transmission-cli 3.00-3 unauthroized user

[karog]

Upgraded from transmission-cli-3.00-2-aarch64.pkg.tar.xz to transmission-cli-3.00-3-aarch64.pkg.tar.xz on odroid n2.

$this->bbcode_second_pass_code('', '$ uname -a
Linux n2 5.16.8-1-aarch64-ARCH #1 SMP Thu Feb 10 03:50:07 UTC 2022 aarch64 GNU/Linux
')
Now client Transmission Remote GUI on mac gets Unauthorized User error when trying to connect. Downgraded and working again.

[zebul666]

with the latest transmission-cli 3-00-3, I can't login to the rpc server anymore on 9091 port

If I downgrade to 3.00-2, it works again.

Something broke with the new build of the package using libraries ?

[graysky]

MOD NOTE - merging

[zebul666]

I don't know why but I can't login succefully on the RPC server of transmission-daemon from transmission-cli-3.00-3 on armv7h (rpi3b)

It keeps endlessly asking for the username and password in the browser.

That works fine at the first attempt when using the older version of the package 3.00-2

[graysky]

MOD NOTE - merging again

[zebul666]

This seems to me like a packaging issue with the rebuilt with libraries in the pkgrel 3 of transmission-3.00

Unless this has to do with the new toolchain, gcc and all.

2 users reporting problem so far.

[jyno]

It appears I've a similar issue with transmission-daemon (and transmission-remote)

[RuneArch]

Just to add...

I spent a few minutes looking at this, thinking that maybe the password had been "reset" to a default.

For whatever reason, there's something wrong with the password hashing now.

With my original (9-character) password, the SHA1 encoding stored in settings.json is not recognised.

Changing my password to a 14 character password worked.

Doesn't matter if it's "<originalpassword>12345" or "aaaaaaaaaaaaaa", the SHA1 hashing works and I can login... 13 character or 15 character password, and nope, unauthorised.

Looking at the instructions, you should be able to stop transmission daemon, enter a plaintext password in settings.json, restart the daemon and then login... but some of the hashes are just plain wrong.

As transmission hasn't changed, then it must be something in the new packaging that's getting warped somewhere.

Anyway, I hope changing your password to 14 characters helps

[zebul666]

The rpc-pasword field in settings.json is created like this:

take a random salt of 8 characters 'vLU2/cH6'
append it to your password 'mypassword' that gives 'mypasswordvLU2/cH6'
calculate sha1sum

then the rpc-password field is a "{"+sha1sum+salt.
Here this gives '{5c6336e5cdf104afa4884c46d75957c0f391d463vLU2/cH6'

@RuneArch everything seems correct to me. I don't see a difference between 3.00-2 and 3.00-3 here

I thought there was a problem with libb64 external library, which is used in the new package. But base64 is not used for the hashing of the password. Where is used libb64 ? May be that is the problem ?
So ?

[graysky]

Is this true on Arch Linux (ie x86_64)? We do not modify their PKGBUILD as far as I know. If a bug is introduced there, it is likely present on ARM as well.