
The wake word is heard while music is playing. Echo-cancelled audio was handed to the wake word
engines in a buffer that the next frame overwrote, so an engine a frame or two behind scored the
newest audio twice and never saw what it missed — worst exactly when the canceller is working, which
is when something is playing.
The camera stops writing itself off. Starting the camera again while it was still shutting down
opened the sensor twice, and when the driver answered EIO the camera was marked unusable until the
device rebooted. A restart now waits for the stop to finish. A still no longer reports an error left
behind by an earlier failed start.
Update cards that could never be cleared. A release could publish a version Home Assistant
cannot rank, and a device without a version stamp reported one too; both left an update card that no
install would settle. Both are refused now, at the release and at the device.
Updates arrive under this project's name, not EchoLocal's — the name of the project this daemon
was forked from, which was still on every update card.
Privacy and security
- A key file that cannot be read no longer starts the API unauthenticated. Only a key that is not
there means an unprovisioned device. - IPv6 addresses in the diagnostics bundle are redacted in the form Linux actually prints them, so a
compressed address or a delegated prefix no longer goes out in a bundle that says addresses were
replaced. - A device's IPv6 address no longer contains its MAC. Addresses take a random identifier instead,
which takes effect at the next reboot. - An SSH key whose body does not match the type in front of it is refused when it is set, instead of
being stored, reported as installed, and then ignored at every login. - The daemon checks the keys it saved are in the file the SSH server actually reads, repairs that
when it can, and says so in the log when it cannot.
Installers now check the release signature before they trust the manifest, using the same key the
device's own updater trusts. They said "signed" before and only checked the checksums.
Verify this release was built by CI from its own tag:
gh attestation verify echod-arm --repo HuskerMinion/techo5 --source-ref refs/tags/v0.7.14