James Dansereau
ad3856892a
build-pc.sh Windows temp-dir re-exec fixes; CI pin actions and no-cache ROM handling; original-N64 and Deck presets; D440 preset labelling; D442 All unlocked as a RAM/query-time override; D443 settings values (MSAA 16x, Restart game); D444 front-end Previous/Next paging; D447 Original-aspect pillarbox/letterbox. Outside contributions by dolent: PRs #120 and #121 (relabelled D445, D446), merged as dolent's original commits. Refs: D440 D441 D442 D443 D444 D445 D446 D447 D387 D283 #120 #121
3.1 KiB
Security Policy
This project is a non-commercial, fan-made research port. It has no server component, no networking of any kind, and no telemetry. Each release ships prebuilt Windows and Linux binaries, but never a ROM or any game asset — you supply those yourself from a copy you legally own. The realistic security surface is:
- the PC port executable parsing your own ROM and asset files at load time (a malformed ROM/asset could in principle crash it or worse), and
- the build/extraction scripts and CI workflow.
A full walkthrough of what a release actually installs on your machine, and
what a from-source build pulls in, is in
docs/security-and-fidelity-status.md.
Why the binaries are unsigned
The Windows .exe and the Linux build are not code-signed — this is a
free, single-developer, non-commercial hobby project with no code-signing
budget, not a sign of anything wrong with the binary. Two things you may
run into as a result:
- Windows SmartScreen may show "Windows protected your PC" on first run. Click "More info" → "Run anyway."
- Some antivirus engines flag
ge007-convert.exe(the one-time ROM-asset converter bundled in the release) specifically, because it's packaged with PyInstaller's--onefilemode — a well-known trigger for heuristic AV engines industry-wide, unrelated to what this project's code actually does. The game launches this converter itself on the first run, when the derived asset folders are missing, so an AV prompt can appear at that moment rather than when you unpack the release. If you want to verify what it does, its full source isprepare-assets.py, shipped right next to it in the same bundle folder. The build pins the PyInstaller version and the CI actions it uses (by commit SHA), so what ships is reproducible from this repository.
Reporting a vulnerability
Please do not open a public issue for a security problem.
Use GitHub's private vulnerability reporting: Security → Report a vulnerability on this repository (https://github.com/jkdansereau/goldeneye-pc-port/security/advisories/new).
If that is unavailable, email the maintainer at the address on their GitHub
profile with SECURITY in the subject.
Please include:
- affected version / commit hash (from
git rev-parse HEAD), - OS and how you built (region,
IDO_RECOMP, MSYS2 vs WSL, …), - a minimal reproduction, and
- the crash log (
ge007.crash.log) or a stack trace if you have one.
Scope
In scope: memory-safety bugs in the port/ layer and PC-port tooling,
issues in the CI workflow or build scripts, and dependency problems we can
act on.
Out of scope: bugs inherited unchanged from the upstream GoldenEye 007 decompilation that are not made worse by the port (report those upstream), missing-asset or wrong-ROM errors, and anything requiring a ROM or assets we do not distribute.
Supported versions
Only the tip of the default branch and the latest release are supported.