Minecraft Bedrock handheld port 2.0.0-rc.10

Channel: testing

Testing channel release. Final R36S and revised RGDS physical acceptance checks remain pending; this release adds no stable or newly Validated claims. The automated gates — host tests, pinned container client builds, reproducible double-assembly, and the release-safety scan — all pass.

What is new in rc.10

Both Google Play downloaders — the optional on-device one and the mcbedrock-get helper — now have their safety rules written down and enforced by CI rather than stated in prose.

• DOWNLOADER-POLICY.md states the three rules: strictly open source, no hardcoded bypass or cracked licence, and no user credential stored on or transmitted through a third party. scripts/check_downloader_policy.py checks all three on every push.
• Provenance manifests. Every binary shipped with the downloader is declared with its SHA-256, size, upstream commit or in-repo source, licence and build script. An undeclared or rebuilt binary now fails the build. The Windows bundle carries its own PROVENANCE.json beside the executable.
• The helper's Play client is pinned. setup-downloader.sh previously cloned whatever the upstream default branch held that day, so the source behind a built binary could not be named afterwards. It now checks out one pinned commit — the same revision the port's ARM64 gplaydl is built from.
• The saved Google token is now owner-only. It was written at the default mode, which on Linux left a live account token readable by every other user on the machine. It is now 0600 inside a 0700 directory on both platforms.
• Three credential-hygiene leaks closed. A cancelled sign-in no longer leaves Google's one-shot token on the card; sign-out now clears the sign-in capture, exchange input and Qt diagnostic logs; and support bundles — which people attach to public issues — now redact email addresses, Google token prefixes, CRED=/CREDB64= lines and spaced user_token = ... assignments.

Also fixed: two documented %LOCALAPPDATA% paths contained literal control bytes instead of backslashes, printing as mcbedrock-getccount.json and mcbedrock-getersiondb\ in the section explaining where your account token is kept.

Known and documented in the policy: the shipped ARM64 binaries are not reproducible builds, and the sign-in window runs Qt WebEngine with its sandbox disabled.

Carried forward

• Separate standard and RGDS products; the standard archive contains no dual-screen runtime, while RGDS is arm64-only for ROCKNIX/Sway.
• Bedrock 1.16.221.01 remains recommended for performance and handheld UI scaling. The fingerprinted original 1.21.51.01 is the newest tested alternative; 1.26+ is unsupported.
• The Windows helper sets itself up from one button and offers every Bedrock version Google Play still serves. Verify its SHA-256 before allowing an antivirus exception.
• RGDS maps local worlds. LAN client sessions retain live telemetry and show remote terrain as unavailable instead of reusing cached local tiles.

Verifying

Every asset's SHA-256 is in SHA256SUMS.txt. The reproducibility job assembles the release twice and requires the two to be byte-identical.

Legal

No game files are included. Users must supply an official Minecraft Bedrock Android APK or complete split set from an account that owns it.

NOT AN OFFICIAL MINECRAFT PRODUCT. NOT APPROVED BY OR ASSOCIATED WITH MOJANG OR MICROSOFT.