| Version | Supported |
|---|---|
| Newest release | Yes |
| Older releases | No |
The launcher updates itself to the newest release, so a fix ships as a new release.
The installer, the portable ZIP and the AppImage each have a Sigstore bundle signed by recomp.team@gmail.com. The
.intoto.jsonl files hold their SLSA provenance. GitHub shows each file's SHA-256 beside it. To check a file, here the
installer:
uvx sigstore verify identity --cert-identity recomp.team@gmail.com --cert-oidc-issuer https://accounts.google.com --bundle DisruptorRecomp-win-Setup.exe.sigstore.json DisruptorRecomp-win-Setup.exe
If you discover a security vulnerability, please report it responsibly:
- Email: recomp.team@gmail.com
- Subject:
[DisruptorRecomp] Security: <brief description> - Include steps to reproduce, the affected release and the potential impact
Please do not open a public GitHub issue for security vulnerabilities.
- Acknowledgement: within 48 hours
- Initial assessment: within 7 days
- Fix or mitigation: depends on severity, typically within 30 days