Atrium 1.0.1
A security fix. Update if you ran 1.0.0.
What was wrong
1.0.0 sent your Sonarr or Radarr API key to third-party artwork sites.
The "recently downloaded" dashboard widget attached the instance's key as an
X-Api-Key header on its poster requests, and those requests went to whichever
artwork site your *arr server had recorded for the image: TheTVDB, TMDB or
Fanart.tv. So the key rode along to a host that has no business receiving it.
A Sonarr or Radarr API key is full control of that server: read paths, change
settings, add and delete media, run commands.
If you ran 1.0.0, consider rotating the API key of every Sonarr and Radarr
instance you used with it. Settings, General, API Key on the server itself.
There is no way to know whether a given key was retained by anyone, so rotating
is the safe assumption rather than a certainty that it was taken.
What else changed
Posters and backdrops on the dashboard and in the calendar were being fetched
from those artwork sites directly, so they saw your IP address and which titles
you were browsing. Your Sonarr and Radarr servers already cache that artwork and
serve it themselves, so Atrium now loads it from them instead. The rest of the
app was already doing this; the dashboard and calendar were the exceptions.
One consequence worth knowing: artwork now follows your instance's URL, local or
external, like every other request. It needs your server reachable, where before
it would load from a public CDN regardless.
Search results for titles you have not added yet still load artwork remotely,
and have to. Your server has nothing cached for something it has never seen.
Which APK
Most phones want app-arm64-v8a-release.apk. Use armeabi-v7a for older
32-bit devices, and x86_64 only for emulators and Chromebooks. Android 7.0
(API 24) or newer.
Signed with the same key as 1.0.0 (CN=Atrium, O=Atrium), so this installs as a
normal update. apksigner verify --print-certs should report:
5ebad1ff2f9cdc63f28b364addf9e858330db26909d9eba8dfbccb998de37351
Free software under the GPL-3.0-or-later.