Maps that arrive on their own: signed content packs
An edited map is worth nothing if every player has to be told to copy a file. So the server can now push changed maps to the new client on its own.
The flow
- Someone edits a map in the editor suite and saves. The change lands in an overlay.
- On the server machine, the owner publishes it — one command, which compares the files against the stock install, keeps only the ones that differ, packs them and signs the pack.
- The running server offers the pack to every client that connects, and to the ones already connected.
- The client downloads it, verifies the signature, unpacks it into a private cache and lays it on top of the install. The next time you enter the map, you see the new one.
If a pack arrives while you are logging in, the first scene waits for it — up to a minute, with a small "Updating game content…" box — so nobody walks into a half-updated world. Players already inside get a line in the chat and see the change when they next enter the map. A pack the client already has is reused from its cache, so a second login costs nothing.
The part that matters: trust
A server that can send files to your computer is a server you have to be able to trust, so the design starts from the opposite assumption: assume the server can be broken into.
- Packs are signed with a key that never sits on the running server. The owner signs offline, on their own machine. A stranger who took over the server could offer packs, but could not sign one, and the client would refuse it.
- The client carries the matching public key. Anything unsigned, altered after signing, or signed by someone else is discarded — not "used with a warning."
- Only map files. A pack may contain map files, terrain and water settings and texture-style lists and nothing else: no programs, no scripts, no libraries. Paths are checked so a pack cannot write outside its own cache folder, and the unpacking refuses anything that tries to follow a link elsewhere.
- Layers, in order. Your own local overlay wins over a pushed pack, and a pack wins over the install. So a modder's local changes are never silently replaced, and removing a pack puts the original map back.
- It is reversible. Unpublish a pack and connected clients delete it on their next connection. Nothing is ever left behind.
We tested each of those on purpose: the pack format, its size and path rules, forged signatures, tampered downloads, a cache that has been altered, and the load gate. The self-test for this feature runs 308 checks, all of which pass. We also ran the whole loop for real against a local server — publish, watch a client download, verify and mount it, reconnect and reuse the cache, remove the pack, watch the client delete it.
Where it stands
Nothing is being served yet. This post is about the plumbing. It is the reason the map you edit on Tuesday can be the map players walk on Wednesday, and it is why we were willing to spend a week on signatures: a way to ship content to players is the kind of thing you do carefully once.