Skip to content

0.1.20

Latest
Latest

Choose a tag to compare

View all tags
@dgprivate dgprivate released this 22 Aug 21:12
· 7 commits to main since this release
v0.1.20
b35eb9b

Two additions, and both were checked rather than asserted.

services:
  kronoterm2mqtt:
    image: hausbit/kronoterm2mqtt:0.1.20

Home Assistant add-on

Home Assistant OS and Supervised installations can install this from an add-on repository instead of running a container by hand: Settings → Add-ons → Add-on store → ⋮ → Repositories, add https://github.com/dgprivate/kronoterm2mqtt, install kronoterm2mqtt.

  • Every setting is on the Configuration tab — MQTT, TLS, the heat pump, the health endpoint, and all of the custom expander including its lists. A test walks the settings dataclasses and fails if the manifest misses one, and a second fails if it offers something the app does not know.
  • The broker fills itself in. use_supervisor takes the address and credentials from the Mosquitto add-on, because Home Assistant already knows them.
  • Still unprivileged. The entrypoint starts as root to write /data, then drops to UID 65532 before starting the app.
  • Watched. The Supervisor polls the same health endpoint the container health check uses, and restarts the add-on when it stops answering.

Documentation for every option is in ha-addon/DOCS.md.

Fuzzing

Three Atheris targets over the input the project does not control — the health report read off a socket, the settings file edited by hand, and the bytes a Modbus gateway sends — run per pull request and weekly, with the corpus cached so coverage accumulates. See fuzz/README.md.

It found two defects in the health command in its first two runs, both fixed here with the inputs pinned as tests:

  • a report missing the keys the command expects — an older container, a truncated answer, or something else on that port — ended in a KeyError traceback instead of a status
  • a report value containing square brackets, which a Modbus error such as Invalid response [0x10] is, was read by rich as markup and ended in a MarkupError

Also

  • The repository's main branch is protected: pull requests, passing tests on 3.12/3.13/3.14, and resolved conversations before a merge.
  • Renovate leaves the add-on's own image tag alone, since the release moves it together with the version.

Vulnerabilities

No publicly known run-time vulnerabilities were fixed in this release.

Assets 4
Loading