Harley
97c3003df0
Serve the WebUI from the sealed uv2nix venv (passthru.hermesVenv) with HERMES_WEBUI_PYTHON pinned so subprocess agent/gateway runs use the venv python, not system python3. HERMES_WEBUI_AGENT_DIR points at the source checkout for run_agent.py + hermes_cli. Localhost-only bind (sessions+memory).
22 lines
1010 B
Diff
22 lines
1010 B
Diff
--- a/matter_server/server/helpers/paa_certificates.py
|
|
+++ b/matter_server/server/helpers/paa_certificates.py
|
|
@@ -68,7 +68,19 @@ async def write_paa_root_cert(
|
|
warnings.simplefilter("ignore", CryptographyDeprecationWarning)
|
|
|
|
- cert = x509.load_pem_x509_certificate(pem_certificate.encode())
|
|
+ try:
|
|
+ cert = x509.load_pem_x509_certificate(pem_certificate.encode())
|
|
+ except ValueError as err:
|
|
+ # A single malformed PAA root certificate in the CSA DCL (e.g. the
|
|
+ # NXP Semiconductors NV PAA) would otherwise abort the entire fetch
|
|
+ # at startup and leave the matter-server websocket unbound. Log the
|
|
+ # cert and skip it so commissioning can proceed.
|
|
+ LOGGER.warning(
|
|
+ "Skipping malformed PAA root certificate '%s': %s",
|
|
+ subject,
|
|
+ err,
|
|
+ )
|
|
+ return False
|
|
|
|
ski: x509.SubjectKeyIdentifier = cert.extensions.get_extension_for_class(
|