5.2 KiB
Reporting security problems
Do not include passwords, private keys, game data, or personal setup logs in a public issue. Report security problems through the repository's private vulnerability reporting feature if enabled, or contact the maintainer privately through an available profile contact.
The installer uses encrypted SSH and explicit SHA256 host-key approval. A changed saved host key is refused. Only public host fingerprints are persisted. Passwords are never stored in project files or passed in command-line arguments.
USB transfer uses a direct physical USB ADB device to forward a temporary local port to the Frame's SSH service. The SSH password and host-key checks remain required; a USB cable does not bypass device identity or authentication. Setup rejects ambiguous device selection and requires an exact serial when several physical USB devices are connected. It does not select an emulator or ADB network device as the USB target.
The release bundles checksum-verified ADB components and their original notices from Google's official Platform Tools package. Setup does not download SDK tools during an installation. Browse adb.exe can select a user-installed replacement; obtain replacements from Google's official Platform Tools download and terms. Only the specific forward created for this setup operation is removed on disconnect. Setup never kills the shared ADB server, removes other applications' forwards, or changes the Frame's Wi-Fi, Steam streaming settings, or Steam/SteamVR session. A cable carries PC-to-Frame SSH/SFTP traffic; the Frame still downloads build dependencies using its own internet connection.
The bundled ADB version is 37.0.1 (protocol 1.0.41). Build-time archive and per-file SHA256 checks are recorded in resources/usb/manifest.json. Runtime validates the bundled executable, its two DLLs, and the unmodified notices before copying them into the versioned %LOCALAPPDATA%/HaloFrameInstaller/usb-tools/37.0.1 cache. ADB on PATH takes precedence; an explicit tool selection overrides automatic discovery. The cache remains available because the shared ADB server may outlive setup.
Setup clears inherited ADB server-address/port overrides and selects a local server. It checks the selected client's protocol against an existing server before issuing normal ADB commands, refusing a mismatch rather than letting the client replace another application's server. It checks the actual operating-system TCP listener for the new forward and refuses non-loopback bindings before SSH authentication sends the password. Setup does not weaken those checks when a tool, device identity, or listener cannot be verified.
The Xbox image parser treats selected files as untrusted, bounds directory/file ranges, rejects unsafe paths and symlinks, and only extracts known retail maps. Remote writes are limited to owned per-user directories. The installer never disables SteamOS read-only mode or uses sudo to install packages.
The source revision is fixed, but the native build still downloads an Ubuntu container and toolchain/dependencies from their upstream distributors. This is not an offline or completely hermetic build. Updates to the fixed source and controller patch must be reviewed and tested together.
Cancellation stops the installer-owned build container; an already completed installation may remain. Repairs back up program files and roll back a failed transaction, preserving saves and unrelated settings. Supplied valid Xbox maps may replace existing maps with backups; no-image repairs reuse existing verified maps. Unknown native folders are adopted only through an explicit Repair request and strict native/data validation. With Steam running, library registration uses the verified client's bounded local interface and reads back the exact native shortcut settings and artwork. Direct library-file edits require Steam to be already closed, use backups, and preserve unrelated entries. Setup never shuts down or relaunches Steam. All paths close their SSH channels; USB also removes its own temporary forward.
The Steam info operation verifies an existing native install and updates only its library information, without map transfers or compilation. Hero, logo, covers, and icon sources are checksum-verified; custom images and icon paths are preserved. The icon's persistent sidecar is restricted to the private owned game folder. Live shortcut-file access for icon identity is read-only, and an uncertain resident icon is deferred rather than overwritten.
The optional game description uses Steam Game Notes through the verified running client, not an unofficial store-identity substitution. Account, native executable, shortcut name, note schema, and document size are checked. Existing notes and unknown fields are retained, edited installer notes are preserved, and a concurrent reread precedes saving. Notes use Steam's normal cloud synchronization; no password or private setup log is placed in them. Unverified Notes results show manual copyable text without restarting Steam or directly writing notes files. The private client interfaces may change; unsupported capabilities fall back to manual steps.