Skip to content

Verification Request: homebridge-rivian #1089

New issue
New issue
Closed
Closed
Verification Request: homebridge-rivian#1089
Labels
request-verificationverifieduse when a plugin meets the criteria - adds the verified badge text

Description

@tvearl
tvearl
opened on Jun 15, 2026

Plugin Name

homebridge-rivian

Link To GitHub Repo

https://github.com/tvearl/homebridge-rivian

Plugin Icon (Optional)

Image

The plugin does not offer the same nor less functionality than that of any existing verified plugin.

🟢 Yes

The plugin successfully installs and does not start unless it is configured.

🟢 Yes

The plugin does not require the user to run Homebridge in a TTY or with non-standard startup parameters, even for initial configuration.

🟢 Yes

The plugin does not contain any analytics or calls that enable you to track the user.

🟢 Yes

If the plugin needs to write files to disk (cache, keys, etc.), it stores them inside the Homebridge storage directory.

🟢 Yes

The plugin does not throw unhandled exceptions, the plugin must catch and log its own errors.

🟢 Yes

More Information

verified functionality for R1T and R1S. NPM packages are publicly published

Activity

  1. tvearl
    added
    pendingthe label given to a new verification/icon request
    request-verification
    on Jun 15, 2026

  2. github-actions commented on Jun 15, 2026

    @github-actions
    github-actionsBot
    on Jun 15, 2026 – with GitHub Actions
    Contributor

    Note

    The verification check script has recently been updated. If you believe any result below is incorrect (a false positive), please reply to this issue and let us know — it helps us tune the new checks.

    🔴 Failed Checks

    • Config Schema JSON: schema is invalid - required should not be a boolean property on individual fields. In JSON Schema, required must be an array at the object level listing required property names. Remove "required": true/false from individual properties and use "required": ["property1", "property2"] at the object level instead.

    🟢 Passed Checks

    • Installation: successfully installed
    • Package JSON: homepage exists
    • Package JSON: bugs.url exists and seems a valid URL
    • Package JSON: keywords exist and contain 'homebridge-plugin'
    • Package JSON: 'preinstall' in scripts is not present
    • Package JSON: 'install' in scripts is not present
    • Package JSON: 'postinstall' in scripts is not present
    • Package JSON: engines.node property is compatible with Node 22
    • Package JSON: engines.node property is compatible with Node 24
    • Package JSON: engines.homebridge property is compatible with Homebridge 2.1.0
    • Package JSON: initializer function found
    • NPM Package: has not been deprecated
    • GitHub Repo: version in package.json (v1.3.0) matches NPM version (v1.3.0)
    • Config Schema JSON: exists and is valid JSON
    • Config Schema JSON: contains a valid pluginAlias
    • Config Schema JSON: pluginAlias matches the platform/accessory registered in code
    • Config Schema JSON: the pluginType is set to 'platform'
    • Config Schema JSON: contains a name schema property
    • Dependencies: homebridge is not declared as a runtime/peer/bundled dependency
    • Dependencies: hap-nodejs is not declared as a runtime/peer/bundled dependency
    • Security: no known vulnerabilities in dependencies
    • Security: code patterns flagged for manual review
    • Security: no privilege escalation attempts detected
    • GitHub Repo: repository is public
    • GitHub Repo: repository is not archived
    • GitHub Repo: issues are enabled
    • GitHub Repo: contains releases

    🔍 For Manual Review

    The following items were detected and require manual review. We understand that these items may be false positives.

    • Security [Critical]: accesses private keys in dist/crypto.d.ts, dist/crypto.js and 7 more
    • Security: accesses environment files in dist/auth-cli.js

    ℹ️ Check Details

    • These checks were run against v1.3.0 of the plugin.
    • Link to the run workflow: visit →.

    📋 Next Steps

    • Please action these failures and then comment /check to run the checks again.
    • If updating your package.json and config.schema.json files, don't forget to publish a new version to NPM.
    • Remember this is an automatic script: if you think something has been marked as a failure in error, let us know with a reply.
    • Feel free to ask any questions you have by replying to this issue.
  3. github-actions
    added
    awaiting-changesuse after review has started - awaiting user to make changes to plugin
    and removed
    pendingthe label given to a new verification/icon request
    on Jun 15, 2026

  4. tvearl commented on Jun 15, 2026

    @tvearl
    tvearl
    on Jun 15, 2026
    Author

    Thanks for the review! I've fixed the failing check and published a new version.

    Fixed: config.schema.json now declares the required field at the object level ("required": ["name"]) instead of "required": true on the property. Published as v1.3.3 to npm.

    On the two manual-review items (both expected, not exfiltration):

    • Accesses private keys (dist/crypto.*) — by design. This plugin enrolls as a Rivian "phone key": it generates a secp256r1 key pair locally and signs vehicle commands with an HMAC over an ECDH-derived shared secret (the same scheme the Rivian app/keys use). The private key is generated on-device, used only to sign commands to Rivian's official API, and stored only inside the Homebridge storage directory. Only the public half is ever sent out (during enrollment).
    • Accesses environment files (dist/auth-cli.js) — this is the optional headless CLI reading the UIX_STORAGE_PATH / HOMEBRIDGE_STORAGE_PATH environment variables to locate the Homebridge storage directory (where it writes the auth file). It does not read .env files or any secrets.

    There is no analytics/telemetry and nothing is written outside the Homebridge storage path.

  5. tvearl commented on Jun 15, 2026

    @tvearl
    tvearl
    on Jun 15, 2026
    Author

    /check

  6. github-actions
    added
    pendingthe label given to a new verification/icon request
    and removed
    awaiting-changesuse after review has started - awaiting user to make changes to plugin
    on Jun 15, 2026

  7. github-actions commented on Jun 15, 2026

    @github-actions
    github-actionsBot
    on Jun 15, 2026 – with GitHub Actions
    Contributor

    Note

    The verification check script has recently been updated. If you believe any result below is incorrect (a false positive), please reply to this issue and let us know — it helps us tune the new checks.

    🟢 Passed Checks

    • Installation: successfully installed
    • Package JSON: homepage exists
    • Package JSON: bugs.url exists and seems a valid URL
    • Package JSON: keywords exist and contain 'homebridge-plugin'
    • Package JSON: 'preinstall' in scripts is not present
    • Package JSON: 'install' in scripts is not present
    • Package JSON: 'postinstall' in scripts is not present
    • Package JSON: engines.node property is compatible with Node 22
    • Package JSON: engines.node property is compatible with Node 24
    • Package JSON: engines.homebridge property is compatible with Homebridge 2.1.0
    • Package JSON: initializer function found
    • NPM Package: has not been deprecated
    • GitHub Repo: version in package.json (v1.3.3) matches NPM version (v1.3.3)
    • Config Schema JSON: exists and is valid JSON
    • Config Schema JSON: contains valid JSON Schema
    • Config Schema JSON: schema has valid type property
    • Config Schema JSON: schema has valid properties for object type
    • Config Schema JSON: contains a valid pluginAlias
    • Config Schema JSON: pluginAlias matches the platform/accessory registered in code
    • Config Schema JSON: the pluginType is set to 'platform'
    • Config Schema JSON: contains a name schema property
    • Dependencies: homebridge is not declared as a runtime/peer/bundled dependency
    • Dependencies: hap-nodejs is not declared as a runtime/peer/bundled dependency
    • Security: no known vulnerabilities in dependencies
    • Security: code patterns flagged for manual review
    • Security: no privilege escalation attempts detected
    • Runtime: homebridge installed successfully
    • Runtime: no config - homebridge should start without plugin configuration and plugin should not load
    • Runtime: platform only - plugin should start with just platform property
    • Runtime: minimal required - plugin should start with minimal required configuration
    • Runtime: full config - plugin should start with comprehensive configuration
    • Runtime: plugin shuts down cleanly within 12s of SIGTERM
    • Runtime: plugin restarts cleanly without port conflicts
    • GitHub Repo: repository is public
    • GitHub Repo: repository is not archived
    • GitHub Repo: issues are enabled
    • GitHub Repo: contains releases

    🔍 For Manual Review

    The following items were detected and require manual review. We understand that these items may be false positives.

    • Security [Critical]: accesses private keys in dist/crypto.d.ts, dist/crypto.js and 7 more
    • Security: accesses environment files in dist/auth-cli.js

    ℹ️ Check Details

    • These checks were run against v1.3.3 of the plugin.
    • Link to the run workflow: visit →.

    📋 Next Steps

    All checks passed successfully, nice work! Your plugin and/or icon will now be manually reviewed by the Homebridge team.

  8. github-actions
    added
    awaiting-final-review
    and removed
    pendingthe label given to a new verification/icon request
    on Jun 15, 2026

  9. bwp91 commented on Jul 13, 2026

    @bwp91
    bwp91
    on Jul 13, 2026
    Contributor

    /check

  10. github-actions
    added
    pendingthe label given to a new verification/icon request
    and removed
    awaiting-final-review
    on Jul 13, 2026

  11. github-actions commented on Jul 13, 2026

    @github-actions
    github-actionsBot
    on Jul 13, 2026 – with GitHub Actions
    Contributor

    🟢 Passed Checks

    • Installation: successfully installed
    • Package JSON: homepage exists
    • Package JSON: bugs.url exists and seems a valid URL
    • Package JSON: keywords exist and contain 'homebridge-plugin'
    • Package JSON: 'preinstall' in scripts is not present
    • Package JSON: 'install' in scripts is not present
    • Package JSON: 'postinstall' in scripts is not present
    • Package JSON: engines.node property is compatible with Node 22
    • Package JSON: engines.node property is compatible with Node 24
    • Package JSON: engines.homebridge property is compatible with Homebridge 2.1.1
    • Package JSON: initializer function found
    • NPM Package: has not been deprecated
    • GitHub Repo: version in package.json (v1.4.1) matches NPM version (v1.4.1)
    • Config Schema JSON: exists and is valid JSON
    • Config Schema JSON: contains valid JSON Schema
    • Config Schema JSON: schema has valid type property
    • Config Schema JSON: schema has valid properties for object type
    • Config Schema JSON: contains a valid pluginAlias
    • Config Schema JSON: pluginAlias matches the platform/accessory registered in code
    • Config Schema JSON: the pluginType is set to 'platform'
    • Config Schema JSON: contains a name schema property
    • Dependencies: homebridge is not declared as a runtime/peer/bundled dependency
    • Dependencies: hap-nodejs is not declared as a runtime/peer/bundled dependency
    • Security: no known vulnerabilities in dependencies
    • Security: code patterns flagged for manual review
    • Security: no privilege escalation attempts detected
    • Runtime: homebridge installed successfully
    • Runtime: no config - homebridge should start without plugin configuration and plugin should not load
    • Runtime: platform only - plugin should start with just platform property
    • Runtime: minimal required - plugin should start with minimal required configuration
    • Runtime: full config - plugin should start with comprehensive configuration
    • Runtime: plugin shuts down cleanly within 12s of SIGTERM
    • Runtime: plugin restarts cleanly without port conflicts
    • GitHub Repo: repository is public
    • GitHub Repo: repository is not archived
    • GitHub Repo: issues are enabled
    • GitHub Repo: contains releases

    🔍 For Manual Review

    The following items were detected and require manual review. We understand that these items may be false positives.

    • Security [Critical]: accesses private keys in dist/crypto.d.ts, dist/crypto.js and 7 more
    • Security: accesses environment files in dist/auth-cli.js

    ℹ️ Check Details

    • These checks were run against v1.4.1 of the plugin.
    • Link to the run workflow: visit →.

    📋 Next Steps

    All checks passed successfully, nice work! Your plugin and/or icon will now be manually reviewed by the Homebridge team.

  12. github-actions
    added
    awaiting-final-review
    and removed
    pendingthe label given to a new verification/icon request
    on Jul 13, 2026
  13. bwp91
    added a commit that references this issue on Jul 13, 2026

    verify: homebridge-rivian

    8973773
  14. bwp91
    added
    verifieduse when a plugin meets the criteria - adds the verified badge text
    on Jul 13, 2026

  15. github-actions commented on Jul 13, 2026

    @github-actions
    github-actionsBot
    on Jul 13, 2026 – with GitHub Actions
    Contributor

    Congratulations! Your plugin has been verified!

    You can now add one of the Verified by Homebridge badges to your plugin's README:

    verified-by-homebridge

    [![verified-by-homebridge](https://img.shields.io/badge/_-verified-blueviolet?color=%23491F59&style=flat&logoColor=%23FFFFFF&logo=homebridge)](https://github.com/homebridge/homebridge/wiki/Verified-Plugins)

    verified-by-homebridge

    [![verified-by-homebridge](https://img.shields.io/badge/homebridge-verified-blueviolet?color=%23491F59&style=flat)](https://github.com/homebridge/homebridge/wiki/Verified-Plugins)

    verified-by-homebridge

    [![verified-by-homebridge](https://img.shields.io/badge/homebridge-verified-blueviolet?color=%23491F59&style=for-the-badge&logoColor=%23FFFFFF&logo=homebridge)](https://github.com/homebridge/homebridge/wiki/Verified-Plugins)

    Your plugin is now also eligible to display a ❤️ Donate button on its tile in the Homebridge UI. See https://github.com/homebridge/homebridge/wiki/Donation-Links for instructions.

    Interested in getting a @homebridge-plugins/ scope for your plugin? See our Homebridge Scoped Plugins program.

    If for any reason in the future you can no longer maintain your plugin, please consider transferring it to our Homebridge Plugins organization.

    Don't forget to join the official Homebridge Discord server, where plugin developers can get tips and advice from other developers and the Homebridge project team in the #plugin-development channel!

    As a verified plugin, you can request a channel in the Discord server to discuss your plugin with users and other developers. Just ask in the #plugin-development channel.

    Thank you for your contribution to the Homebridge community.

    • The Homebridge Team
  16. github-actions
    removed
    awaiting-final-review
    on Jul 13, 2026

  17. bwp91 commented on Jul 13, 2026

    @bwp91
    bwp91
    on Jul 13, 2026
    Contributor

    Thanks for your patience — your plugin is now verified! 🎉

  18. bwp91
    closed this as completedon Jul 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    request-verificationverifieduse when a plugin meets the criteria - adds the verified badge text

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions