This document describes the security model, threat mitigations, and audit status for the Worms W.M.D macOS fix.

The fix is designed to be:

• Transparent: Open source and fully auditable
• Minimal: Only modifies files within the game bundle
• Reversible: Creates backups before any changes
• Unprivileged: Never requires sudo or elevated permissions
• Verified: Downloads require cryptographic checksum validation

This fix is designed to be safe against:

• Modify any system files or directories
• Require or use sudo, doas, or any privilege escalation
• Collect, transmit, or store any personal data
• Access any network services except those listed below
• Install persistent background services (unless you opt in)
• Modify PATH, DYLD_LIBRARY_PATH, or other environment variables

All network operations use:

• HTTPS only: --proto '=https' enforced on curl
• TLS 1.2 minimum: --tlsv1.2 enforced on curl
• Retry with backoff: --retry 3 --retry-delay 1 --retry-connrefused
• Timeouts: All requests have --max-time limits (10-300 seconds)
• Checksum verification: SHA256 required for pre-built packages

No analytics or telemetry are used, and network access is limited to the endpoints listed above.

The check_updates.sh --download option downloads a ZIP snapshot from GitHub without cryptographic signature verification. For maximum security, prefer git pull which uses SSH/HTTPS authentication.

Pre-built Qt framework packages undergo multiple verification steps:

1. Source verification: Downloaded only from the repository's dist/ directory
2. Checksum validation: SHA256 hash must match the .sha256 file
3. Archive layout validation: Only whitelisted paths are allowed:
   • Frameworks/ and contents
   • PlugIns/ and contents
   • METADATA.txt
4. Path traversal protection: Archives containing ../, /.., or absolute paths are rejected
5. Post-extraction verification: Confirms expected directories exist

If any verification fails, the script falls back to Homebrew or exits with an error.

The fix applies an ad-hoc code signature to the modified game bundle:

codesign --force --deep --sign - "$GAME_APP"

This signature:

• Allows the app to run without Gatekeeper warnings
• Does not require an Apple Developer account
• Is not notarized (Apple notarization would require the original developer)

The signature can be verified with:

codesign -dv --verbose=4 "path/to/Worms W.M.D.app"

The update watcher (tools/watch_for_updates.sh --install) installs a LaunchAgent that:

• Monitors for Steam updates that overwrite the fix
• Runs locally with no network access
• Uses launchctl bootstrap gui/$UID (user-level, not system-level)
• Can be completely removed with --uninstall

The LaunchAgent plist is created at:

~/Library/LaunchAgents/com.wormswmd.fix.watcher.plist

User-controllable environment variables are validated:

All interactive prompts:

• Use read ... < /dev/tty for reliable input even when piped
• Validate input before use (e.g., numeric range checks)
• Default to safe options (e.g., "no" for destructive operations)

Last audit: 2025-12-26

# Main fix script
less fix_worms_wmd.sh

# Individual steps
ls -la scripts/
less scripts/01_build_agl_stub.sh

# Tools
ls -la tools/
less tools/check_updates.sh

# AGL stub source
less src/agl_stub.c

shellcheck fix_worms_wmd.sh install.sh scripts/*.sh tools/*.sh

./fix_worms_wmd.sh --dry-run

./fix_worms_wmd.sh --verify

./tools/preflight_check.sh

This verifies:

• macOS version and architecture
• Rosetta 2 installation (Apple Silicon)
• Game installation and fix status
• Runtime dependencies (FMOD, Steam API, libcurl)
• Network connectivity to Team17 services

# View source
cat src/agl_stub.c

# Check compiled binary
file "$HOME/Library/Application Support/Steam/steamapps/common/WormsWMD/Worms W.M.D.app/Contents/Frameworks/AGL.framework/Versions/A/AGL"

# Verify architecture
lipo -archs "$HOME/Library/Application Support/Steam/steamapps/common/WormsWMD/Worms W.M.D.app/Contents/Frameworks/AGL.framework/Versions/A/AGL"

The fix automatically creates a backup before making changes:

Backup location: ~/Documents/WormsWMD-Backup-YYYYMMDD-HHMMSS/

Backup contents:

• Frameworks/ - Original Qt frameworks and libraries
• PlugIns/ - Original Qt plugins
• Info.plist - Original app metadata
• DataOSX/ - Original configuration files

Restore command:

./fix_worms_wmd.sh --restore

Pre-built Qt packages:

• Built from Homebrew Qt 5.15 on Intel macOS
• Packaged with tools/package_qt_frameworks.sh
• Stored in repo dist/ with SHA256 checksums
• Architecture: x86_64 (runs under Rosetta 2 on Apple Silicon)

1. Pre-built packages are not signed: The Qt framework tarball uses SHA256 checksums but not cryptographic signatures. The checksum file is in the same repository.

2. Update downloads lack signatures: check_updates.sh --download retrieves code without signature verification. Use git pull for authenticated updates.

3. Ad-hoc code signature: The app is signed with an ad-hoc signature, not a Developer ID. This may trigger Gatekeeper warnings on some systems.

4. Backup restore is not validated: backup_saves.sh does not validate tar archive contents before extraction. Only restore backups you created yourself.

5. Game config secrets: The original game ships with confirmed API credentials in config files. These are documented in TEAM17_DEVELOPER_REPORT.md (redacted) for Team17's awareness. The fix does not modify these credentials.

Do not open a public issue for security vulnerabilities.

Instead, email the maintainer directly with:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

You will receive a response within 48 hours acknowledging the report.