0 Fork 0

mirror of https://github.com/Abdess/retroarch_system.git synced 2026-11-11 12:33:53 -06:00

Files

T

Abdessamad Derraz a8fce32051 docs: add a security policy

The installer runs from a one-line command, and no page said how to
report a weakness in it without making it public. SECURITY.md names the
scope, the private report from the Security tab and how each download
is checked.

2026-11-09 08:25:58 +01:00

1.4 KiB

Raw Blame History

Security policy

Scope

The one-line installer: install.sh, install.ps1 and the install.py they download.
The packs, their manifests under install/ and the checksums each release publishes.
The website, its scripts and the data it serves under api/.

Reporting a vulnerability

Report it privately from the repository's Security tab, with Report a vulnerability. A public issue is the wrong place for it: the details stay private until a fix is out.

A useful report names the file or the page, the steps that show the problem, and what an attacker gains.

Supported versions

The installer and the site served from main, and the latest release. Older releases are removed when a new one is published.

How downloads are checked

install.sh and install.ps1 download install.py from a fixed commit and refuse it unless its SHA-256 matches the one they carry.
The installer checks every file against the hash its manifest records before writing it.
Each release lists the SHA-256 of its files in SHA256SUMS.txt, signed with the key in allowed_signers: verifying a release.

Not a security issue

A file with an unexpected hash, a missing file or a takedown request: open an issue with the file's path or hash.

1.4 KiB Raw Blame History