mirror of
https://github.com/Abdess/retroarch_system.git
synced 2026-11-11 12:33:53 -06:00
Abdessamad Derraz
a8fce32051
The installer runs from a one-line command, and no page said how to report a weakness in it without making it public. SECURITY.md names the scope, the private report from the Security tab and how each download is checked.
28 lines
1.4 KiB
Markdown
28 lines
1.4 KiB
Markdown
# Security policy
|
|
|
|
## Scope
|
|
|
|
- The one-line installer: `install.sh`, `install.ps1` and the `install.py` they download.
|
|
- The packs, their manifests under `install/` and the checksums each release publishes.
|
|
- The website, its scripts and the data it serves under `api/`.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Report it privately from the repository's **Security** tab, with **Report a vulnerability**. A public issue is the wrong place for it: the details stay private until a fix is out.
|
|
|
|
A useful report names the file or the page, the steps that show the problem, and what an attacker gains.
|
|
|
|
## Supported versions
|
|
|
|
The installer and the site served from `main`, and the latest release. Older releases are removed when a new one is published.
|
|
|
|
## How downloads are checked
|
|
|
|
- `install.sh` and `install.ps1` download `install.py` from a fixed commit and refuse it unless its SHA-256 matches the one they carry.
|
|
- The installer checks every file against the hash its manifest records before writing it.
|
|
- Each release lists the SHA-256 of its files in `SHA256SUMS.txt`, signed with the key in `allowed_signers`: [verifying a release](https://abdess.github.io/retrobios/wiki/release-process/#verifying-a-release).
|
|
|
|
## Not a security issue
|
|
|
|
A file with an unexpected hash, a missing file or a takedown request: [open an issue](https://github.com/Abdess/retrobios/issues/new) with the file's path or hash.
|