Lakka and RetroPie keep the files that differ by case from a platform
name, core extras go to the claim that pins its content, and LRPS2
reads its own GameIndex.
Core lists now come from each platform's own sources: ROCKNIX gains
its standalone emulators, RetroBat drops the Batocera ports it never
ran, Recalbox reads its two MAME releases.
Three refs cited paths under Q3E/src/main/jni that the repository does
not carry: xash3d-fwgs and SeriousSamClassic are git submodules, so the
parent tree holds pointers and nothing else. They read as the separate
repositories they are, which is what the external form is for.
Reading the last two changed blocks turned up the substance.
ETQW_GLSL_SHADER_VERSION went from .3 to .6, and the bundled
zzz_etqwbase.pk4 grew from 136061 to 141815 bytes: the size, md5 and
sha1 the profile recorded describe the pack that was replaced. The new
one is in, the old one kept as a variant for builds that still expect
it, and GameResourceUrl gained two Quake 4 mod entries along the way.
70 refs, 68 anchored and 2 external, none left to read.
SHA256SUMS.txt sat beside the artifacts it vouches for, so whoever could
rewrite a release rewrote the list with it. The packs were already
reproducible, which answers corruption and lets a third party rebuild an
archive byte for byte; nothing answered a rewritten release.
The list is now signed with an ed25519 key kept for this alone, and the
public half is allowed_signers at the repository root, so verification
does not go through the release page: ssh-keygen -Y verify against the
committed file, then sha256sum --check. Rehearsed on all three outcomes:
a good signature, a tampered pack caught by the sums, a rewritten list
caught by the signature.
The release steps sign and upload the signature, the README points a
downloader at the procedure, and the reproducibility section says what
each half proves. Rotation keeps retired lines so past releases stay
verifiable. Three tests hold the trust root, the signing step and the
documented principal in agreement.
dedup.py removes a copy only when another file has the same SHA-1 and
the same name, keeping the higher-priority path, so resolution by hash
still finds the content. Verified rather than assumed: all 17268
manifest entries ship the same bytes as before, no destination gained
or lost, only the source paths consolidate. Every deleted path's content
is still held elsewhere.
12.1 MB and 48 empty directories go with them. The index and the
published artefacts are regenerated on top.
Abdessamad Derraz