The installer looked for retroarch.exe in C:\RetroArch-Win64 and
Program Files\RetroArch only, so a RetroArch under Program Files\
RetroArch-Win64, in a Steam library on another drive, or in an
installed ES-DE's Emulators folder went undetected. All three are
searched; Steam libraries come from Steam's own library list.
install.py held a local it never read and, since the registry path
rules, a loop variable shadowing the platform module, so the py38
ruff gate the installer is held to failed. Both are fixed, and the
suite reads the two rules from the syntax tree since CI has no ruff.
The registry declares where each platform keeps its BIOS and every
manifest publishes it, but the installer detects before it fetches
any manifest and never had RetroPie, BizHawk, RetroBat's paths, or
EmuDeck's default folder. It now carries the registry's path rules,
held equal to the registry by a test.
The registry names one path per standalone copy for every platform,
but each manifest places the file its own way, so the installer
looked where the pack had put nothing and copied nothing: EmuDeck's
aes_keys.txt for Azahar, Batocera's switch/prod.keys. Each manifest
copy now names its source, which the installer validates and reads.
The pack builder accepts the aliases declared in the target overrides,
so --target switch works there, but the installer's target manifests
carried only canonical names. The documented word was the one that
failed, and the installer then carried on with every file: 1911 files
and 4.1 GB where the user had asked for the 863 that target needs.
Aliases are emitted beside their canonical target, and an unknown
target now stops the run and lists what is available. A filter is
applied or refused, never ignored.
Every other manifest field was treated as hostile input, but
standalone_copies targets were only length-checked before being
expanded and written to: a traversal component or a symlink already
sitting at the destination sent the copy outside the directory the
user opted into. Targets are now validated like the other paths and a
symlinked destination is never followed.
RETROBIOS_BASE_URL serves the manifest and the files it declares, so
it now has to be HTTPS the way both bootstraps already require of the
installer URL; loopback stays open for the end-to-end tests.
install.ps1 left TLS at the Windows PowerShell 5.1 default, which
GitHub refuses, so the download failed before any hash was checked.
check_local read every file once per declared digest, single threaded.
One read now feeds both, across the same pool the downloads use.
RetroPie had no manifest, so the one-line installer answered 'unknown
platform' for a frontend whose packs do ship.
The manifest is untrusted input. It is now read under a size limit and
validated before use: destinations are contained below the BIOS root,
repo_path stays inside bios/, release_asset is a basename, hashes match
their shape, declared totals match their lists, and every entry has a
download source.
Downloads stream against the declared size, are checked by SHA-256 then
SHA-1, land in a per-process temporary file and are installed with
os.replace. Copies into standalone-emulator directories are opt-in with
--standalone-copies so a detection never writes outside the selected
tree.
Both bootstraps verify install.py against an embedded SHA-256 before
running it, and require the Python version install.py actually needs.
A target that publishes no core list is a target with no filter, not a
broken manifest: rejecting it disabled --target for the whole platform.
Abdessamad Derraz