Code signing policy

Where things stand

• The list of release files (SHA256SUMS.txt) carries the author’s signature (since v0.5.5).
• The Aegis definitions file carries the author’s signature. A file whose signature does not match is never used.
• The programs (the exe and the others) carry no Windows code signature (publisher certificate) yet. Windows shows its blue warning the first time you open them.

What is code signing?

A mark attached to a file. It lets you check who made the file, and that nobody changed it afterwards.

Two kinds of signature matter for PocketRoles.

• A signature with the author’s keyin place
  Made with a key PocketRoles created itself. It is on the list of release files and on the Aegis definitions file.
• A Windows code signature (Authenticode)not yet
  Attached to a program after a certificate company has checked the publisher. With it, Windows can show the publisher, and the blue warning appears much less often.

What is signed today

The list of release files (SHA256SUMS.txt)

Since v0.5.5, every release on GitHub Releases comes with these 4 files.

A “fingerprint” is a SHA-256 hash. If even one byte of a file changes, its fingerprint changes.

The list has a line # release=<version>, so a list from an old release cannot be reused for a new one. The same version is never re-signed with different content, either: the author’s PC keeps a record of every signed version and its content, and the tool refuses.

This is what SHA256SUMS.txt looks like.

# format=PocketRoles.Release.Sums.v1
# release=0.5.5
<64-character fingerprint>  PocketRoles-0.5.5.zip
<64-character fingerprint>  PocketRoles-Setup-0.5.5.zip

The Aegis definitions file (aegis/definitions.txt)

It holds the cheat-detection rules, the NG words, the shared ban list and more. The mod and the Aegis tray app fetch it from GitHub automatically.

This file is signed with the same key too (definitions.txt.sig).

The mod and the tray app use only a file whose signature matches. If it has no signature, the signature does not match, it was signed with a revoked key, or it is older than the file in use, that file is not used. They then use the values built into the program (and the file they verified and saved earlier).

You can see the result on the tray app’s scan screen (“signature OK”) and with the mod’s /ac rules.

The signing key

Method

RSA 3072-bit / SHA-256

keyid

91400fdf0f5af4ca — the first 16 hex digits of the public key’s fingerprint (SHA-256). The second line of every .sig file reads keyid=91400fdf0f5af4ca.

Private key

Only on the author’s PC, protected by a password, plus one backup kept offline. It is not on GitHub and not in any automated build.

Public key

Inside the mod and the tray app (in the source: src/Net/AegisRules.cs and aegis/Aegis.ps1).

If the key leaks

We switch to a new key and ship a version that lists the old key as revoked. Files signed with a revoked key are no longer used.

What is not signed yet

The files we distribute today (the launcher’s .cmd and .ps1, the mod’s DLL) and the exe launcher we are building carry no Windows code signature.

That is why the blue screen “Windows protected your PC” (SmartScreen) appears the first time you open them. It means “the publisher could not be verified”, not “a virus was found”. To open the file, click “More info”, then “Run anyway”.

If you are unsure, check the file first with the steps under “How to check” below.

One more honest note: today’s launcher does not check SHA256SUMS.txt by itself when it downloads. The check happens only when you follow the steps below.

How to check

1. Check the fingerprint (not damaged, not swapped)

1. From the same release on GitHub Releases, download the zip and SHA256SUMS.txt into the same folder.
2. Open PowerShell in that folder: hold Shift and right-click an empty spot in the folder, then “Open PowerShell window here” (on Windows 11: “Open in Terminal”).
3. Type this and press Enter.

   Get-FileHash .\PocketRoles-0.5.5.zip

4. If the 64-character Hash it shows matches the line with the same file name in SHA256SUMS.txt, the file is fine. Upper and lower case do not matter.

To check everything at once, use this one line (it prints OK or NG for each file).

Get-Content .\SHA256SUMS.txt | ForEach-Object { if ($_ -match '^([0-9a-f]{64})  (.+)$') { $ok = (Get-FileHash -LiteralPath ".\$($Matches[2])").Hash -ieq $Matches[1]; ('{0}  {1}' -f $(if ($ok) { 'OK' } else { 'NG' }), $Matches[2]) } }

What this tells you:

• Nothing was damaged during the download.
• It is the very file named in the list.
• It cannot tell you whether the list itself was swapped. That is what “Check the signature” below is for.

2. Check the signature (is the list really from the author?)

The checking tool is part of the PocketRoles source (tools/sign-definitions.ps1). It needs no private key and no password.

1. On the GitHub page, click “Code”, then “Download ZIP”, and unpack the source.
2. Put the 4 release files (both zips, SHA256SUMS.txt and SHA256SUMS.txt.sig) in one folder.
3. In PowerShell, type the following (replace the two <…> with your own folders).

   powershell -NoProfile -ExecutionPolicy Bypass -File "<source folder>\tools\sign-definitions.ps1" -VerifyRelease "<folder with the 4 files>\SHA256SUMS.txt"

4. If it prints “署名 OK（鍵 91400fdf0f5af4ca）” and a green “検証 OK”, the list was signed with the author’s key. It also compares the zips’ fingerprints with the list. (The tool’s messages are in Japanese.)
5. If red text appears, do not use that file. We would appreciate a note through Contact.

3. The Aegis definitions file

Automatic. The mod and the tray app verify the signature every time they receive the file. To see it yourself, look for “signature OK” on the tray app’s scan screen, or use the mod’s /ac rules.

Who decides about signing

• PocketRoles is made by one person (GitHub: @wakayamachannel).
• Every signature is made by the author, by hand, entering the password on the author’s own PC. Nothing is signed automatically.
• Changes from other people (pull requests) are read and checked in full by the author before they are merged.
• The author’s GitHub account uses two-factor authentication (2FA).

What comes next

• We plan to add a Windows code signature to the exe launcher and are preparing the application for it. It has not been approved yet. Once it is, we will add that here.
• Even with a signature, the blue screen can still appear for a while at first. Windows takes some time to trust a new publisher.
• The mod itself (PocketRoles.dll) is not part of this plan, because building it needs Among Us files.

More details and contact

• Full details (GitHub): docs/CODE-SIGNING.en.md
• Questions: Contact
• Security problems: SECURITY.md (GitHub)