From d0de51d31d286331155d2822163f593f5c3cf2f1 Mon Sep 17 00:00:00 2001 From: MoonCast Date: Wed, 21 Oct 2026 19:10:25 +0000 Subject: [PATCH] docs: CONTRIBUTING.md and SECURITY.md Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 1 + CONTRIBUTING.md | 39 +++++++++++++++++++++++++++++++++++++++ SECURITY.md | 16 ++++++++++++++++ 3 files changed, 56 insertions(+) create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/CHANGELOG.md b/CHANGELOG.md index fd65827be2..394a4252ec 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -78,6 +78,7 @@ - Build: chiaki's build script starts the native build clean when chiaki's build files change. The OpenSSL upgrade otherwise failed on a machine that had built before (old configured headers left in the cache). ## Unreleased +- CONTRIBUTING.md: how to report problems, build, and send changes (one topic per pull request, CHANGELOG in each, lint and CI, the chiaki-ng submodule, no game pictures or secrets, licences). SECURITY.md: report privately through GitHub's security advisories, and what MoonCast keeps where. - README: rewritten for MoonCast (it was still Moonlight's). It covers what the two apps play and how, the features, install and Sunshine's gamepad setting, building with the chiaki-ng submodule, the licences and the credits. ## 12.2-test227 (2026-10-21) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000000..3b24894691 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,39 @@ +# Contributing to MoonCast + +Thanks for helping! A few rules keep the history easy to follow and the apps easy to release. + +## Reporting a problem + +Use **New issue → Something doesn't work**. Say: +- which app (MoonCast or MoonCast TV) and which version (Settings, About); +- your device and Android version; +- what you played (PC, PS5 or Xbox), at home or away; +- what happened. + +A screenshot or a short video helps a lot. For ideas, use **Idea or wish**. + +Security problems go privately, not in an issue: see [SECURITY.md](SECURITY.md). + +## Building + +See [Building](README.md#building) in the README. Clone with `--recurse-submodules`: the PS5 part is built from `third-party/chiaki-ng`. + +## Changes + +- **One topic per branch and pull request.** A fix and a feature are two pull requests. Name branches by kind and topic: `fix/battery-res`, `feat/fsr`, `docs/readme`. +- **CHANGELOG.md in every pull request.** Add an entry at the top that says what changed for someone using the app, in plain words. Then add what changed in the code. +- **Match the code around you.** Use the same naming, comment style and amount of comments. Keep it simple: no new libraries or abstractions without a reason. +- **Both apps.** Settings and behaviour that make sense on TVs and handhelds go into both (`src/tv` and `src/handheld`); shared code lives in `src/main`. +- **Lint and CI must pass.** CI builds both apps and runs lint on every pull request. Locally: `./gradlew lintNonRootHandheldDebug lintNonRootTvDebug`. +- **Test on a device** before asking for review, and say in the pull request what you tested, on which device, and what you couldn't test. +- **PS5 native code** lives in [MoonCastDev/chiaki-ng-mooncast](https://github.com/MoonCastDev/chiaki-ng-mooncast). Change it there first, then move the `third-party/chiaki-ng` submodule to the new commit in your pull request. +- **No copyrighted game pictures** in the repository (screenshots, box art, mockups). Use made-up scenes, or free games. +- **No secrets.** Never commit keys, passwords, tokens, sign-in data or `keystore.properties`. + +## Test builds + +Put the build name in the version: `BUILD=test123 ./gradlew assembleNonRootHandheldDebug assembleNonRootTvDebug` gives `1.0-test123`. Pre-releases on GitHub carry these test builds; releases are signed with the MoonCast key, built with `scripts/release.sh`. + +## Licence + +MoonCast is GPL-3.0, with the parts from chiaki-ng (PS5) and XStreaming (Xbox) under AGPL-3.0. By contributing, you agree that your work is published under the same licences. When you add a library, also add it to `app/src/main/java/com/limelight/home/Licences.kt`, to `NOTICE`, and add its licence text to `app/src/main/assets/licences/`. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000..0c828a3fb7 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,16 @@ +# Security + +MoonCast handles pairing with your PC, and sign-ins to PlayStation Network and Xbox. If you find a way to get at +someone's pairing, sign-in or console, or a way into MoonCast or the devices it talks to, please report it **privately**: + +- **[Report a vulnerability](https://github.com/MoonCastDev/moonlight-android/security/advisories/new)** (GitHub's private security advisory). Only the maintainers see it. + +Please don't open a public issue for it. Include what you found, how to reproduce it, and which version (Settings, About). +We'll reply as soon as we can and agree with you on when the fix and the report are made public. + +What MoonCast keeps, and where: +- **PC pairing certificates:** stay on the device. When you send a game to a MoonCast TV, they go to that TV for the session only, encrypted, over your own network. +- **PlayStation Network and Xbox sign-ins, and a PS5's registration:** stay on your own devices (moving a game to your MoonCast TV hands what it needs to that TV, over your own network) and go only to Sony and Microsoft. +- **Release builds:** signed with the MoonCast key (certificate SHA-256 `ac7cce06b53c84cdfdaf7f05c29479e332b434bd5799dc5716cba632173dff07`). Don't install a "MoonCast" signed with anything else. + +Supported versions: the latest release and the latest beta.