enricobuehler
94b7a834cb
apple / swift (push) Successful in 3m19s
decky / build-publish (push) Successful in 35s
windows-host / package (push) Successful in 18m44s
windows-host / winget-source (push) Skipped
rpm / build-publish (44, fedora-44, punktfunk-fedora44-rpm) (push) Successful in 22m27s
rpm / build-publish (43, bazzite, punktfunk-fedora-rpm) (push) Successful in 17m15s
apple / screenshots (push) Successful in 23m24s
ci / web (push) Successful in 58s
ci / docs-site (push) Successful in 1m27s
ci / bench (push) Successful in 7m15s
ci / rust-arm64 (push) Successful in 11m47s
deb / build-publish-client-arm64 (push) Successful in 10m21s
android / android (push) Failing after 11m52s
deb / build-publish-host (push) Successful in 11m34s
docker / build-push (., web/Dockerfile, punktfunk-web) (push) Successful in 1m42s
deb / build-publish (push) Successful in 17m34s
docker / build-push (docs-site, docs-site/Dockerfile, punktfunk-docs) (push) Successful in 3m6s
docker / build-push (ci, ci/rust-ci-noble.Dockerfile, punktfunk-rust-ci-noble) (push) Successful in 8m30s
arch / build-publish (push) Successful in 18m29s
docker / build-push (ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora-rpm) (push) Successful in 13m59s
docker / build-push (--build-arg FEDORA_VERSION=44, ci, ci/fedora-rpm.Dockerfile, punktfunk-fedora44-rpm) (push) Successful in 14m36s
docker / build-push (ci, ci/rust-ci.Dockerfile, punktfunk-rust-ci) (push) Successful in 13m1s
docker / deploy-docs (push) Successful in 35s
ci / rust (push) Successful in 30m15s
docker / build-push-arm64cross (push) Successful in 9m8s
A user found this in their log and had never been offered a choice:
WARN GameStream/Moonlight compat ENABLED (--gamestream): its pairing runs over
plain HTTP and its legacy control encryption can reuse GCM nonces
(security-review #5/#9) — an on-path LAN attacker could MITM pairing or
recover input. Enable only on a TRUSTED network.
They were right. The `gamestream` task carried no `Flags: unchecked`, so it was
pre-ticked; and since a silent install takes the wizard's own task defaults
(1839d756), a winget install turned it on with no checkbox ever shown. The host
warns that this plane is a security downgrade on every single start, so having
the installer enable it by default cannot be squared with our own advice — least
of all on the path where nobody sees a wizard.
Now unchecked, matching `allowpublicfw`, the other task with a security
consequence. A default install therefore lands `PUNKTFUNK_HOST_CMD=serve`, the
native-only host; Punktfunk's own clients are unaffected, since the native
punktfunk/1 plane is always on. Unattended opt-in is `/MERGETASKS=gamestream`.
Scope, deliberately: this changes FRESH installs only. `GamestreamParam` already
omits the flag entirely unless `FreshHostInstall`, so no existing host has its
choice touched by an upgrade, and anyone relying on Moonlight today keeps it.
`DEFAULT_HOST_CMD` (the service's fallback when host.env carries no
PUNKTFUNK_HOST_CMD line at all) is deliberately NOT flipped here: the installer
always writes the line explicitly, so it does not affect a normal install, and
inverting it would silently disable Moonlight for anyone whose host.env lost that
line — a runtime regression that belongs in its own change, if at all.
Docs corrected everywhere they stated the old default, since three of them now
told users the opposite of what ships: the winget Agreement shown BEFORE install
(it said "enabled by default" and gave the opt-OUT override), the Windows
packaging README, and host.env.example. The `--override` example in the installer
manifest is inverted with it (`/MERGETASKS=gamestream` to add, `!` to remove).
Verified: [Tasks] + [Code] compile with ISCC 6.7.1 on the windows-amd64 runner
(all optional features defined), and the winget catalogue rebuilds and passes
29/29 with the edited manifests.
54 lines
3.0 KiB
Bash
54 lines
3.0 KiB
Bash
# punktfunk host configuration (Windows) — read by the `PunktfunkHost` service.
|
|
#
|
|
# `punktfunk-host service install` writes a default copy of this to
|
|
# %ProgramData%\punktfunk\host.env
|
|
# Edit that file (not this one) and restart the service to apply:
|
|
# punktfunk-host service stop
|
|
# punktfunk-host service start
|
|
#
|
|
# Format: KEY=VALUE per line; '#' starts a comment. The service loads these into its environment
|
|
# and passes PUNKTFUNK_* and RUST_LOG through to the host it launches into the active session.
|
|
|
|
# Hardware encode backend. `auto` (default) detects the GPU vendor: NVIDIA->nvenc (direct SDK),
|
|
# AMD->amf, Intel->qsv (both libavcodec). Force one with: nvenc | amf | qsv | sw (software H.264).
|
|
# nvenc needs the `--features nvenc` build; amf/qsv need the `--features amf-qsv` build (FFmpeg DLLs
|
|
# ship in the installer). The published installer is built with all three.
|
|
PUNKTFUNK_ENCODER=auto
|
|
|
|
# Video source: `virtual` creates a per-client virtual display at the client's exact resolution +
|
|
# refresh — the flagship mode. Requires the bundled pf-vdisplay indirect display driver installed.
|
|
PUNKTFUNK_VIDEO_SOURCE=virtual
|
|
|
|
# Virtual-display backend: the all-Rust pf-vdisplay IddCx driver the installer bundles is the only
|
|
# backend now (the legacy SudoVDA backend was removed). This is informational; leave it as `pf`.
|
|
PUNKTFUNK_VDISPLAY=pf
|
|
|
|
# Capture is IDD-push: straight from the pf-vdisplay driver's shared ring — zero-copy, includes the
|
|
# secure desktop. It is the SOLE capture path (DDA/WGC were removed; the former PUNKTFUNK_IDD_PUSH
|
|
# knob is gone — a stale setting is ignored).
|
|
|
|
# Capture the secure desktop (UAC / lock / login) so the stream survives those transitions.
|
|
PUNKTFUNK_SECURE_DDA=1
|
|
|
|
# Log level (info | debug | trace). Logs land in %ProgramData%\punktfunk\logs\.
|
|
RUST_LOG=info
|
|
|
|
# The host subcommand the service launches. The native punktfunk/1 host is ALWAYS on; `--gamestream`
|
|
# adds the GameStream/Moonlight-compat planes, which pair over plain HTTP and reuse legacy GCM
|
|
# nonces (security-review #5/#9) — so `serve` alone is the SECURE native-only host.
|
|
#
|
|
# A Windows install writes this line explicitly from the installer's "Enable GameStream (Moonlight)
|
|
# compatibility" task, which is OPT-IN (unchecked) — so a default install lands `serve`. Only if
|
|
# this line is absent altogether does the service fall back to its built-in `serve --gamestream`.
|
|
# Change it later with `punktfunk-host service install --gamestream=on|off` + a service restart; a
|
|
# custom value you write here by hand is never overwritten by a reinstall/upgrade.
|
|
#PUNKTFUNK_HOST_CMD=serve --gamestream
|
|
|
|
# Multi-GPU boxes only: force the NVENC/Desktop-Duplication GPU by Description substring. Leave
|
|
# unset on single-GPU machines (the default auto-picks the discrete adapter).
|
|
#PUNKTFUNK_RENDER_ADAPTER=4090
|
|
|
|
# Keep a per-client virtual display alive briefly after disconnect so a quick reconnect reuses it
|
|
# (no display connect/disconnect chime). Default 10000 ms.
|
|
#PUNKTFUNK_MONITOR_LINGER_MS=10000
|