V2 game binary signing signs protected outputs after executable packing and before store wrapping. The release contract covers code signing for Windows, macOS notarization, and Linux AppImage signing.
Signing Targets#
V2/ue/Build/DRM/v2-game-binary-signing.json defines the signing target for
each launch desktop platform:
- Windows Authenticode signing for the protected Win64 executable, with RFC3161 timestamping and post-signature verification.
- macOS Developer ID signing, hardened runtime, notarization, and stapled notarization ticket verification.
- Linux AppImage signing with a release GPG key, detached signature, signed manifest timestamp, and post-signature verification.
All targets require release evidence, key custody through HSM, KMS, or CI secret store controls, and blocking of unsigned artifacts.
Release Behavior#
Unsigned artifacts cannot advance to release packaging. Signature verification
must run after signing and before storefront upload. Signing consumes the
protected binary outputs from V2/ue/Build/DRM/v2-executable-packing.json and
keeps anti-tamper telemetry wired through
V2/ue/Build/DRM/v2-anti-tamper-telemetry.json.
CI Gates#
V2/ue/Tools/plan-v2-game-binary-signing.py emits the deterministic game binary
signing plan. V2/ue/Tools/check-v2-game-binary-signing.py validates the
manifest, planner output, executable packing dependency, anti-tamper telemetry
dependency, Horde wiring, CI workflow wiring, and this runbook.
Required release gates:
drm-game-binary-signing-plan-generateddrm-game-binary-signing-platform-coveragedrm-game-binary-signing-signature-verificationdrm-game-binary-signing-key-custodydrm-game-binary-signing-platform-specific-requirements
The signature-verification gate requires all three targets to verify signed artifacts, and the platform-specific gate requires Windows timestamping, macOS notarization/stapling, and Linux AppImage signature coverage.