Two follow-ups to the Linux server support in #6. Both are Linux-only, so
neither reached a Windows player.
Session codes
- nonce()'s fallback for a container with no /dev/urandom read
"i < 4 && !value", which ended the loop as soon as the first round
produced anything: one round of sixteen bits instead of four. Over
200k draws that is 62k distinct codes with a ceiling of 0xffff, rather
than 200k across the full range.
libsteam_api.so
- It was fetched from a mirror's main branch with no hash, by CI and by
the script every server operator runs, and it is loaded into the
server process. A branch name is whatever that branch holds on the day
it runs.
- Pinned to mirror commit df2baabf574a and checked against its SHA-256
(385840 bytes, eb2dd015...). The size and export checks already there
catch a wrong file; a hash is what catches a swapped one.
- --sdk-url still overrides the URL and drops the check, since a
different URL has a different hash; --sdk-sha256 keeps it.
Swagi-Redacted