APT package matrix-synapse-py3 clobbers config in homeserver.yaml

[the-moog]

Description

apt-get upgrade on the package matrix-synapse-py3 clobbers the homeserver.yaml
You can choose not to do this (unless you have done a quiet upgrade, but as the contents of the example configuration file changes you need to preserve the supplied file to merge it into your own.

The issue is that either you lose the new example config or you overwrite your own, I preserve my own before the upgrade but this itself causes issues.
Apparently if you restart the homeserver as a new version it should NOT kick all the users, but this is what happens if the config file changes significantly.

Instead, the package installer should supply an example contemporary homeserver.yaml.exaple if the file homeserver.yaml exists so that the existing homeserver.yaml is not clobbered.

Steps to reproduce

apt-get upgrade

Version information

Problem exists in all versions to date (for me 1.12.0-xenial)

• Platform:

Ubuntu Xenial

[richvdh]

APT package matrix-synapse-py3 clobbers config in homeserver.yaml

this is only true if you tell dpkg to overwrite your config; it is just doing what it told you to do.

If you choose to keep the existing config (which is recommended), dpkg will put the updated sample config at /etc/matrix-synapse/homeserver.yaml.dpkg-dist.

Apparently if you restart the homeserver as a new version it should NOT kick all the users, but this is what happens if the config file changes significantly.

this shouldn't happen. Please open a separate issue for it, saying which versions you upgraded from and to, and share a link to your server logs after the upgrade.

[aaronraimist]

It’s happening presumably because they are choosing to get a fresh config and the macaroon shared secret is being changed.

[richvdh]

the macaroon shared secret is no longer used to verify access tokens, since 0.34.1.1 (see #4664).

[aaronraimist]

I thought it was still used and that vulnerability was about what happened if you didn’t have one set

[richvdh]

I think you thought wrong. As it says:

v0.34.1.1 removed the macaroon signature check on regular access tokens (#4374)