mirror of https://github.com/gesellix/Bose-SoundTouch.git synced 2026-08-19 00:56:16 +00:00

Files

T

968312aa39 Implement Spotify Connect ZeroConf DH blob encryption (#192 )

Replace the simplified tokenType=accesstoken push with the full Spotify
Connect ZeroConf protocol: GET getInfo to fetch the speaker's 768-bit DH
public key, derive AES-128-CTR + HMAC-SHA1 keys from the shared secret,
and POST an encrypted LoginCredentials protobuf blob. Speakers that
receive a proper blob can self-refresh their Spotify session
independently, eliminating the need for periodic re-priming on token
expiry. Falls back to the raw token approach automatically when getInfo
fails, preserving compatibility with older firmware.

SHA1 is mandated by the Spotify Connect ZeroConf protocol spec for DH key derivation. This cannot be changed without breaking protocol compatibility.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-28 15:34:05 +02:00

4.8 KiB

Raw Blame History

Parity Analysis: Bose-SoundTouch (Go) vs. SoundCork (Python)

This document provides a comparative analysis of the current Go implementation and the deborahgu/soundcork project, identifying functional gaps and potential improvements.

1. Core Architecture and Language

Bose-SoundTouch (Go): Uses chi for routing and encoding/xml for data. High performance, strong typing, and precise MIME type handling (application/vnd.bose.streaming-v1.2+xml).
SoundCork (Python): Uses FastAPI and xml.etree.ElementTree. Prioritizes flexibility and rapid prototyping of streaming service mocks.

2. Functional Comparison

Feature	Bose-SoundTouch (Go)	SoundCork (Python)
Group Management	Full CRUD: `POST /group`, `POST /group/{id}`, `DELETE /group/{id}` with XML datastore persistence (`Group_{id}.xml`).	Active group management (`groups.py`), supporting `/addGroup` and stereo pairing logic.
ZeroConf Priming	Full DH key exchange + encrypted blob; fallback to `tokenType=accesstoken` for older firmware.	Simple `tokenType=accesstoken` push only; token expires after ~60 minutes.
BMX Services	Supports TuneIn, Orion, and custom streams.	More modular `bmx_services.json` registry with broader mock support.
Persistence	Mixed JSON/XML datastore.	Pure XML-based persistence per device/account.
Admin UI	CLI-based (`soundtouch-cli`) or API-driven.	Draft Web UI for device discovery and account management (`admin.py`).
Discovery	Integrated setup tools and SSDP/MDNS awareness.	Leverages `bosesoundtouchapi` Python library for active discovery.

3. Key Strengths of SoundCork

Group Pairing Logic: Includes logic to manage master/slave relationships for SoundTouch 10 stereo pairs.
Service Extensibility: JSON-based registry for BMX services makes it easier to mock multiple providers (SiriusXM, Spotify) without code changes.
Mock Coverage: Better coverage of "dummy" endpoints that respond with plausible XML (e.g., customerSupport).

4. Suggested Implementation Steps for Bose-SoundTouch

✅ A. Implement Full Group Support (Completed)

POST /group, POST /group/{id}, DELETE /group/{id} implemented in pkg/service/handlers/handlers_marge.go.
Group CRUD persisted in XML datastore (Group_{id}.xml) via pkg/service/datastore/datastore.go.
GET /group on device registration reads the group the device belongs to.

✅ B. Proper ZeroConf Spotify Blob (Completed)

Full Spotify Connect ZeroConf protocol implemented in pkg/service/spotify/zeroconf.go.
Flow: getInfo (fetch speaker DH public key) → 768-bit DH key exchange → AES-128-CTR encrypted LoginCredentials protobuf blob → addUser.
Speaker can self-refresh credentials independently; no periodic re-priming needed for token expiry.
Automatic fallback to tokenType=accesstoken if getInfo fails (older firmware without DH support).
See docs/concepts/spotify-priming-strategy.md for full protocol details.

C. Modularize BMX Registry (Medium Priority)

Extract the hardcoded service list in HandleBMXRegistry into an external bmx-services.json file.
Allow users to customize which mocked services are advertised to the speaker.

D. Enhanced Source Management (Medium Priority)

Refine source learning logic to ensure all sourceAccount and sourceName metadata is correctly captured during synchronization, using patterns from soundcork's learnSource.

E. Basic Admin Web UI (Low Priority)

Develop a minimal internal status page to list active accounts and connected devices, improving usability over raw API calls.

5. Summary

While our Go implementation is structurally more consistent with recent reference recordings (e.g., buttonNumber, detailed components), SoundCork provides better coverage of multi-device coordination (Groups) and service emulation (BMX) that we should adopt for a more complete offline experience.

4.8 KiB Raw Blame History