From a8fce320513a4cad622e0edffabe199f8e8619b9 Mon Sep 17 00:00:00 2001 From: Abdessamad Derraz <3028866+Abdess@users.noreply.github.com> Date: Mon, 9 Nov 2026 08:25:58 +0100 Subject: [PATCH 1/2] docs: add a security policy The installer runs from a one-line command, and no page said how to report a weakness in it without making it public. SECURITY.md names the scope, the private report from the Security tab and how each download is checked. --- SECURITY.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..10667993e --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,27 @@ +# Security policy + +## Scope + +- The one-line installer: `install.sh`, `install.ps1` and the `install.py` they download. +- The packs, their manifests under `install/` and the checksums each release publishes. +- The website, its scripts and the data it serves under `api/`. + +## Reporting a vulnerability + +Report it privately from the repository's **Security** tab, with **Report a vulnerability**. A public issue is the wrong place for it: the details stay private until a fix is out. + +A useful report names the file or the page, the steps that show the problem, and what an attacker gains. + +## Supported versions + +The installer and the site served from `main`, and the latest release. Older releases are removed when a new one is published. + +## How downloads are checked + +- `install.sh` and `install.ps1` download `install.py` from a fixed commit and refuse it unless its SHA-256 matches the one they carry. +- The installer checks every file against the hash its manifest records before writing it. +- Each release lists the SHA-256 of its files in `SHA256SUMS.txt`, signed with the key in `allowed_signers`: [verifying a release](https://abdess.github.io/retrobios/wiki/release-process/#verifying-a-release). + +## Not a security issue + +A file with an unexpected hash, a missing file or a takedown request: [open an issue](https://github.com/Abdess/retrobios/issues/new) with the file's path or hash. From 36e42557dd496dd9e5d85ab4eafa5502df180fb4 Mon Sep 17 00:00:00 2001 From: Abdessamad Derraz <3028866+Abdess@users.noreply.github.com> Date: Mon, 9 Nov 2026 08:25:58 +0100 Subject: [PATCH 2/2] docs: write what-are-bios-files without pronouns The pronoun pass left this start page untouched. Its old heading keeps its anchor. --- wiki/what-are-bios-files.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/wiki/what-are-bios-files.md b/wiki/what-are-bios-files.md index 985839f42..60fd35b65 100644 --- a/wiki/what-are-bios-files.md +++ b/wiki/what-are-bios-files.md @@ -8,7 +8,7 @@ order: 10 A console has a small program inside it. It starts first, then starts the game. This program is the **BIOS**, also called **firmware**. -Get your files +Get the files An **emulator** is an app that acts like a console. For many consoles, it needs a copy of the BIOS. That copy is a file: a **BIOS file**. @@ -17,14 +17,14 @@ a copy of the BIOS. That copy is a file: a **BIOS file**. ## How it works -1. You pick a game in your setup's menu. +1. Pick a game in the setup's menu. 2. The setup starts the emulator. -3. The emulator opens the BIOS file in your **BIOS folder**. +3. The emulator opens the BIOS file in the **BIOS folder**. 4. The game starts. -If step 3 fails, you see "BIOS missing" or a black screen. +If step 3 fails, the screen says "BIOS missing" or stays black. -## Do I need one? +## Which consoles need one? { #do-i-need-one } - **Yes:** PlayStation 1 and 2, Saturn, Neo Geo, PC Engine CD and many home computers. @@ -49,12 +49,12 @@ another for Europe. Some setups check each file's **hash**, a fingerprint of its contents. Batocera, Recalbox and EmuDeck report a version they do not expect. -Our files are the versions each setup expects. +The files here are the versions each setup expects. ## Can a game start without it? Sometimes. Some emulators carry their own code in place of the BIOS. Some games -then glitch or do not start. The real file works best, so we include it. +then glitch or do not start. The real file works best, so the packs include it. ## Is it legal? @@ -62,6 +62,6 @@ Laws differ by country. [Is it legal?](legal.md) ## Next steps -- [Get your files](../which-pack.md) +- [Get the files](../which-pack.md) - [Words used on this site](glossary.md)