Skip to content

Translocator 0.3.0

Choose a tag to compare

View all tags
@Lueken Lueken released this 12 Aug 05:04
· 2 commits to main since this release
v0.3.0
aa44754

Install this one by hand

The updater signing key was replaced in 0.3.0. Your existing launcher will offer
the update and then fail with:

Update failed: The signature was created with a different key than the one provided

That is expected and nothing on your install is touched. Download the installer
below, run it once, and auto-updates work normally afterwards.

Translocator_0.3.0_x64-setup.exe
sha256  31ccb501594b9d93528d616682783368c9f38b6ef74af62019e5394728a4d45b

The previous key's password was recorded incorrectly and could not be recovered.
Retiring it is a one-way door: the old public key is compiled into every 0.2.x
build, so there is no way to reach those installs automatically.

Modpacks are verified before anything is installed

Until now the launcher checked each downloaded mod against a hash printed in the
same document the pack came with, which catches a corrupted download and no
attacker at all. Now:

  • Every pack version is checked against the publisher's Ed25519 signature, bound
    to their Vintage Story account.
  • The first install of a pack records who signed it. Every install afterwards has
    to match, so a pack changing hands stops and asks rather than going through
    quietly. The first install is trust on first use and is not verified against
    anything, which is a real limit rather than a detail.
  • A pack carries a signed revision counter, so an older release can no longer be
    served in place of the current one.
  • Verification runs over the document the Hub served, not a reparsed copy of it.

Pack format v3

Clean break, no compatibility window. Packs published before this need
republishing; The Quire already has been. Packs now declare
min_launcher_version: 0.3.0, so an older launcher is refused rather than
allowed to install something it cannot verify.

Credentials

  • Backups no longer contain your session or your saved server passwords.
  • Signing out clears saved sessions from every installation, not only the current one.
  • Saved server passwords are hidden from the in-app browser.
  • Developer tools are compiled out of release builds.

Also

A pack id from the Hub could reach the filesystem before being validated. It is
checked now before it is joined to any path.

Version numbers in tauri.conf.json, package.json and Cargo.toml had drifted
apart, leaving the launcher reporting 0.1.0 to the pack version gate and to the
Hub. CI now fails when they disagree.

Assets 4
Loading