Class GeneratedPinSet

Namespace

FishMMO.Client.Security

Assembly

FishMMO.Client.dll

IL-embedded certificate pin set. The real values are substituted at build time by CI. The committed sentinel values are intentionally invalid so pinning cannot accidentally ship with empty values.

public static class GeneratedPinSet

Inheritance

object

GeneratedPinSet

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Fields

ManifestPublicKeyBase64

Ed25519 public key (base64) for verifying signed pin update manifests from the API. Empty string disables runtime updates.

public const string ManifestPublicKeyBase64 = ""

Field Value

string

Pins

SHA-256 SPKI pins (base64). Minimum 2 entries required for release builds — one active key + one backup for rotation.

public static readonly string[] Pins

Field Value

string[]

SentinelMarker

Sentinel string the build validator checks for. CI replaces the entire sentinel value (including this marker) with the real pin.

public const string SentinelMarker = "FISHMMO_SENTINEL_PLACEHOLDER"

Field Value

string

VersionManifestPublicKeyBase64

Ed25519 public key (base64) for verifying the signed VERSION manifest served by GET {APIHost}latest_version.

public const string VersionManifestPublicKeyBase64 = ""

Field Value

string

Remarks

A separate key from ManifestPublicKeyBase64 on purpose. That one is the trust anchor for the TLS pin set; this one authorises which bytes the updater will install. They have different holders, different rotation cadences and very different blast radii, and sharing a key would mean compromising either one yields both.

An empty string means version-manifest signing is not configured for this deployment. The client then falls back to the SHA-256-over-pinned-TLS posture it had before, and says so loudly at every version check in a release build — see HttpPatchServerService.GetLatestVersion. Once a key IS configured, a manifest that does not verify against it is refused outright.

The signed form is the response document with its "signature" value replaced by "", with the base64 signature appended — identical to the pin manifest, so one signing tool serves both. See Ed25519ManifestVerifier.