fix(matrix): hard-fail E2EE when python-olm missing + stable MATRIX_DEVICE_ID - #5517
Closed
kshitijk4poor wants to merge 1 commit into
Closed
kshitijk4poor wants to merge 1 commit into
kshitijk4poor wants to merge 1 commit into
Conversation
…EVICE_ID Two issues caused Matrix E2EE to silently not work in encrypted rooms: 1. When matrix-nio is installed without the [e2e] extra (no python-olm / libolm), nio.crypto.ENCRYPTION_ENABLED is False and client.olm is never initialized. The adapter logged warnings but returned True from connect(), so the bot appeared online but could never decrypt messages. Now: check_matrix_requirements() and connect() both hard-fail with a clear error message when MATRIX_ENCRYPTION=true but E2EE deps are missing. 2. Without a stable device_id, the bot gets a new device identity on each restart. Other clients see it as "unknown device" and refuse to share Megolm session keys. Now: MATRIX_DEVICE_ID env var lets users pin a stable device identity that persists across restarts and is passed to nio.AsyncClient constructor + restore_login(). Changes: - gateway/platforms/matrix.py: add _check_e2ee_deps(), hard-fail in connect() and check_matrix_requirements(), MATRIX_DEVICE_ID support in constructor + restore_login - gateway/config.py: plumb MATRIX_DEVICE_ID into platform extras - hermes_cli/config.py: add MATRIX_DEVICE_ID to OPTIONAL_ENV_VARS Closes NousResearch#3521
kshitijk4poor
force-pushed
the
fix/matrix-e2ee-hard-fail-stable-device
branch
from
April 6, 2026 14:23
424c891 to
d877cef
Compare
Collaborator
|
Merged via PR #5665. Your commit was cherry-picked with authorship preserved. Thanks @kshitijk4poor! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Matrix E2EE silently doesn't work in encrypted rooms even when
MATRIX_ENCRYPTION=trueis set. Two root causes:1. Silent degradation when E2EE deps missing
When
matrix-niois installed without the[e2e]extra (no python-olm/libolm),nio.crypto.ENCRYPTION_ENABLEDisFalseandclient.olmis never initialized. The adapter logged warnings butconnect()returnedTrue— bot appeared online but could never decrypt messages in encrypted rooms.2. Unstable device identity across restarts
Without a stable
device_id, each restart creates a new device identity. Other Matrix clients see it as 'unknown device' and refuse to share Megolm session keys, so decryption fails even when the crypto backend is correctly installed.Fix
Hard-fail when E2EE deps are missing:
_check_e2ee_deps()function checksnio.crypto.ENCRYPTION_ENABLEDcheck_matrix_requirements()fails at startup if encryption is requested but deps are missing — clear error message tells users exactly what to installconnect()double-checks and refuses to start if crypto store fails to loadStable device identity via
MATRIX_DEVICE_ID:MATRIX_DEVICE_IDlets users pin a stable device IDnio.AsyncClientconstructor andrestore_login()gateway/config.pyandhermes_cli/config.pyFiles changed
gateway/platforms/matrix.py_check_e2ee_deps(),MATRIX_DEVICE_IDsupportgateway/config.pyMATRIX_DEVICE_IDinto platform extrashermes_cli/config.pyMATRIX_DEVICE_IDtoOPTIONAL_ENV_VARStests/gateway/test_matrix.pyTesting
test_session_race_guard)Note
This fixes the
check_matrix_requirements()andconnect()paths. The deeper E2EE verification flow (SAS device verification, recovery key support) is a separate feature request tracked in #3521 comments.Closes #3521