Release v1.19.2: no network code, and no archive inside the exe

Two structural changes, both aimed at the antivirus false positives that
are blocking the Nexus page.

The exe was 90% embedded archive. --onedir in 1.19.0 only moved the DLLs
into _internal; the Python code stayed inside S2Tweaker.exe as a
zlib-compressed blob: 2,857,284 of 3,175,748 bytes, entropy 7.999 of a
possible 8.0. That is the exact shape analysts use to identify PyInstaller
malware, and the CI guard did not catch it because 3.17 MB passed an 8 MB
limit. With --debug noarchive the modules ship as plain .pyc in _internal:
the launcher is 345,705 bytes with entropy 6.823. --noupx pins the packer
off, since the generated spec sets upx=True and only a missing UPX on PATH
kept it dormant. The guard is now 1 MB and additionally counts .pyc files,
so it tests the invariant it claims to test.

The update check is gone, along with every trace of networking. Nexus'
file submission guidelines prohibit executables that connect to the
internet "unless where it is crucial" and state that "'auto update'
functionality does not qualify as crucial". The tool now contains no
urllib, no sockets and no HTTP client at all, and tests/test_no_network.py
walks the AST of every module to keep it that way. That claim is worth
more than the button was: a moderator can verify it with one grep.

Also removed with it: the Updater badge, the wizard's fourth page and the
FAQ entry that advertised update.bat. Page 3 no longer names update.bat as
a landmark either - it has not been in the download since 1.19.1, and the
wizard must never point at a file the user does not have.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: Zayn995

.github/workflows/build.yml

@@ -74,10 +74,22 @@ jobs:
               throw "Versions-Ressource unvollstaendig: $f ist leer"
             }
           }
-          # Der Starter darf kein eingebettetes Archiv mehr sein.
-          if ((Get-Item $exe).Length -gt 8MB) {
+          # Der Starter darf kein eingebettetes Archiv mehr sein. Die alte
+          # Schranke von 8 MB hat das NICHT geprueft: 1.19.1 kam mit
+          # 3,17 MB durch und bestand zu 90 % aus genau dem Archiv, das
+          # hier ausgeschlossen sein sollte. Mit --debug noarchive liegt
+          # der Starter bei ~345 KB; 1 MB laesst Luft und schlaegt an,
+          # sobald der Klumpen zurueckkehrt.
+          if ((Get-Item $exe).Length -gt 1MB) {
             throw "Starter ist $((Get-Item $exe).Length) Bytes gross - steckt wieder ein Archiv drin?"
           }
+          # Gegenprobe am Inhalt statt nur an der Groesse: die Module
+          # muessen als .pyc in _internal liegen.
+          $pyc = (Get-ChildItem "dist/S2Tweaker/_internal" -Recurse -Filter *.pyc | Measure-Object).Count
+          "Module als .pyc  : $pyc"
+          if ($pyc -lt 100) {
+            throw "Nur $pyc .pyc-Dateien - steckt der Python-Code wieder in der EXE?"
+          }
 
       - name: Programmordner als Artefakt
         # Genau dieses Artefakt bekommt spaeter die SignPath-Signatur.

README.md

@@ -57,6 +57,7 @@ built lazily when you expand a category, so startup stays fast.
 
 | Layer | Details |
 |---|---|
+| Network | **None.** Since 1.19.2 the program contains no networking code at all — no `urllib`, no sockets, no HTTP client — and the bundled repak is compiled without its HTTP/TLS stack. Both are enforced on every build ([tests/test_no_network.py](tests/test_no_network.py), [tests/test_no_download.py](tests/test_no_download.py)) and can be verified with one `grep` of this repository. The update check was removed with 1.19.2: Nexus' file submission guidelines prohibit internet-connecting executables "unless where it is crucial" and say "'auto update' functionality does not qualify as crucial". Updating is a manual file swap. |
 | Vanilla data | `repak unpack` of `pakchunk0-Windows.pak` (only the 29 needed GameData files), then `.cfg.bin` → text via the vendored decoder ([s2tweaker/vendor_bin2cfg.py](s2tweaker/vendor_bin2cfg.py)). Cached in `cache/vanilla-<pakSize>-s<schema>/`; a game update changes the fingerprint → automatic re-extraction. |
 | Oodle | The game's config archives are Oodle-compressed, so reading them needs the proprietary `oo2core_9_win64.dll`. The game does **not** ship it (Oodle is linked into the game executable), and **S2Tweaker never downloads it**: a program that pulls a library off the internet and then runs it looks exactly like a dropper, which is one reason scanners flag tools like this. The user places the file once; the tool looks in the usual local spots, always verifies the SHA-256, and says so at startup with a link and a target folder if it is missing. The bundled repak cannot fetch it either - it is built from source with the download function and its HTTP/TLS stack removed ([tools/build_repak.py](tools/build_repak.py)). Packing never needs Oodle. |
 | Parsing | [cfgparse.py](s2tweaker/cfgparse.py) parses GSC's cfg text format (`Name : struct.begin {refkey=...}` … `struct.end`) into a tree; `refkey` inheritance chains are resolved to get effective vanilla values. |

docs/CODE_SIGNING_POLICY.md

@@ -50,13 +50,25 @@ source, and both are stated openly:
 ## Privacy
 
 S2Tweaker collects nothing. There is no telemetry, no analytics, no account
-and no usage reporting. It makes exactly two kinds of outbound request, both
-of which the user triggers:
-
-1. **"Check for updates"** (a button, never in the background): one request
-   to `api.github.com` asking for the latest release tag.
-2. **Oodle library**: one download from the public OodleUE mirror on GitHub,
-   once, if the library is not already present on the machine.
+and no usage reporting.
+
+Since 1.19.2 it makes **no outbound requests at all**. There is no networking
+code left in the program: no `urllib`, no sockets, no HTTP client. The
+bundled `repak.exe` is compiled from source with its download function and
+its entire HTTP/TLS stack removed, so it cannot make a request either. Both
+claims are enforced by [tests/test_no_network.py](../tests/test_no_network.py)
+and [tests/test_no_download.py](../tests/test_no_download.py) on every build,
+and anyone can verify them by grepping this repository.
+
+Two earlier network paths were removed deliberately:
+
+1. **"Check for updates"** — dropped in 1.19.2. Nexus Mods' file submission
+   guidelines prohibit executables that connect to the internet "unless where
+   it is crucial", and state that "'auto update' functionality does not
+   qualify as crucial". Updating is now a manual file swap.
+2. **Oodle library download** — dropped in 1.19.1. A program that fetches a
+   library and then loads it is dropper-shaped, and it caused antivirus false
+   positives. The user places that file once, guided by a setup window.
 
 Everything else — settings, presets, cache, generated mods — stays in the
 tool's own folder on the user's machine.

s2tweaker/__init__.py

@@ -4,6 +4,6 @@
 Haltbarkeit, Mutanten usw.) eine Mod-Pak-Datei fuer den ~mods-Ordner.
 """
 
-__version__ = "1.19.1"
+__version__ = "1.19.2"
 
 

s2tweaker/faq.py

@@ -615,19 +615,17 @@
     },
     {
         "q": "Does S2Tweaker download anything? What is the Oodle file?",
-        "a": "No, nothing - not the tool and not the repak it bundles. "
-             "Reading your game's packed configs needs Oodle's "
-             "oo2core_9_win64.dll, which is proprietary and may not be "
-             "shipped with the tool. Older versions fetched it "
+        "a": "No. Since 1.19.2 there is no networking code in the tool at "
+             "all - not in it, not in the repak it bundles. Check the "
+             "public source yourself. Reading your game's packed configs "
+             "needs Oodle's oo2core_9_win64.dll, which is proprietary and "
+             "may not be shipped with the tool. Older versions fetched it "
              "automatically; that was dropped, because a program that "
              "downloads a library and then runs it is exactly what "
-             "malware does and it made scanners flag this tool. Now you "
+             "malware does, and it made scanners flag this tool. Now you "
              "place the file once yourself: if it is missing, S2Tweaker "
-             "says so at startup and gives you the link and the folder. "
-             "Every Unreal Engine install has the file, as do some other "
-             "S.T.A.L.K.E.R. 2 tools. Building a pak never needs it. The "
-             "only network request left is the update check, and only "
-             "when you click it.",
+             "says so at startup and shows the link and the folder. "
+             "Building a pak never needs it.",
         "k": "internet network download dll oodle offline privacy "
              "telemetry connection firewall blocked",
     },
@@ -787,16 +785,16 @@
     },
     {
         "q": "How do I update the tool? Is there an auto-update?",
-        "a": "Click '⟳ Check for updates' (top right): the tool asks "
-             "github.com once whether a newer release exists - never in "
-             "the background. If there is one it opens the download "
-             "page. There is also an optional helper, update.bat, that "
-             "does the swap for you and keeps your old files as .bak. It "
-             "is deliberately NOT in the download: a file that fetches "
-             "something and replaces programs is what scanners dislike. "
-             "The 'Updater' button shows whether you have it and offers "
-             "the link. Settings, presets, output and cache always stay "
-             "where they are.",
+        "a": "By hand, and on purpose. Download the new version from "
+             "where you got this one, then replace S2Tweaker.exe and the "
+             "_internal folder next to it. Your settings, presets, "
+             "output and cache stay where they are - nothing else has to "
+             "be touched. There is no update check and no auto-update "
+             "any more: a tool that talks to a server to fetch and "
+             "replace program files is the pattern antivirus scanners "
+             "and mod sites object to, and this one had enough trouble "
+             "with false positives already. The version you are running "
+             "is in the window title.",
         "k": "update autoupdate upgrade new version release download "
              "github check latest newer patch tool bat updater",
     },