Force / Enforce security if service is not available (#2744)

* Force / Enforce security if service is not available

* add options

* Add tests

* force security on test

* force security add-on validation

* Adjust style like codenotary

* Different exception type for backend error

* Adjust messages

* add comments

* ditch, not needed

* Address comment

* fix build

.devcontainer/Dockerfile

@@ -44,6 +44,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         dbus \
         network-manager \
         libpulse0 \
+    && bash <(curl https://getvcn.codenotary.com -L) \
     && rm -rf /var/lib/apt/lists/*
 
 # Install Python dependencies from requirements.txt if it exists

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -3,62 +3,78 @@ about: Report an issue related to the Home Assistant Supervisor.
 labels: bug
 title: ""
 issue_body: true
-inputs:
-  - type: description
+body:
+  - type: markdown
     attributes:
       value: |
         This issue form is for reporting bugs with **supported** setups only!
 
         If you have a feature or enhancement request, please use the [feature request][fr] section of our [Community Forum][fr].
+
         [fr]: https://community.home-assistant.io/c/feature-requests
-  - type: input
-    attributes:
-      label: What is the version of the Supervisor used?
+  - type: textarea
+    validations:
       required: true
+    attributes:
+      label: Describe the issue you are experiencing
+      description: Provide a clear and concise description of what the bug is.
+  - type: markdown
+    attributes:
+      value: |
+        ## Environment
+  - type: input
+    validations:
+      required: true
+    attributes:
+      label: What is the used version of the Supervisor?
       placeholder: supervisor-
       description: >
         Can be found in the Supervisor panel -> System tab. Starts with
         `supervisor-....`.
   - type: dropdown
+    validations:
+      required: true
     attributes:
       label: What type of installation are you running?
-      required: true
       description: >
         If you don't know, you can find it in: Configuration panel -> Info.
-      choices:
+      options:
         - Home Assistant OS
         - Home Assistant Supervised
   - type: dropdown
+    validations:
+      required: true
     attributes:
       label: Which operating system are you running on?
-      required: true
-      choices:
+      options:
         - Home Assistant Operating System
         - Debian
         - Other (e.g., Raspbian/Raspberry Pi OS/Fedora)
   - type: input
+    validations:
+      required: true
     attributes:
       label: What is the version of your installed operating system?
-      required: true
-      placeholder: 5.10
+      placeholder: "5.11"
       description: Can be found in the Supervisor panel -> System tab.
   - type: input
+    validations:
+      required: true
     attributes:
       label: What version of Home Assistant Core is installed?
-      required: true
       placeholder: core-
       description: >
         Can be found in the Supervisor panel -> System tab. Starts with
         `core-....`.
-  - type: textarea
+  - type: markdown
     attributes:
-      label: Describe the issue you are experiencing
-      required: true
-      description: Provide a clear and concise description of what the bug is.
+      value: |
+        # Details
   - type: textarea
+    validations:
+      required: true
     attributes:
       label: Steps to reproduce the issue
-      required: true
       description: |
         Please tell us exactly how to reproduce your issue.
         Provide clear and concise step by step instructions and add code snippets if needed.
@@ -68,12 +84,22 @@ inputs:
         3.
         ...
   - type: textarea
+    validations:
+      required: true
     attributes:
       label: Anything in the Supervisor logs that might be useful for us?
-      required: false
       description: >
         The Supervisor logs can be found in the Supervisor panel -> System tab.
-  - type: description
+      value: |
+        ```txt
+        # Put your logs below this line
+
+        ```
+  - type: markdown
+    attributes:
+      value: |
+        ## Additional information
+  - type: markdown
     attributes:
       value: |
         If you have any additional information for us, use the field below.

.github/PULL_REQUEST_TEMPLATE.md

@@ -37,6 +37,7 @@
 - This PR fixes or closes issue: fixes #
 - This PR is related to issue:
 - Link to documentation pull request:
+- Link to cli pull request:
 
 ## Checklist
 

.github/workflows/builder.yml

@@ -35,7 +35,7 @@ on:
 env:
   BUILD_NAME: supervisor
   BUILD_TYPE: supervisor
-  WHEELS_TAG: 3.8-alpine3.12
+  WHEELS_TAG: 3.8-alpine3.13
 
 jobs:
   init:
@@ -97,7 +97,7 @@ jobs:
           wheels-host: ${{ secrets.WHEELS_HOST }}
           wheels-key: ${{ secrets.WHEELS_KEY }}
           wheels-user: wheels
-          apk: "build-base;libffi-dev;openssl-dev"
+          apk: "build-base;libffi-dev;openssl-dev;cargo"
           skip-binary: aiohttp
           requirements: "requirements.txt"
 
@@ -114,19 +114,56 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Login to GitHub Container Registry
+        if: needs.init.outputs.publish == 'true'
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ secrets.GIT_USER }}
+          password: ${{ secrets.GIT_TOKEN }}
+
       - name: Set build arguments
         if: needs.init.outputs.publish == 'false'
         run: echo "BUILD_ARGS=--test" >> $GITHUB_ENV
 
       - name: Build supervisor
-        uses: home-assistant/builder@2021.01.1
+        uses: home-assistant/builder@2021.03.3
         with:
           args: |
             $BUILD_ARGS \
             --${{ matrix.arch }} \
             --target /data \
+            --with-codenotary "${{ secrets.VCN_USER }}" "${{ secrets.VCN_PASSWORD }}" "${{ secrets.VCN_ORG }}" \
+            --validate-from "${{ secrets.VCN_ORG }}" \
+            --validate-cache "${{ secrets.VCN_ORG }}" \
             --generic ${{ needs.init.outputs.version }}
 
+  codenotary:
+    name: CodeNotary signature
+    needs: init
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the repository
+        if: needs.init.outputs.publish == 'true'
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Set version
+        if: needs.init.outputs.publish == 'true'
+        uses: home-assistant/actions/helpers/version@master
+        with:
+          type: ${{ env.BUILD_TYPE }}
+
+      - name: Signing image
+        if: needs.init.outputs.publish == 'true'
+        uses: home-assistant/actions/helpers/codenotary@master
+        with:
+          source: dir://${{ github.workspace }}
+          user: ${{ secrets.VCN_USER }}
+          password: ${{ secrets.VCN_PASSWORD }}
+          organisation: ${{ secrets.VCN_ORG }}
+
   version:
     name: Update version
     needs: ["init", "run_supervisor"]
@@ -155,13 +192,13 @@ jobs:
   run_supervisor:
     runs-on: ubuntu-latest
     name: Run the Supervisor
-    needs: ["build"]
+    needs: ["build", "codenotary"]
     steps:
       - name: Checkout the repository
         uses: actions/checkout@v2
 
       - name: Build the Supervisor
-        uses: home-assistant/builder@2021.01.1
+        uses: home-assistant/builder@2021.03.3
         with:
           args: |
             --test \

.github/workflows/ci.yaml

@@ -353,6 +353,10 @@ jobs:
         id: python
         with:
           python-version: ${{ matrix.python-version }}
+      - name: Install CodeNotary
+        shell: bash
+        run: |
+          bash <(curl https://getvcn.codenotary.com -L)
       - name: Restore Python virtual environment
         id: cache-venv
         uses: actions/cache@v2.1.4
@@ -428,4 +432,4 @@ jobs:
           coverage report
           coverage xml
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v1.2.1
+        uses: codecov/codecov-action@v1.3.1

.github/workflows/stale.yml

@@ -9,7 +9,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v3.0.16
+      - uses: actions/stale@v3.0.18
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 60

.hadolint.yaml

@@ -1,5 +1,6 @@
 ignored:
-  - DL3018
+  - DL3003
   - DL3006
   - DL3013
+  - DL3018
   - SC2155

.vcnignore

@@ -0,0 +1,21 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# Distribution / packaging
+*.egg-info/
+
+# General files
+.git
+.github
+.devcontainer
+.vscode
+.tox
+
+# Data
+home-assistant-polymer/
+script/
+tests/
+data/
+venv/

Dockerfile

@@ -1,13 +1,18 @@
 ARG BUILD_FROM
-FROM $BUILD_FROM
+FROM ${BUILD_FROM}
 
 ENV \
     S6_SERVICES_GRACETIME=10000 \
     SUPERVISOR_API=http://localhost
 
+ARG BUILD_ARCH
+ARG VCN_VERSION
+WORKDIR /usr/src
+
 # Install base
 RUN \
-    apk add --no-cache \
+    set -x \
+    && apk add --no-cache \
         eudev \
         eudev-libs \
         git \
@@ -15,10 +20,37 @@ RUN \
         libffi \
         libpulse \
         musl \
-        openssl
-
-ARG BUILD_ARCH
-WORKDIR /usr/src
+        openssl \
+    && apk add --no-cache --virtual .build-dependencies \
+        build-base \
+        go \
+    \
+    && git clone -b v${VCN_VERSION} --depth 1 \
+        https://github.com/codenotary/vcn \
+    && cd vcn \
+    \
+    # Fix: https://github.com/codenotary/vcn/issues/131
+    && go get github.com/codenotary/immudb@4cf9e2ae06ac2e6ec98a60364c3de3eab5524757 \
+    \
+    && if [ "${BUILD_ARCH}" = "armhf" ]; then \
+        GOARM=6 GOARCH=arm go build -o vcn -ldflags="-s -w" ./cmd/vcn; \
+    elif [ "${BUILD_ARCH}" = "armv7" ]; then \
+        GOARM=7 GOARCH=arm go build -o vcn -ldflags="-s -w" ./cmd/vcn; \
+    elif [ "${BUILD_ARCH}" = "aarch64" ]; then \
+        GOARCH=arm64 go build -o vcn -ldflags="-s -w" ./cmd/vcn; \
+    elif [ "${BUILD_ARCH}" = "i386" ]; then \
+        GOARCH=386 go build -o vcn -ldflags="-s -w" ./cmd/vcn; \
+    elif [ "${BUILD_ARCH}" = "amd64" ]; then \
+        GOARCH=amd64 go build -o vcn -ldflags="-s -w" ./cmd/vcn; \
+    else \
+        exit 1; \
+    fi \
+    \
+    && rm -rf /root/go /root/.cache \
+    && mv vcn /usr/bin/vcn \
+    \
+    && apk del .build-dependencies \
+    && rm -rf /usr/src/vcn
 
 # Install requirements
 COPY requirements.txt .

build.json

@@ -1,11 +1,15 @@
 {
   "image": "homeassistant/{arch}-hassio-supervisor",
+  "shadow_repository": "ghcr.io/home-assistant",
   "build_from": {
-    "aarch64": "homeassistant/aarch64-base-python:3.8-alpine3.12",
-    "armhf": "homeassistant/armhf-base-python:3.8-alpine3.12",
-    "armv7": "homeassistant/armv7-base-python:3.8-alpine3.12",
-    "amd64": "homeassistant/amd64-base-python:3.8-alpine3.12",
-    "i386": "homeassistant/i386-base-python:3.8-alpine3.12"
+    "aarch64": "ghcr.io/home-assistant/aarch64-base-python:3.8-alpine3.13",
+    "armhf": "ghcr.io/home-assistant/armhf-base-python:3.8-alpine3.13",
+    "armv7": "ghcr.io/home-assistant/armv7-base-python:3.8-alpine3.13",
+    "amd64": "ghcr.io/home-assistant/amd64-base-python:3.8-alpine3.13",
+    "i386": "ghcr.io/home-assistant/i386-base-python:3.8-alpine3.13"
+  },
+  "args": {
+    "VCN_VERSION": "0.9.4"
   },
   "labels": {
     "io.hass.type": "supervisor"

requirements.txt

@@ -1,20 +1,20 @@
-aiohttp==3.7.3
+aiohttp==3.7.4.post0
 async_timeout==3.0.1
 atomicwrites==1.4.0
 attrs==20.3.0
-awesomeversion==21.2.2
+awesomeversion==21.2.3
 brotli==1.0.9
 cchardet==2.1.7
-colorlog==4.7.2
+colorlog==4.8.0
 cpe==1.2.1
-cryptography==3.3.1
+cryptography==3.4.6
 debugpy==1.2.1
-docker==4.4.1
-gitpython==3.1.12
+docker==4.4.4
+gitpython==3.1.14
 jinja2==2.11.3
-pulsectl==20.5.1
+pulsectl==21.3.4
 pytz==2021.1
 pyudev==0.22.0
 ruamel.yaml==0.15.100
-sentry-sdk==0.19.5
+sentry-sdk==1.0.0
 voluptuous==0.12.1

requirements_tests.txt

@@ -1,14 +1,14 @@
 black==20.8b1
 codecov==2.1.11
-coverage==5.4
-flake8-docstrings==1.5.0
-flake8==3.8.4
-pre-commit==2.10.1
-pydocstyle==5.1.1
-pylint==2.6.0
+coverage==5.5
+flake8-docstrings==1.6.0
+flake8==3.9.0
+pre-commit==2.11.1
+pydocstyle==6.0.0
+pylint==2.7.2
 pytest-aiohttp==0.3.0
 pytest-asyncio==0.12.0 # NB!: Versions over 0.12.0 breaks pytest-aiohttp (https://github.com/aio-libs/pytest-aiohttp/issues/16)
 pytest-cov==2.11.1
 pytest-timeout==1.4.2
 pytest==6.2.2
-pyupgrade==2.10.0
+pyupgrade==2.11.0

setup.py

@@ -44,7 +44,9 @@ setup(
         "supervisor.jobs",
         "supervisor.misc",
         "supervisor.plugins",
+        "supervisor.resolution.checks",
         "supervisor.resolution.evaluations",
+        "supervisor.resolution.fixups",
         "supervisor.resolution",
         "supervisor.services.modules",
         "supervisor.services",

supervisor/addons/__init__.py

@@ -154,17 +154,16 @@ class AddonManager(CoreSysAttributes):
     async def install(self, slug: str) -> None:
         """Install an add-on."""
         if slug in self.local:
-            _LOGGER.warning("Add-on %s is already installed", slug)
-            return
+            raise AddonsError(f"Add-on {slug} is already installed", _LOGGER.warning)
         store = self.store.get(slug)
 
         if not store:
-            _LOGGER.error("Add-on %s not exists", slug)
-            raise AddonsError()
+            raise AddonsError(f"Add-on {slug} not exists", _LOGGER.error)
 
         if not store.available:
-            _LOGGER.error("Add-on %s not supported on that platform", slug)
-            raise AddonsNotSupportedError()
+            raise AddonsNotSupportedError(
+                f"Add-on {slug} not supported on that platform", _LOGGER.error
+            )
 
         self.data.install(store)
         addon = Addon(self.coresys, slug)
@@ -256,23 +255,23 @@ class AddonManager(CoreSysAttributes):
     async def update(self, slug: str) -> None:
         """Update add-on."""
         if slug not in self.local:
-            _LOGGER.error("Add-on %s is not installed", slug)
-            raise AddonsError()
+            raise AddonsError(f"Add-on {slug} is not installed", _LOGGER.error)
         addon = self.local[slug]
 
         if addon.is_detached:
-            _LOGGER.error("Add-on %s is not available inside store", slug)
-            raise AddonsError()
+            raise AddonsError(
+                f"Add-on {slug} is not available inside store", _LOGGER.error
+            )
         store = self.store[slug]
 
         if addon.version == store.version:
-            _LOGGER.warning("No update available for add-on %s", slug)
-            return
+            raise AddonsError(f"No update available for add-on {slug}", _LOGGER.warning)
 
         # Check if available, Maybe something have changed
         if not store.available:
-            _LOGGER.error("Add-on %s not supported on that platform", slug)
-            raise AddonsNotSupportedError()
+            raise AddonsNotSupportedError(
+                f"Add-on {slug} not supported on that platform", _LOGGER.error
+            )
 
         # Update instance
         last_state: AddonState = addon.state

supervisor/addons/addon.py

@@ -22,6 +22,8 @@ from ..const import (
     ATTR_AUDIO_OUTPUT,
     ATTR_AUTO_UPDATE,
     ATTR_BOOT,
+    ATTR_DATA,
+    ATTR_EVENT,
     ATTR_IMAGE,
     ATTR_INGRESS_ENTRY,
     ATTR_INGRESS_PANEL,
@@ -32,8 +34,10 @@ from ..const import (
     ATTR_PORTS,
     ATTR_PROTECTED,
     ATTR_SCHEMA,
+    ATTR_SLUG,
     ATTR_STATE,
     ATTR_SYSTEM,
+    ATTR_TYPE,
     ATTR_USER,
     ATTR_UUID,
     ATTR_VERSION,
@@ -50,12 +54,13 @@ from ..exceptions import (
     AddonConfigurationError,
     AddonsError,
     AddonsNotSupportedError,
+    ConfigurationFileError,
     DockerError,
     DockerRequestError,
     HostAppArmorError,
-    JsonFileError,
 )
 from ..hardware.data import Device
+from ..homeassistant.const import WSEvent, WSType
 from ..utils import check_port
 from ..utils.apparmor import adjust_profile
 from ..utils.json import read_json_file, write_json_file
@@ -74,7 +79,7 @@ RE_WEBUI = re.compile(
 
 RE_WATCHDOG = re.compile(
     r"^(?:(?P<s_prefix>https?|tcp)|\[PROTO:(?P<t_proto>\w+)\])"
-    r":\/\/\[HOST\]:\[PORT:(?P<t_port>\d+)\](?P<s_suffix>.*)$"
+    r":\/\/\[HOST\]:(?:\[PORT:)?(?P<t_port>\d+)\]?(?P<s_suffix>.*)$"
 )
 
 RE_OLD_AUDIO = re.compile(r"\d+,\d+")
@@ -89,12 +94,34 @@ class Addon(AddonModel):
         """Initialize data holder."""
         super().__init__(coresys, slug)
         self.instance: DockerAddon = DockerAddon(coresys, self)
-        self.state: AddonState = AddonState.UNKNOWN
+        self._state: AddonState = AddonState.UNKNOWN
 
     def __repr__(self) -> str:
         """Return internal representation."""
         return f"<Addon: {self.slug}>"
 
+    @property
+    def state(self) -> AddonState:
+        """Return state of the add-on."""
+        return self._state
+
+    @state.setter
+    def state(self, new_state: AddonState) -> None:
+        """Set the add-on into new state."""
+        if self._state == new_state:
+            return
+        self._state = new_state
+        self.sys_homeassistant.websocket.send_command(
+            {
+                ATTR_TYPE: WSType.SUPERVISOR_EVENT,
+                ATTR_DATA: {
+                    ATTR_EVENT: WSEvent.ADDON,
+                    ATTR_SLUG: self.slug,
+                    ATTR_STATE: new_state,
+                },
+            }
+        )
+
     @property
     def in_progress(self) -> bool:
         """Return True if a task is in progress."""
@@ -398,18 +425,32 @@ class Addon(AddonModel):
 
     @property
     def devices(self) -> Set[Device]:
-        """Create a schema for add-on options."""
+        """Extract devices from add-on options."""
         raw_schema = self.data[ATTR_SCHEMA]
         if isinstance(raw_schema, bool) or not raw_schema:
             return set()
 
         # Validate devices
-        options_validator = AddonOptions(self.coresys, raw_schema)
+        options_validator = AddonOptions(self.coresys, raw_schema, self.name, self.slug)
         with suppress(vol.Invalid):
             options_validator(self.options)
 
         return options_validator.devices
 
+    @property
+    def pwned(self) -> Set[str]:
+        """Extract pwned data for add-on options."""
+        raw_schema = self.data[ATTR_SCHEMA]
+        if isinstance(raw_schema, bool) or not raw_schema:
+            return set()
+
+        # Validate devices
+        options_validator = AddonOptions(self.coresys, raw_schema, self.name, self.slug)
+        with suppress(vol.Invalid):
+            options_validator(self.options)
+
+        return options_validator.pwned
+
     def save_persist(self) -> None:
         """Save data of add-on."""
         self.sys_addons.data.save_data()
@@ -470,7 +511,7 @@ class Addon(AddonModel):
                 self.slug,
                 humanize_error(self.options, ex),
             )
-        except JsonFileError:
+        except ConfigurationFileError:
             _LOGGER.error("Add-on %s can't write options", self.slug)
         else:
             _LOGGER.debug("Add-on %s write options: %s", self.slug, options)
@@ -551,7 +592,9 @@ class Addon(AddonModel):
 
         # create voluptuous
         new_schema = vol.Schema(
-            vol.All(dict, AddonOptions(self.coresys, new_raw_schema))
+            vol.All(
+                dict, AddonOptions(self.coresys, new_raw_schema, self.name, self.slug)
+            )
         )
 
         # validate
@@ -583,7 +626,7 @@ class Addon(AddonModel):
         try:
             await self.instance.run()
         except DockerRequestError as err:
-            self.state = AddonState.STOPPED
+            self.state = AddonState.ERROR
             raise AddonsError() from err
         except DockerError as err:
             self.state = AddonState.ERROR
@@ -596,6 +639,7 @@ class Addon(AddonModel):
         try:
             await self.instance.stop()
         except DockerRequestError as err:
+            self.state = AddonState.ERROR
             raise AddonsError() from err
         except DockerError as err:
             self.state = AddonState.ERROR
@@ -666,7 +710,7 @@ class Addon(AddonModel):
             # Store local configs/state
             try:
                 write_json_file(temp_path.joinpath("addon.json"), data)
-            except JsonFileError as err:
+            except ConfigurationFileError as err:
                 _LOGGER.error("Can't save meta for %s", self.slug)
                 raise AddonsError() from err
 
@@ -722,7 +766,7 @@ class Addon(AddonModel):
             # Read snapshot data
             try:
                 data = read_json_file(Path(temp, "addon.json"))
-            except JsonFileError as err:
+            except ConfigurationFileError as err:
                 raise AddonsError() from err
 
             # Validate

supervisor/addons/build.py

@@ -6,16 +6,23 @@ from typing import TYPE_CHECKING, Dict
 
 from awesomeversion import AwesomeVersion
 
-from ..const import ATTR_ARGS, ATTR_BUILD_FROM, ATTR_SQUASH, META_ADDON
+from ..const import (
+    ATTR_ARGS,
+    ATTR_BUILD_FROM,
+    ATTR_SQUASH,
+    FILE_SUFFIX_CONFIGURATION,
+    META_ADDON,
+)
 from ..coresys import CoreSys, CoreSysAttributes
-from ..utils.json import JsonConfig
+from ..exceptions import ConfigurationFileError
+from ..utils.common import FileConfiguration, find_one_filetype
 from .validate import SCHEMA_BUILD_CONFIG
 
 if TYPE_CHECKING:
     from . import AnyAddon
 
 
-class AddonBuild(JsonConfig, CoreSysAttributes):
+class AddonBuild(FileConfiguration, CoreSysAttributes):
     """Handle build options for add-ons."""
 
     def __init__(self, coresys: CoreSys, addon: AnyAddon) -> None:
@@ -23,9 +30,14 @@ class AddonBuild(JsonConfig, CoreSysAttributes):
         self.coresys: CoreSys = coresys
         self.addon = addon
 
-        super().__init__(
-            Path(self.addon.path_location, "build.json"), SCHEMA_BUILD_CONFIG
-        )
+        try:
+            build_file = find_one_filetype(
+                self.addon.path_location, "build", FILE_SUFFIX_CONFIGURATION
+            )
+        except ConfigurationFileError:
+            build_file = self.addon.path_location / "build.json"
+
+        super().__init__(build_file, SCHEMA_BUILD_CONFIG)
 
     def save_data(self):
         """Ignore save function."""

supervisor/addons/data.py

@@ -1,6 +1,5 @@
 """Init file for Supervisor add-on data."""
 from copy import deepcopy
-import logging
 from typing import Any, Dict
 
 from ..const import (
@@ -13,16 +12,14 @@ from ..const import (
 )
 from ..coresys import CoreSys, CoreSysAttributes
 from ..store.addon import AddonStore
-from ..utils.json import JsonConfig
+from ..utils.common import FileConfiguration
 from .addon import Addon
 from .validate import SCHEMA_ADDONS_FILE
 
-_LOGGER: logging.Logger = logging.getLogger(__name__)
-
 Config = Dict[str, Any]
 
 
-class AddonsData(JsonConfig, CoreSysAttributes):
+class AddonsData(FileConfiguration, CoreSysAttributes):
     """Hold data for installed Add-ons inside Supervisor."""
 
     def __init__(self, coresys: CoreSys):

supervisor/addons/model.py

@@ -32,6 +32,7 @@ from ..const import (
     ATTR_IMAGE,
     ATTR_INGRESS,
     ATTR_INIT,
+    ATTR_JOURNALD,
     ATTR_KERNEL_MODULES,
     ATTR_LEGACY,
     ATTR_LOCATON,
@@ -45,6 +46,7 @@ from ..const import (
     ATTR_PORTS,
     ATTR_PORTS_DESCRIPTION,
     ATTR_PRIVILEGED,
+    ATTR_REALTIME,
     ATTR_REPOSITORY,
     ATTR_SCHEMA,
     ATTR_SERVICES,
@@ -55,6 +57,7 @@ from ..const import (
     ATTR_STDIN,
     ATTR_TIMEOUT,
     ATTR_TMPFS,
+    ATTR_TRANSLATIONS,
     ATTR_UART,
     ATTR_UDEV,
     ATTR_URL,
@@ -71,6 +74,7 @@ from ..const import (
     AddonStartup,
 )
 from ..coresys import CoreSys, CoreSysAttributes
+from ..docker.const import Capabilities
 from .options import AddonOptions, UiOptions
 from .validate import RE_SERVICE, RE_VOLUME
 
@@ -183,6 +187,11 @@ class AddonModel(CoreSysAttributes, ABC):
         """Return repository of add-on."""
         return self.data[ATTR_REPOSITORY]
 
+    @property
+    def translations(self) -> dict:
+        """Return add-on translations."""
+        return self.data[ATTR_TRANSLATIONS]
+
     @property
     def latest_version(self) -> AwesomeVersion:
         """Return latest version of add-on."""
@@ -307,7 +316,7 @@ class AddonModel(CoreSysAttributes, ABC):
         return self.data.get(ATTR_ENVIRONMENT)
 
     @property
-    def privileged(self) -> List[str]:
+    def privileged(self) -> List[Capabilities]:
         """Return list of privilege."""
         return self.data.get(ATTR_PRIVILEGED, [])
 
@@ -395,6 +404,11 @@ class AddonModel(CoreSysAttributes, ABC):
         """Return True if the add-on access to kernel modules."""
         return self.data[ATTR_KERNEL_MODULES]
 
+    @property
+    def with_realtime(self) -> bool:
+        """Return True if the add-on need realtime schedule functions."""
+        return self.data[ATTR_REALTIME]
+
     @property
     def with_full_access(self) -> bool:
         """Return True if the add-on want full access to hardware."""
@@ -524,7 +538,9 @@ class AddonModel(CoreSysAttributes, ABC):
 
         if isinstance(raw_schema, bool):
             raw_schema = {}
-        return vol.Schema(vol.All(dict, AddonOptions(self.coresys, raw_schema)))
+        return vol.Schema(
+            vol.All(dict, AddonOptions(self.coresys, raw_schema, self.name, self.slug))
+        )
 
     @property
     def schema_ui(self) -> Optional[List[Dict[str, Any]]]:
@@ -535,6 +551,11 @@ class AddonModel(CoreSysAttributes, ABC):
             return None
         return UiOptions(self.coresys)(raw_schema)
 
+    @property
+    def with_journald(self) -> bool:
+        """Return True if the add-on accesses the system journal."""
+        return self.data[ATTR_JOURNALD]
+
     def __eq__(self, other):
         """Compaired add-on objects."""
         if not isinstance(other, AddonModel):

supervisor/addons/options.py

@@ -1,4 +1,5 @@
 """Add-on Options / UI rendering."""
+import hashlib
 import logging
 from pathlib import Path
 import re
@@ -58,14 +59,15 @@ class AddonOptions(CoreSysAttributes):
     """Validate Add-ons Options."""
 
     def __init__(
-        self,
-        coresys: CoreSys,
-        raw_schema: Dict[str, Any],
+        self, coresys: CoreSys, raw_schema: Dict[str, Any], name: str, slug: str
     ):
         """Validate schema."""
         self.coresys: CoreSys = coresys
         self.raw_schema: Dict[str, Any] = raw_schema
         self.devices: Set[Device] = set()
+        self.pwned: Set[str] = set()
+        self._name = name
+        self._slug = slug
 
     def __call__(self, struct):
         """Create schema validator for add-ons options."""
@@ -75,7 +77,12 @@ class AddonOptions(CoreSysAttributes):
         for key, value in struct.items():
             # Ignore unknown options / remove from list
             if key not in self.raw_schema:
-                _LOGGER.warning("Unknown options %s", key)
+                _LOGGER.warning(
+                    "Option '%s' does not exist in the schema for %s (%s)",
+                    key,
+                    self._name,
+                    self._slug,
+                )
                 continue
 
             typ = self.raw_schema[key]
@@ -90,7 +97,9 @@ class AddonOptions(CoreSysAttributes):
                     # normal value
                     options[key] = self._single_validate(typ, value, key)
             except (IndexError, KeyError):
-                raise vol.Invalid(f"Type error for {key}") from None
+                raise vol.Invalid(
+                    f"Type error for option '{key}' in {self._name} ({self._slug})"
+                ) from None
 
         self._check_missing_options(self.raw_schema, options, "root")
         return options
@@ -100,20 +109,26 @@ class AddonOptions(CoreSysAttributes):
         """Validate a single element."""
         # if required argument
         if value is None:
-            raise vol.Invalid(f"Missing required option '{key}'") from None
+            raise vol.Invalid(
+                f"Missing required option '{key}' in {self._name} ({self._slug})"
+            ) from None
 
         # Lookup secret
         if str(value).startswith("!secret "):
             secret: str = value.partition(" ")[2]
             value = self.sys_homeassistant.secrets.get(secret)
             if value is None:
-                raise vol.Invalid(f"Unknown secret {secret}") from None
+                raise vol.Invalid(
+                    f"Unknown secret '{secret}' in {self._name} ({self._slug})"
+                ) from None
 
         # parse extend data from type
         match = RE_SCHEMA_ELEMENT.match(typ)
 
         if not match:
-            raise vol.Invalid(f"Unknown type {typ}") from None
+            raise vol.Invalid(
+                f"Unknown type '{typ}' in {self._name} ({self._slug})"
+            ) from None
 
         # prepare range
         range_args = {}
@@ -123,6 +138,8 @@ class AddonOptions(CoreSysAttributes):
                 range_args[group_name[2:]] = float(group_value)
 
         if typ.startswith(_STR) or typ.startswith(_PASSWORD):
+            if typ.startswith(_PASSWORD) and value:
+                self.pwned.add(hashlib.sha1(str(value).encode()).hexdigest())
             return vol.All(str(value), vol.Range(**range_args))(value)
         elif typ.startswith(_INT):
             return vol.All(vol.Coerce(int), vol.Range(**range_args))(value)
@@ -144,7 +161,9 @@ class AddonOptions(CoreSysAttributes):
             try:
                 device = self.sys_hardware.get_by_path(Path(value))
             except HardwareNotFound:
-                raise vol.Invalid(f"Device {value} does not exists!") from None
+                raise vol.Invalid(
+                    f"Device '{value}' does not exists! in {self._name} ({self._slug})"
+                ) from None
 
             # Have filter
             if match.group("filter"):
@@ -152,14 +171,16 @@ class AddonOptions(CoreSysAttributes):
                 device_filter = _create_device_filter(str_filter)
                 if device not in self.sys_hardware.filter_devices(**device_filter):
                     raise vol.Invalid(
-                        f"Device {value} don't match the filter {str_filter}!"
+                        f"Device '{value}' don't match the filter {str_filter}! in {self._name} ({self._slug})"
                     )
 
             # Device valid
             self.devices.add(device)
             return str(device.path)
 
-        raise vol.Invalid(f"Fatal error for {key} type {typ}") from None
+        raise vol.Invalid(
+            f"Fatal error for option '{key}' with type '{typ}' in {self._name} ({self._slug})"
+        ) from None
 
     def _nested_validate_list(self, typ: Any, data_list: List[Any], key: str):
         """Validate nested items."""
@@ -167,7 +188,9 @@ class AddonOptions(CoreSysAttributes):
 
         # Make sure it is a list
         if not isinstance(data_list, list):
-            raise vol.Invalid(f"Invalid list for {key}") from None
+            raise vol.Invalid(
+                f"Invalid list for option '{key}' in {self._name} ({self._slug})"
+            ) from None
 
         # Process list
         for element in data_list:
@@ -188,13 +211,17 @@ class AddonOptions(CoreSysAttributes):
 
         # Make sure it is a dict
         if not isinstance(data_dict, dict):
-            raise vol.Invalid(f"Invalid dict for {key}") from None
+            raise vol.Invalid(
+                f"Invalid dict for option '{key}' in {self._name} ({self._slug})"
+            ) from None
 
         # Process dict
         for c_key, c_value in data_dict.items():
             # Ignore unknown options / remove from list
             if c_key not in typ:
-                _LOGGER.warning("Unknown options %s", c_key)
+                _LOGGER.warning(
+                    "Unknown option '%s' for %s (%s)", c_key, self._name, self._slug
+                )
                 continue
 
             # Nested?
@@ -216,7 +243,9 @@ class AddonOptions(CoreSysAttributes):
         for miss_opt in missing:
             if isinstance(origin[miss_opt], str) and origin[miss_opt].endswith("?"):
                 continue
-            raise vol.Invalid(f"Missing option {miss_opt} in {root}") from None
+            raise vol.Invalid(
+                f"Missing option '{miss_opt}' in {root} in {self._name} ({self._slug})"
+            ) from None
 
 
 class UiOptions(CoreSysAttributes):

supervisor/addons/utils.py

@@ -6,18 +6,8 @@ import logging
 from pathlib import Path
 from typing import TYPE_CHECKING
 
-from ..const import (
-    PRIVILEGED_DAC_READ_SEARCH,
-    PRIVILEGED_NET_ADMIN,
-    PRIVILEGED_SYS_ADMIN,
-    PRIVILEGED_SYS_MODULE,
-    PRIVILEGED_SYS_PTRACE,
-    PRIVILEGED_SYS_RAWIO,
-    ROLE_ADMIN,
-    ROLE_MANAGER,
-    SECURITY_DISABLE,
-    SECURITY_PROFILE,
-)
+from ..const import ROLE_ADMIN, ROLE_MANAGER, SECURITY_DISABLE, SECURITY_PROFILE
+from ..docker.const import Capabilities
 
 if TYPE_CHECKING:
     from .model import AddonModel
@@ -46,16 +36,19 @@ def rating_security(addon: AddonModel) -> int:
         rating += 1
 
     # Privileged options
-    if any(
-        privilege in addon.privileged
-        for privilege in (
-            PRIVILEGED_NET_ADMIN,
-            PRIVILEGED_SYS_ADMIN,
-            PRIVILEGED_SYS_RAWIO,
-            PRIVILEGED_SYS_PTRACE,
-            PRIVILEGED_SYS_MODULE,
-            PRIVILEGED_DAC_READ_SEARCH,
+    if (
+        any(
+            privilege in addon.privileged
+            for privilege in (
+                Capabilities.NET_ADMIN,
+                Capabilities.SYS_ADMIN,
+                Capabilities.SYS_RAWIO,
+                Capabilities.SYS_PTRACE,
+                Capabilities.SYS_MODULE,
+                Capabilities.DAC_READ_SEARCH,
+            )
         )
+        or addon.with_kernel_modules
     ):
         rating += -1
 
@@ -73,12 +66,8 @@ def rating_security(addon: AddonModel) -> int:
     if addon.host_pid:
         rating += -2
 
-    # Full Access
-    if addon.with_full_access:
-        rating += -2
-
-    # Docker Access
-    if addon.access_docker_api:
+    # Docker Access & full Access
+    if addon.access_docker_api or addon.with_full_access:
         rating = 1
 
     return max(min(6, rating), 1)

supervisor/addons/validate.py

@@ -21,6 +21,7 @@ from ..const import (
     ATTR_AUTO_UPDATE,
     ATTR_BOOT,
     ATTR_BUILD_FROM,
+    ATTR_CONFIGURATION,
     ATTR_DESCRIPTON,
     ATTR_DEVICES,
     ATTR_DEVICETREE,
@@ -44,6 +45,7 @@ from ..const import (
     ATTR_INGRESS_PORT,
     ATTR_INGRESS_TOKEN,
     ATTR_INIT,
+    ATTR_JOURNALD,
     ATTR_KERNEL_MODULES,
     ATTR_LEGACY,
     ATTR_LOCATON,
@@ -59,6 +61,7 @@ from ..const import (
     ATTR_PORTS_DESCRIPTION,
     ATTR_PRIVILEGED,
     ATTR_PROTECTED,
+    ATTR_REALTIME,
     ATTR_REPOSITORY,
     ATTR_SCHEMA,
     ATTR_SERVICES,
@@ -72,6 +75,7 @@ from ..const import (
     ATTR_SYSTEM,
     ATTR_TIMEOUT,
     ATTR_TMPFS,
+    ATTR_TRANSLATIONS,
     ATTR_UART,
     ATTR_UDEV,
     ATTR_URL,
@@ -82,7 +86,6 @@ from ..const import (
     ATTR_VIDEO,
     ATTR_WATCHDOG,
     ATTR_WEBUI,
-    PRIVILEGED_ALL,
     ROLE_ALL,
     ROLE_DEFAULT,
     AddonBoot,
@@ -91,6 +94,7 @@ from ..const import (
     AddonState,
 )
 from ..discovery.validate import valid_discovery_service
+from ..docker.const import Capabilities
 from ..validate import (
     docker_image,
     docker_ports,
@@ -136,6 +140,26 @@ RE_MACHINE = re.compile(
 )
 
 
+def _warn_addon_config(config: Dict[str, Any]):
+    """Warn about miss configs."""
+    name = config.get(ATTR_NAME)
+    if not name:
+        raise vol.Invalid("Invalid Add-on config!")
+
+    if config.get(ATTR_FULL_ACCESS, False) and (
+        config.get(ATTR_DEVICES)
+        or config.get(ATTR_UART)
+        or config.get(ATTR_USB)
+        or config.get(ATTR_GPIO)
+    ):
+        _LOGGER.warning(
+            "Add-on have full device access, and selective device access in the configuration. Please report this to the maintainer of %s",
+            name,
+        )
+
+    return config
+
+
 def _migrate_addon_config(protocol=False):
     """Migrate addon config."""
 
@@ -210,7 +234,7 @@ _SCHEMA_ADDON_CONFIG = vol.Schema(
         vol.Optional(ATTR_PORTS): docker_ports,
         vol.Optional(ATTR_PORTS_DESCRIPTION): docker_ports_description,
         vol.Optional(ATTR_WATCHDOG): vol.Match(
-            r"^(?:https?|\[PROTO:\w+\]|tcp):\/\/\[HOST\]:\[PORT:\d+\].*$"
+            r"^(?:https?|\[PROTO:\w+\]|tcp):\/\/\[HOST\]:(\[PORT:\d+\]|\d+).*$"
         ),
         vol.Optional(ATTR_WEBUI): vol.Match(
             r"^(?:https?|\[PROTO:\w+\]):\/\/\[HOST\]:\[PORT:\d+\].*$"
@@ -233,7 +257,7 @@ _SCHEMA_ADDON_CONFIG = vol.Schema(
         vol.Optional(ATTR_TMPFS, default=False): vol.Boolean(),
         vol.Optional(ATTR_MAP, default=list): [vol.Match(RE_VOLUME)],
         vol.Optional(ATTR_ENVIRONMENT): {vol.Match(r"\w*"): str},
-        vol.Optional(ATTR_PRIVILEGED): [vol.In(PRIVILEGED_ALL)],
+        vol.Optional(ATTR_PRIVILEGED): [vol.Coerce(Capabilities)],
         vol.Optional(ATTR_APPARMOR, default=True): vol.Boolean(),
         vol.Optional(ATTR_FULL_ACCESS, default=False): vol.Boolean(),
         vol.Optional(ATTR_AUDIO, default=False): vol.Boolean(),
@@ -243,6 +267,7 @@ _SCHEMA_ADDON_CONFIG = vol.Schema(
         vol.Optional(ATTR_UART, default=False): vol.Boolean(),
         vol.Optional(ATTR_DEVICETREE, default=False): vol.Boolean(),
         vol.Optional(ATTR_KERNEL_MODULES, default=False): vol.Boolean(),
+        vol.Optional(ATTR_REALTIME, default=False): vol.Boolean(),
         vol.Optional(ATTR_HASSIO_API, default=False): vol.Boolean(),
         vol.Optional(ATTR_HASSIO_ROLE, default=ROLE_DEFAULT): vol.In(ROLE_ALL),
         vol.Optional(ATTR_HOMEASSISTANT_API, default=False): vol.Boolean(),
@@ -275,11 +300,14 @@ _SCHEMA_ADDON_CONFIG = vol.Schema(
         vol.Optional(ATTR_TIMEOUT, default=10): vol.All(
             vol.Coerce(int), vol.Range(min=10, max=300)
         ),
+        vol.Optional(ATTR_JOURNALD, default=False): vol.Boolean(),
     },
     extra=vol.REMOVE_EXTRA,
 )
 
-SCHEMA_ADDON_CONFIG = vol.All(_migrate_addon_config(True), _SCHEMA_ADDON_CONFIG)
+SCHEMA_ADDON_CONFIG = vol.All(
+    _migrate_addon_config(True), _warn_addon_config, _SCHEMA_ADDON_CONFIG
+)
 
 
 # pylint: disable=no-value-for-parameter
@@ -296,6 +324,23 @@ SCHEMA_BUILD_CONFIG = vol.Schema(
     extra=vol.REMOVE_EXTRA,
 )
 
+SCHEMA_TRANSLATION_CONFIGURATION = vol.Schema(
+    {
+        vol.Required(ATTR_NAME): str,
+        vol.Optional(ATTR_DESCRIPTON): vol.Maybe(str),
+    },
+    extra=vol.REMOVE_EXTRA,
+)
+
+
+SCHEMA_ADDON_TRANSLATIONS = vol.Schema(
+    {
+        vol.Optional(ATTR_CONFIGURATION): {str: SCHEMA_TRANSLATION_CONFIGURATION},
+        vol.Optional(ATTR_NETWORK): {str: str},
+    },
+    extra=vol.REMOVE_EXTRA,
+)
+
 
 # pylint: disable=no-value-for-parameter
 SCHEMA_ADDON_USER = vol.Schema(
@@ -318,13 +363,15 @@ SCHEMA_ADDON_USER = vol.Schema(
     extra=vol.REMOVE_EXTRA,
 )
 
-
 SCHEMA_ADDON_SYSTEM = vol.All(
     _migrate_addon_config(),
     _SCHEMA_ADDON_CONFIG.extend(
         {
             vol.Required(ATTR_LOCATON): str,
             vol.Required(ATTR_REPOSITORY): str,
+            vol.Required(ATTR_TRANSLATIONS, default=dict): {
+                str: SCHEMA_ADDON_TRANSLATIONS
+            },
         }
     ),
 )

supervisor/api/__init__.py

@@ -28,6 +28,7 @@ from .resolution import APIResoulution
 from .security import SecurityMiddleware
 from .services import APIServices
 from .snapshots import APISnapshots
+from .store import APIStore
 from .supervisor import APISupervisor
 
 _LOGGER: logging.Logger = logging.getLogger(__name__)
@@ -80,6 +81,7 @@ class RestAPI(CoreSysAttributes):
         self._register_services()
         self._register_snapshots()
         self._register_supervisor()
+        self._register_store()
 
         await self.start()
 
@@ -226,6 +228,10 @@ class RestAPI(CoreSysAttributes):
         self.webapp.add_routes(
             [
                 web.get("/resolution/info", api_resolution.info),
+                web.post(
+                    "/resolution/check/{check}/options", api_resolution.options_check
+                ),
+                web.post("/resolution/check/{check}/run", api_resolution.run_check),
                 web.post(
                     "/resolution/suggestion/{suggestion}",
                     api_resolution.apply_suggestion,
@@ -238,6 +244,7 @@ class RestAPI(CoreSysAttributes):
                     "/resolution/issue/{issue}",
                     api_resolution.dismiss_issue,
                 ),
+                web.post("/resolution/healthcheck", api_resolution.healthcheck),
             ]
         )
 
@@ -338,12 +345,10 @@ class RestAPI(CoreSysAttributes):
                 web.get("/addons", api_addons.list),
                 web.post("/addons/reload", api_addons.reload),
                 web.get("/addons/{addon}/info", api_addons.info),
-                web.post("/addons/{addon}/install", api_addons.install),
                 web.post("/addons/{addon}/uninstall", api_addons.uninstall),
                 web.post("/addons/{addon}/start", api_addons.start),
                 web.post("/addons/{addon}/stop", api_addons.stop),
                 web.post("/addons/{addon}/restart", api_addons.restart),
-                web.post("/addons/{addon}/update", api_addons.update),
                 web.post("/addons/{addon}/options", api_addons.options),
                 web.post(
                     "/addons/{addon}/options/validate", api_addons.options_validate
@@ -469,6 +474,46 @@ class RestAPI(CoreSysAttributes):
             ]
         )
 
+    def _register_store(self) -> None:
+        """Register store endpoints."""
+        api_store = APIStore()
+        api_store.coresys = self.coresys
+
+        self.webapp.add_routes(
+            [
+                web.get("/store", api_store.store_info),
+                web.get("/store/addons", api_store.addons_list),
+                web.get("/store/addons/{addon}", api_store.addons_addon_info),
+                web.get("/store/addons/{addon}/{version}", api_store.addons_addon_info),
+                web.post(
+                    "/store/addons/{addon}/install", api_store.addons_addon_install
+                ),
+                web.post(
+                    "/store/addons/{addon}/install/{version}",
+                    api_store.addons_addon_install,
+                ),
+                web.post("/store/addons/{addon}/update", api_store.addons_addon_update),
+                web.post(
+                    "/store/addons/{addon}/update/{version}",
+                    api_store.addons_addon_update,
+                ),
+                web.post("/store/reload", api_store.reload),
+                web.get("/store/repositories", api_store.repositories_list),
+                web.get(
+                    "/store/repositories/{repository}",
+                    api_store.repositories_repository_info,
+                ),
+            ]
+        )
+
+        # Reroute from legacy
+        self.webapp.add_routes(
+            [
+                web.post("/addons/{addon}/install", api_store.addons_addon_install),
+                web.post("/addons/{addon}/update", api_store.addons_addon_update),
+            ]
+        )
+
     def _register_panel(self) -> None:
         """Register panel for Home Assistant."""
         panel_dir = Path(__file__).parent.joinpath("panel")

supervisor/api/addons.py

@@ -82,6 +82,7 @@ from ..const import (
     ATTR_STARTUP,
     ATTR_STATE,
     ATTR_STDIN,
+    ATTR_TRANSLATIONS,
     ATTR_UART,
     ATTR_UDEV,
     ATTR_UPDATE_AVAILABLE,
@@ -102,7 +103,8 @@ from ..const import (
 )
 from ..coresys import CoreSysAttributes
 from ..docker.stats import DockerStats
-from ..exceptions import APIError, APIForbidden
+from ..exceptions import APIError, APIForbidden, PwnedError, PwnedSecret
+from ..utils.pwned import check_pwned_password
 from ..validate import docker_ports
 from .utils import api_process, api_process_raw, api_validate
 
@@ -171,6 +173,7 @@ class APIAddons(CoreSysAttributes):
                 ATTR_INSTALLED: addon.is_installed,
                 ATTR_AVAILABLE: addon.available,
                 ATTR_DETACHED: addon.is_detached,
+                ATTR_HOMEASSISTANT: addon.homeassistant_version,
                 ATTR_REPOSITORY: addon.repository,
                 ATTR_BUILD: addon.need_build,
                 ATTR_URL: addon.url,
@@ -264,6 +267,7 @@ class APIAddons(CoreSysAttributes):
             ATTR_SERVICES: _pretty_services(addon),
             ATTR_DISCOVERY: addon.discovery,
             ATTR_IP_ADDRESS: None,
+            ATTR_TRANSLATIONS: addon.translations,
             ATTR_INGRESS: addon.with_ingress,
             ATTR_INGRESS_ENTRY: None,
             ATTR_INGRESS_URL: None,
@@ -335,12 +339,30 @@ class APIAddons(CoreSysAttributes):
         """Validate user options for add-on."""
         addon = self._extract_addon_installed(request)
         data = {ATTR_MESSAGE: "", ATTR_VALID: True}
+
+        # Validate config
         try:
             addon.schema(addon.options)
         except vol.Invalid as ex:
             data[ATTR_MESSAGE] = humanize_error(addon.options, ex)
             data[ATTR_VALID] = False
 
+        # Validate security
+        if self.sys_config.force_security:
+            for secret in addon.pwned:
+                try:
+                    await check_pwned_password(self.sys_websession, secret)
+                    continue
+                except PwnedSecret:
+                    data[ATTR_MESSAGE] = "Add-on use pwned secrets!"
+                except PwnedError as err:
+                    data[
+                        ATTR_MESSAGE
+                    ] = f"Error happening on pwned secrets check: {err!s}!"
+
+                data[ATTR_VALID] = False
+                break
+
         return data
 
     @api_process
@@ -386,12 +408,6 @@ class APIAddons(CoreSysAttributes):
             ATTR_BLK_WRITE: stats.blk_write,
         }
 
-    @api_process
-    def install(self, request: web.Request) -> Awaitable[None]:
-        """Install add-on."""
-        addon = self._extract_addon(request)
-        return asyncio.shield(addon.install())
-
     @api_process
     def uninstall(self, request: web.Request) -> Awaitable[None]:
         """Uninstall add-on."""
@@ -410,12 +426,6 @@ class APIAddons(CoreSysAttributes):
         addon = self._extract_addon_installed(request)
         return asyncio.shield(addon.stop())
 
-    @api_process
-    def update(self, request: web.Request) -> Awaitable[None]:
-        """Update add-on."""
-        addon: Addon = self._extract_addon_installed(request)
-        return asyncio.shield(addon.update())
-
     @api_process
     def restart(self, request: web.Request) -> Awaitable[None]:
         """Restart add-on."""

supervisor/api/discovery.py

@@ -13,7 +13,7 @@ from ..const import (
 from ..coresys import CoreSysAttributes
 from ..discovery.validate import valid_discovery_service
 from ..exceptions import APIError, APIForbidden
-from .utils import api_process, api_validate
+from .utils import api_process, api_validate, require_home_assistant
 
 SCHEMA_DISCOVERY = vol.Schema(
     {
@@ -33,15 +33,10 @@ class APIDiscovery(CoreSysAttributes):
             raise APIError("Discovery message not found")
         return message
 
-    def _check_permission_ha(self, request):
-        """Check permission for API call / Home Assistant."""
-        if request[REQUEST_FROM] != self.sys_homeassistant:
-            raise APIForbidden("Only HomeAssistant can use this API!")
-
     @api_process
+    @require_home_assistant
     async def list(self, request):
         """Show register services."""
-        self._check_permission_ha(request)
 
         # Get available discovery
         discovery = []
@@ -79,13 +74,11 @@ class APIDiscovery(CoreSysAttributes):
         return {ATTR_UUID: message.uuid}
 
     @api_process
+    @require_home_assistant
     async def get_discovery(self, request):
         """Read data into a discovery message."""
         message = self._extract_message(request)
 
-        # HomeAssistant?
-        self._check_permission_ha(request)
-
         return {
             ATTR_ADDON: message.addon,
             ATTR_SERVICE: message.service,

supervisor/api/ingress.py

@@ -25,10 +25,9 @@ from ..const import (
     COOKIE_INGRESS,
     HEADER_TOKEN,
     HEADER_TOKEN_OLD,
-    REQUEST_FROM,
 )
 from ..coresys import CoreSysAttributes
-from .utils import api_process, api_validate
+from .utils import api_process, api_validate, require_home_assistant
 
 _LOGGER: logging.Logger = logging.getLogger(__name__)
 
@@ -50,11 +49,6 @@ class APIIngress(CoreSysAttributes):
 
         return addon
 
-    def _check_ha_access(self, request: web.Request) -> None:
-        if request[REQUEST_FROM] != self.sys_homeassistant:
-            _LOGGER.warning("Ingress is only available behind Home Assistant")
-            raise HTTPUnauthorized()
-
     def _create_url(self, addon: Addon, path: str) -> str:
         """Create URL to container."""
         return f"http://{addon.ip_address}:{addon.ingress_port}/{path}"
@@ -74,18 +68,16 @@ class APIIngress(CoreSysAttributes):
         return {ATTR_PANELS: addons}
 
     @api_process
+    @require_home_assistant
     async def create_session(self, request: web.Request) -> Dict[str, Any]:
         """Create a new session."""
-        self._check_ha_access(request)
-
         session = self.sys_ingress.create_session()
         return {ATTR_SESSION: session}
 
     @api_process
+    @require_home_assistant
     async def validate_session(self, request: web.Request) -> Dict[str, Any]:
         """Validate session and extending how long it's valid for."""
-        self._check_ha_access(request)
-
         data = await api_validate(VALIDATE_SESSION_DATA, request)
 
         # Check Ingress Session
@@ -93,11 +85,11 @@ class APIIngress(CoreSysAttributes):
             _LOGGER.warning("No valid ingress session %s", data[ATTR_SESSION])
             raise HTTPUnauthorized()
 
+    @require_home_assistant
     async def handler(
         self, request: web.Request
     ) -> Union[web.Response, web.StreamResponse, web.WebSocketResponse]:
         """Route data to Supervisor ingress service."""
-        self._check_ha_access(request)
 
         # Check Ingress Session
         session = request.cookies.get(COOKIE_INGRESS)

supervisor/api/jobs.py

@@ -36,6 +36,8 @@ class APIJobs(CoreSysAttributes):
 
         self.sys_jobs.save_data()
 
+        await self.sys_resolution.evaluate.evaluate_system()
+
     @api_process
     async def reset(self, request: web.Request) -> None:
         """Reset options for JobManager."""

supervisor/api/panel/entrypoint.js

@@ -1,9 +1,9 @@
 
 try {
-  new Function("import('/api/hassio/app/frontend_latest/entrypoint.b537a8c0.js')")();
+  new Function("import('/api/hassio/app/frontend_latest/entrypoint.afd8dd1f.js')")();
 } catch (err) {
   var el = document.createElement('script');
-  el.src = '/api/hassio/app/frontend_es5/entrypoint.f493e22d.js';
+  el.src = '/api/hassio/app/frontend_es5/entrypoint.83a2047d.js';
   document.body.appendChild(el);
 }
   

supervisor/api/panel/frontend_es5/chunk.0aeb318c1dfa0b946242.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunk.0aeb318c1dfa0b946242.js","sources":["webpack://home-assistant-frontend/chunk.0aeb318c1dfa0b946242.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.0ca880f618245e0de2ab.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunk.0ca880f618245e0de2ab.js","sources":["webpack://home-assistant-frontend/chunk.0ca880f618245e0de2ab.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.1274df0d4f9b61110840.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk.1274df0d4f9b61110840.js","sources":["webpack://home-assistant-frontend/chunk.1274df0d4f9b61110840.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.1da2af7a753728051dc0.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunk.1da2af7a753728051dc0.js","sources":["webpack://home-assistant-frontend/chunk.1da2af7a753728051dc0.js"],"mappings":";AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.23709353009814f6ec3d.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk.23709353009814f6ec3d.js","sources":["webpack://home-assistant-frontend/chunk.23709353009814f6ec3d.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.2c0dec9d76da4dfd87ad.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk.2c0dec9d76da4dfd87ad.js","sources":["webpack://home-assistant-frontend/chunk.2c0dec9d76da4dfd87ad.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.2e5192dd0552c13e5623.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk.2e5192dd0552c13e5623.js","sources":["webpack://home-assistant-frontend/chunk.2e5192dd0552c13e5623.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.38542ad428e77ec0c4d7.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk.38542ad428e77ec0c4d7.js","sources":["webpack://home-assistant-frontend/chunk.38542ad428e77ec0c4d7.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.3a2a2f6b4ddd0c4883f8.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk.3a2a2f6b4ddd0c4883f8.js","sources":["webpack://home-assistant-frontend/chunk.3a2a2f6b4ddd0c4883f8.js"],"mappings":";AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.42b19ffa1fa277adc9cd.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunk.42b19ffa1fa277adc9cd.js","sources":["webpack://home-assistant-frontend/chunk.42b19ffa1fa277adc9cd.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.480c85c27dcb0da9fc2a.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk.480c85c27dcb0da9fc2a.js","sources":["webpack://home-assistant-frontend/chunk.480c85c27dcb0da9fc2a.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.4e6beec37a57a13ae7aa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk.4e6beec37a57a13ae7aa.js","sources":["webpack://home-assistant-frontend/chunk.4e6beec37a57a13ae7aa.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.5d022e08a13eb31311de.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk.5d022e08a13eb31311de.js","sources":["webpack://home-assistant-frontend/chunk.5d022e08a13eb31311de.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.67e3627d3c04d75f6f9d.js

@@ -1,2 +0,0 @@
-!function(){"use strict";var n,t={14971:function(n,t,e){var r,o,i=e(91107),u=e(9902),a=e.n(u),s=(e(58556),e(62173)),f={renderMarkdown:function(n,t){var e,i=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{};return r||(r=Object.assign({},(0,s.getDefaultWhiteList)(),{"ha-icon":["icon"],"ha-svg-icon":["path"]})),i.allowSvg?(o||(o=Object.assign({},r,{svg:["xmlns","height","width"],path:["transform","stroke","d"],img:["src"]})),e=o):e=r,(0,s.filterXSS)(a()(n,t),{whiteList:e})}};(0,i.Jj)(f)}},e={};function r(n){if(e[n])return e[n].exports;var o=e[n]={exports:{}};return t[n].call(o.exports,o,o.exports,r),o.exports}r.m=t,r.x=function(){r(14971)},r.n=function(n){var t=n&&n.__esModule?function(){return n.default}:function(){return n};return r.d(t,{a:t}),t},r.d=function(n,t){for(var e in t)r.o(t,e)&&!r.o(n,e)&&Object.defineProperty(n,e,{enumerable:!0,get:t[e]})},r.f={},r.e=function(n){return Promise.all(Object.keys(r.f).reduce((function(t,e){return r.f[e](n,t),t}),[]))},r.u=function(n){return"chunk.d93e72d29a82b1218f4a.js"},r.o=function(n,t){return Object.prototype.hasOwnProperty.call(n,t)},n=r.x,r.x=function(){return r.e(474).then(n)},r.p="/api/hassio/app/frontend_es5/",function(){var n={971:1};r.f.i=function(t,e){n[t]||importScripts(""+r.u(t))};var t=self.webpackChunkhome_assistant_frontend=self.webpackChunkhome_assistant_frontend||[],e=t.push.bind(t);t.push=function(t){var o=t[0],i=t[1],u=t[2];for(var a in i)r.o(i,a)&&(r.m[a]=i[a]);for(u&&u(r);o.length;)n[o.pop()]=1;e(t)}}(),r.x()}();
-//# sourceMappingURL=chunk.67e3627d3c04d75f6f9d.js.map

supervisor/api/panel/frontend_es5/chunk.67e3627d3c04d75f6f9d.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunk.67e3627d3c04d75f6f9d.js","sources":["webpack://home-assistant-frontend/chunk.67e3627d3c04d75f6f9d.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.69339833f81fc6a02f8b.js.LICENSE.txt

@@ -0,0 +1,14 @@
+/*! *****************************************************************************
+Copyright (c) Microsoft Corporation.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+***************************************************************************** */

supervisor/api/panel/frontend_es5/chunk.69339833f81fc6a02f8b.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk.69339833f81fc6a02f8b.js","sources":["webpack://home-assistant-frontend/chunk.69339833f81fc6a02f8b.js"],"mappings":";AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.6e0eac4b55be870889b8.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunk.6e0eac4b55be870889b8.js","sources":["webpack://home-assistant-frontend/chunk.6e0eac4b55be870889b8.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.6e5ce6bddf1cc3ddee5c.js

@@ -1,2 +0,0 @@
-(self.webpackChunkhome_assistant_frontend=self.webpackChunkhome_assistant_frontend||[]).push([[914],{92914:function(n,e,r){"use strict";r.r(e),r.d(e,{codeMirror:function(){return c},codeMirrorCss:function(){return i}});var t=r(79074),s=r.n(t),o=r(49338),a=(r(22080),r(19393),r(47181));s().commands.save=function(n){(0,a.B)(n.getWrapperElement(),"editor-save")};var c=s(),i=o.Z}}]);
-//# sourceMappingURL=chunk.6e5ce6bddf1cc3ddee5c.js.map

supervisor/api/panel/frontend_es5/chunk.6e5ce6bddf1cc3ddee5c.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunk.6e5ce6bddf1cc3ddee5c.js","sources":["webpack://home-assistant-frontend/chunk.6e5ce6bddf1cc3ddee5c.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.712a551bcc67f5a1a334.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunk.712a551bcc67f5a1a334.js","sources":["webpack://home-assistant-frontend/chunk.712a551bcc67f5a1a334.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.79b4e240c46ccbe25e4d.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunk.79b4e240c46ccbe25e4d.js","sources":["webpack://home-assistant-frontend/chunk.79b4e240c46ccbe25e4d.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.a03705bab0924c828f4f.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk.a03705bab0924c828f4f.js","sources":["webpack://home-assistant-frontend/chunk.a03705bab0924c828f4f.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.d0222f0b152d21991ec4.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunk.d0222f0b152d21991ec4.js","sources":["webpack://home-assistant-frontend/chunk.d0222f0b152d21991ec4.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.d8cd40ff6f99303c5f8f.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk.d8cd40ff6f99303c5f8f.js","sources":["webpack://home-assistant-frontend/chunk.d8cd40ff6f99303c5f8f.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.d93e72d29a82b1218f4a.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chunk.d93e72d29a82b1218f4a.js","sources":["webpack://home-assistant-frontend/chunk.d93e72d29a82b1218f4a.js"],"mappings":"AAAA","sourceRoot":""}

supervisor/api/panel/frontend_es5/chunk.df460c6964334a453095.js

@@ -0,0 +1,2 @@
+!function(){"use strict";var n,t={14971:function(n,t,e){var r,o,i=e(91107),u=e(9902),s=e.n(u),a=(e(58556),e(62173)),f={renderMarkdown:function(n,t){var e,i=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{};return r||(r=Object.assign({},(0,a.getDefaultWhiteList)(),{"ha-icon":["icon"],"ha-svg-icon":["path"]})),i.allowSvg?(o||(o=Object.assign({},r,{svg:["xmlns","height","width"],path:["transform","stroke","d"],img:["src"]})),e=o):e=r,(0,a.filterXSS)(s()(n,t),{whiteList:e})}};(0,i.Jj)(f)}},e={};function r(n){if(e[n])return e[n].exports;var o=e[n]={exports:{}};return t[n].call(o.exports,o,o.exports,r),o.exports}r.m=t,r.x=function(){return r(14971)},r.n=function(n){var t=n&&n.__esModule?function(){return n.default}:function(){return n};return r.d(t,{a:t}),t},r.d=function(n,t){for(var e in t)r.o(t,e)&&!r.o(n,e)&&Object.defineProperty(n,e,{enumerable:!0,get:t[e]})},r.f={},r.e=function(n){return Promise.all(Object.keys(r.f).reduce((function(t,e){return r.f[e](n,t),t}),[]))},r.u=function(n){return"chunk.23709353009814f6ec3d.js"},r.o=function(n,t){return Object.prototype.hasOwnProperty.call(n,t)},n=r.x,r.x=function(){return r.e(474).then(n)},r.p="/api/hassio/app/frontend_es5/",function(){var n={971:1};r.f.i=function(t,e){n[t]||importScripts(""+r.u(t))};var t=self.webpackChunkhome_assistant_frontend=self.webpackChunkhome_assistant_frontend||[],e=t.push.bind(t);t.push=function(t){var o=t[0],i=t[1],u=t[2];for(var s in i)r.o(i,s)&&(r.m[s]=i[s]);for(u&&u(r);o.length;)n[o.pop()]=1;e(t)}}();r.x()}();
+//# sourceMappingURL=chunk.df460c6964334a453095.js.map

supervisor/api/panel/frontend_es5/chunk.df460c6964334a453095.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk.df460c6964334a453095.js","sources":["webpack://home-assistant-frontend/chunk.df460c6964334a453095.js"],"mappings":"AAAA","sourceRoot":""}