[MohamedElGhandour]

In plain words

MetalSharp could load replacement runtime code without checking who supplied it, and some FEX paths were inserted into shell commands. Steam API keys could also be saved with permissions that exposed them to another local account. These fixes close those paths and preserve existing game prefixes, saves, and login data.

Summary

Harden runtime setup, launcher dependency installation, and credential storage in the C backend. The normal in-app updater already checks the publisher signature; these changes address separate setup and repair paths.

Changes

• Execute FEX signature inspection directly, quote generated wrapper paths literally, and regenerate existing wrappers with facade version 3. Apostrophes and shell metacharacters stay part of the path.
• Use packaged runtime archives for setup and Steam repair. Remove unverified downloads and loose/cache archive lookup; a missing packaged archive asks the user to reinstall the full official app.
• Replace GOG's floating Git/Python installation with the fixed GOGDL v1.3.1 arm64 release, verified against an embedded SHA-256 before atomic installation. Existing users migrate through normal launcher actions without deleting their prefix.
• Save Steam API keys atomically as owner-only files, tighten older files when read, and reject credential-file symlinks.
• Restore TLS certificate verification when retrieving Sunshine checksum metadata. The local Sunshine API's self-signed-certificate handling remains scoped to localhost.

Why this approach

Regular app packaging already requires all six runtime archives. Removing the network fallback keeps those resources covered by the app's signature without adding another checksum publication mechanism. The FEX build already carries its runtime and skips those downloads.

The standalone GOG helper removes the Git, virtualenv, and unpinned package-install steps. Its existing command-line interface matches MetalSharp's callers. Failed verification leaves the previous helper and user data intact.

Verification

Check	Result
make -C app/src-c test	Passed, including new security regressions. Runtime-ready simulation skipped because this source checkout has no runtime archives.
make -C app/src-c VARIANT=fex BUILD_DIR="$PWD/app/src-c/build-fex" test	Passed.
GOG bootstrap tests with the official pinned artifact, both variants	Passed; verified installation and legacy-helper migration preserved prefix, token, and save fixtures. The downloaded executable was not run.
cargo fmt --manifest-path app-gpui/Cargo.toml --check	Passed.
cargo test --manifest-path app-gpui/Cargo.toml --locked --offline	95 passed, 2 existing tests ignored.
python3 tools/ci/verify-dmg-workflow.py	Passed; all six required bundle assets confirmed.
C formatting on changed blocks and new test files; git diff --check; shell syntax	Passed. Existing unrelated formatting was preserved.
codesign --verify --deep --strict on both built backend binaries	Passed; this does not validate a release DMG or publisher notarization.

Backend tests used isolated temporary homes. Regression cases cover crafted paths, invalid CDHashes, old-wrapper regeneration, missing or shadowed bundles, tampered helper downloads, initialized GOG upgrades, legacy credential permissions, and symlink target preservation.

Real-game launch smoke — 28 October 2026

Tested commit 753bb86 with Deadlock (1422450), D3DMetal, regular/Rosetta, using the existing Steam library on the internal drive. Both the frontend and backend were compiled from the PR; unchanged icons and runtime resources were copied from the installed 1.0.0 app into a separate, locally ad-hoc-signed test app. Full deep/strict signature verification passed. The installed application bundle was not modified.

Surface / action	Expected	Observed	Verdict
Local app startup	Supervise the PR backend	Active backend process path and SHA-256 matched the assembled PR package.	Pass
MetalSharp Play button	Launch the installed Windows game through D3DMetal	deadlock.exe started; backend reported appid 1422450 and the same game PID. D3DMetal was loaded.	Pass
Deadlock window	Render actual game content	Two window captures showed different rendered 3D lobby frames and the HUD.	Pass
Sustained launch	Keep the game alive after startup	The same game process remained running for 07:16 before deliberate cleanup.	Pass
Cleanup	Stop only the test game and app	PID-scoped stop removed the test game; the local test app and its backend exited gracefully.	Pass

This was a launch/rendering smoke test, not a multiplayer match, input/audio qualification, performance benchmark, or FEX game test. Existing Steam authentication was reused; no new store login was performed.

PR Readiness (MANDATORY)

• Real-game launch test completed — Deadlock, D3DMetal, regular/Rosetta, internal Steam library; launch and rendering verified above.
• No secrets or personal absolute /Users/... paths introduced.
• Config/rules TOML validation: N/A; no rules or DLL maps changed.
• Version metadata: N/A; no version bump.
• Bottle/runtime migration and launch behavior preserved by regression tests; rollback noted below.
• Architecture docs updated for bundle recovery and GOG installation.
• Regression tests added for the affected security-sensitive behavior.

Risk and remaining checks

A damaged installation now needs the full official app reinstalled instead of downloading replacement runtime archives. Future GOGDL upgrades must update the pinned asset and digest together. Reverting this commit restores the previous behavior.

FEX game launching, standard full-Xcode packaging, release DMG signing/notarization, and real store login remain untested. The separate local regular app was assembled and its full code signature verified for the launch test above. Wine's broad file access and compatibility-related browser sandbox flags need separate isolation/compatibility work; this PR does not claim to make untrusted Windows executables safe.

Created by Codex (GPT-6).