openOMSI 0.2.48

openOMSI 0.2.48

Early release, expect bugs. openOMSI needs an original OMSI 2 installation to run; it contains no game content.

Additional security hardening and verification for mods, maps and online sessions (thanks to @thibautgnt); the details are in the list below. Online play needs 0.2.48 on every computer (the session protocol moves from 6 to 7; 0.2.47 was not released; an older game is refused cleanly when it joins), and a dedicated server's admin_password needs at least 8 characters.

New

• Model test in the launcher, for modders: a bus is loaded exactly as for a drive, without a window, and every warning and error of its .bus, model, meshes, scripts, constfiles and paint schemes is listed, with the textures that are not there; the running game's warnings show live beside it (openomsi --check-vehicle) (#2524, by @icacar98-dot).
• The navigator and the city map show the land under the roads on a map that brings a package (Maps/<Map>/openomsi-realmap): water, parks and woods, rivers, rail and borders, in a dark or a light look; two new settings (Navigator surface, Light navigator). See docs/MAP_PACKAGE.md (#2529, by @lmonteirotech).
• The launcher grows with its window on a big or wide screen, and has a Launcher size setting; Launcher layout: Classic brings back the Drive page in steps (Bus, Day & weather, Map & duty); the bus preview can be looked at from the passenger's and the driver's seat; the launcher asks less of a weaker computer and rests while you drive (#2493, by @thibautgnt; it supersedes #1631).

Fixes

• Hardening (by @thibautgnt): mod archives can no longer write outside the mod being installed; texture and other content names cannot point at another computer (\\server\share) or climb out of the content folders, nor can another player's roller blind and script strings; online sessions: the host is signed (a per-session key), so nobody can pose as it on the relay or for its mods, a player's place cannot be taken with an overheard hello, the session is not told to strangers from outside the network, and a dedicated server's admin login uses PBKDF2 instead of one hash over plain UDP; bans hold the player's address; the mods download, the WebSocket gateway and files that claim billions of entries can no longer exhaust memory or hang the game; crafted glTF, .x, TGA and zip files no longer crash it; Android: other apps can no longer fake an update's answer; the website shows issue text through an allowlist with a Content-Security-Policy.
• Hardening: the launcher's glib (GTK3, Linux) has the fix of RUSTSEC-2024-0429: its VariantStrIter wrote through a pointer it did not own mutably.
• Hardening: ruzstd 0.9.1, the zstd decoder of plugin packages (.oop): a tiny crafted file could make it ask for all the memory (RUSTSEC-2026-0344).
• The loading screen has its plain dark background again, without the map's picture (0.2.46 put it there, #1383).
• Passengers read the destination from the IBIS: the depot row the IBIS was set to, not the display script's own row - nobody boarded a bus showing a code typed past the list (#2508, by @icacar98-dot).
• With one door open, nobody waits at a shut door with a button: they walk to the open one (#2509, by @icacar98-dot).
• People who get off where there is no pavement spread out beside the bus instead of crowding the doorway, before they go (#2510, by @icacar98-dot).
• The map's drivers stay out of the passengers also when its humans.txt names nobody installed (#2511, by @icacar98-dot).
• A repaint's folder no longer paints over the details of the other repaints in it: only what its .cti names comes from there (#2515, by @icacar98-dot).
• A paint scheme's [setvar]s are written before every frame of the scripts, as Omsi.exe does - the IK-201's display went back to Latin letters only so (#2519, by @icacar98-dot).
• Serbian and Croatian text in Windows-1250 (č, ć, đ with š or ž) is read as such, no longer as Western letters (#2521, by @icacar98-dot).
• Mac: the app is no longer overwritten by the game program beside it (#2522, by @thibautgnt).
• iPhone: the touch buttons answer where they are drawn from the first drive (#2491, by @thibautgnt).
• Dependencies: the crates' minor updates, pollster 1.0 and sha2 0.11 (#2544, #2545, #2546); Dependabot now comes once a month with the major versions grouped.

Downloads

Platform	Download
Windows x64	openOMSI-0.2.48-windows-x64.zip
Windows ARM64	openOMSI-0.2.48-windows-arm64.zip
macOS (Apple silicon)	openOMSI-0.2.48-macos-arm64.zip
macOS (Intel)	openOMSI-0.2.48-macos-x64.zip
Linux x64	openOMSI-0.2.48-linux-x64.zip
Linux ARM64	openOMSI-0.2.48-linux-arm64.zip
Android (arm64, 8.0+)	openOMSI-0.2.48-android-arm64.apk
Dedicated server, Linux	openOMSI-0.2.48-server-linux-x64.zip, openOMSI-0.2.48-server-linux-arm64.zip
Dedicated server, Windows	openOMSI-0.2.48-server-windows-x64.zip, openOMSI-0.2.48-server-windows-arm64.zip