mirror of
https://github.com/jkdansereau/goldeneye-pc-port.git
synced 2026-10-24 00:02:45 +02:00
James Dansereau
4b710728bf
Deck/Windows playtest fixes: fog rework (D540) and RSP-style CPU near-plane clip with per-vertex N64 fog (D543), with fog recomputed on near-plane-clipped vertices as the RSP does, so the haze around the player stays steady (D553); colour-combiner clamp for banded walls (D548); rocket and thrown-item stack overflows (D545, D549); menu double-trigger mitigation (D541); Dam ending first-shot camera swivel restored by removing an old port look-at workaround (D552); settings standardisation (D546), live All unlocked (D547), F10 mouse (D544); static window title and the project mark (the in-game crosshair shape, site gold) as window/taskbar icon and favicon (D550). Reference frames re-based on Windows, Linux and Steam Deck (A/B-confirmed); capture_p7.sh runs on Windows. Opt-in update check, off by default (D551: one HTTPS request to GitHub per launch when enabled; winhttp.dll loaded only then; the tag CI job checks the tag against GE007_VERSION). Release notes, ROADMAP, internals and security docs updated; tree-hygiene pass. Refs: D540 D541 D543 D544 D545 D546 D547 D548 D549 D550 D551 D552 D553 D554 D555 D556 D557 D558 D559 D560 D561 D562 D563 D564
98 lines
4.3 KiB
Markdown
98 lines
4.3 KiB
Markdown
# Security Policy
|
|
|
|
This project is a non-commercial, fan-made research port. It has no server
|
|
component and no telemetry, and no networking unless you turn on the opt-in
|
|
update check (`Game.CheckUpdates`, off by default), which makes one HTTPS
|
|
request to GitHub's releases API per launch (GitHub sees that request and
|
|
your IP, as with any web request). On Windows it loads the system
|
|
`winhttp.dll` from System32 only then; on Linux/Steam Deck it runs the
|
|
system `curl`. It never downloads or installs anything. Each release ships
|
|
prebuilt Windows and Linux binaries, but never a ROM or any game asset — you
|
|
supply those yourself from a copy you legally own. The realistic security
|
|
surface is:
|
|
|
|
- the PC port executable parsing your own ROM and asset files at load time
|
|
(a malformed ROM/asset could in principle crash it or worse), and
|
|
- the build/extraction scripts and CI workflow.
|
|
|
|
A full walkthrough of what a release actually installs on your machine, and
|
|
what a from-source build pulls in, is in
|
|
[`docs/security.md`](../docs/security.md).
|
|
|
|
### Why the binaries are unsigned
|
|
|
|
The Windows `.exe` and the Linux build are **not code-signed** — this is a
|
|
free, single-developer, non-commercial hobby project with no code-signing
|
|
budget, not a sign of anything wrong with the binary. Two things you may
|
|
run into as a result:
|
|
|
|
- **Windows SmartScreen** may show "Windows protected your PC" on first
|
|
run. Click "More info" → "Run anyway."
|
|
- Some antivirus engines flag `ge007-convert.exe` (the one-time ROM-asset
|
|
converter bundled in the release) specifically, because it's packaged
|
|
with PyInstaller's `--onefile` mode — a well-known trigger for heuristic
|
|
AV engines industry-wide, unrelated to what this project's code actually
|
|
does. The game launches this converter itself on the first run, when the
|
|
derived asset folders are missing, so an AV prompt can appear at that
|
|
moment rather than when you unpack the release. If you want to verify what
|
|
it does, its full source is `prepare-assets.py`, shipped right next to it in
|
|
the same bundle folder. The build pins the PyInstaller version and the CI
|
|
actions it uses (by commit SHA), so what ships is reproducible from this
|
|
repository.
|
|
|
|
### Verifying a release build (build provenance)
|
|
|
|
From **v0.5.0** on, the tag-only CI job attaches an in-toto SLSA
|
|
build-provenance attestation to each release artifact (the zip/tarball and
|
|
its `.sha256` sidecars). The attestation is signed by GitHub's OIDC key for
|
|
*this repository's* workflow running the tagged commit. It does not replace a
|
|
code signature — but it proves that the exact file you downloaded was produced
|
|
by this repo's CI from the release tag, and nothing else. Verify any
|
|
downloaded artifact with:
|
|
|
|
```sh
|
|
gh attestation verify goldeneye-pc-port-0.5.0-win64.zip \
|
|
--repo jkdansereau/goldeneye-pc-port
|
|
```
|
|
|
|
(use the name of the file you downloaded, e.g.
|
|
`goldeneye-pc-port-0.5.0-linux-x86_64.tar.gz` on Linux). A passing check confirms both
|
|
the file's digest and its provenance; a tampered or foreign file fails.
|
|
Releases before v0.5.0 have no attestations — for those, the per-file
|
|
`.sha256` sidecars and a from-source build are the available checks.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please **do not** open a public issue for a security problem.
|
|
|
|
Use GitHub's private vulnerability reporting:
|
|
**Security → Report a vulnerability** on this repository
|
|
(<https://github.com/jkdansereau/goldeneye-pc-port/security/advisories/new>).
|
|
|
|
If that is unavailable, email the maintainer at the address on their GitHub
|
|
profile with `SECURITY` in the subject.
|
|
|
|
Please include:
|
|
|
|
- affected version / commit hash (from `git rev-parse HEAD`),
|
|
- OS and how you built (region, `IDO_RECOMP`, MSYS2 vs WSL, …),
|
|
- a minimal reproduction, and
|
|
- the crash log (`ge007.crash.log`) or a stack trace if you have one.
|
|
|
|
## Scope
|
|
|
|
In scope: memory-safety bugs in the `port/` layer and PC-port tooling,
|
|
issues in the CI workflow or build scripts, and dependency problems we can
|
|
act on.
|
|
|
|
Out of scope: bugs inherited unchanged from the upstream
|
|
[GoldenEye 007 decompilation](https://github.com/n64decomp/007) that are not
|
|
made worse by the port (report those upstream), missing-asset or wrong-ROM
|
|
errors, and anything requiring a ROM or assets we do not distribute.
|
|
|
|
## Supported versions
|
|
|
|
Only the tip of the default branch and the
|
|
[latest release](https://github.com/jkdansereau/goldeneye-pc-port/releases/latest)
|
|
are supported.
|