No more repak.exe: pak files are read and written in pure Python (1.23.0)

- s2tweaker/pakfile.py: pak reader (versions 1-11; raw, Zlib, Gzip and
  Oodle entries, Oodle through ctypes) and a V8B writer, standard library
  only. pakio.py keeps its API on top of it; the Oodle DLL is looked up
  locally and loaded directly, never downloaded.
- Verified against the real game and against repak 0.2.3
  (tests/test_pakfile.py, also in the CI subset): the 36 needed game files
  come out byte for byte as repak extracted them, 27 third-party mod paks
  (V3/V8B/V11; raw, Zlib, Oodle) read identically, and a pak we write has
  the same index, entry headers and SHA-1s as repak's - repak reads it.
- Why: Microsoft's ML engine flagged the CI-built repak.exe as a trojan
  (Wacatac.B!ml, then Bearfoos.A!ml) although two builds differed in 27
  bytes of linker timestamp and PDB GUID only. With the pak code in
  Python there is no unsigned executable left in the package.
- Build and CI: no repak build steps; the cross-check fails on any
  unsigned binary or a repak.exe in the folder; the self-test does a pak
  roundtrip; the launcher removes a stale _internal/repak.exe on start.
- tools/repak.exe and tools/build_repak.py are gone from the repository
  (the locally built binary carried the build machine's user name in its
  Cargo paths); source ZIPs exclude binaries from now on.
- Docs, FAQ and Nexus texts updated; version 1.23.0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: Zayn995

.github/workflows/build.yml

@@ -40,12 +40,6 @@ jobs:
       - name: Abhaengigkeiten
         run: pip install -r requirements.txt
 
-      - name: repak aus dem Quellcode bauen
-        # Ersetzt das im Repo liegende Binaerteil durch einen frischen Build
-        # OHNE Download-Funktion (tools/build_repak.py erklaert warum).
-        # Damit stammt am Ende jede ausgelieferte Datei aus offenem Quellcode.
-        run: python tools/build_repak.py
-
       - name: Tests ohne Spieldaten
         # Die volle Batterie braucht den vanilla/-Ordner mit extrahierten
         # GameData. Die duerfen nie ins Repo (GSC-Copyright), also laeuft
@@ -59,7 +53,8 @@ jobs:
         # Unabhaengig vom Bau-Skript, mit Windows-Bordmitteln: der Starter
         # muss Byte fuer Byte die pythonw.exe des Runners sein und von der
         # Python Software Foundation signiert; jede DLL/PYD muss gueltig
-        # signiert sein (einzige Ausnahme: das selbst gebaute repak.exe);
+        # signiert sein - ohne Ausnahme (seit 05.09.2026 gibt es kein repak.exe
+        # mehr; Paks liest und schreibt s2tweaker/pakfile.py in reinem Python);
         # und nichts, was Netz oder TLS kann, darf im Paket liegen.
         shell: pwsh
         run: |
@@ -80,9 +75,8 @@ jobs:
           $bins = Get-ChildItem $dist -Recurse -Include *.exe,*.dll,*.pyd
           $unsigned = @($bins | Where-Object { (Get-AuthenticodeSignature $_.FullName).Status -ne 'Valid' })
           "Binaerdateien : $($bins.Count), davon unsigniert: $($unsigned.Name -join ', ')"
-          if (@($unsigned | Where-Object { $_.Name -ne 'repak.exe' }).Count -gt 0) {
-            throw "Unsignierte Binaerdatei ausser repak.exe im Paket"
-          }
+          if ($unsigned.Count -gt 0) { throw "Unsignierte Binaerdatei im Paket" }
+          if (Get-ChildItem $dist -Recurse -Filter repak.exe) { throw "repak.exe im Paket" }
           foreach ($bad in '_ssl', '_socket', '_hashlib', 'libssl', 'libcrypto', 'sqlite3', '_multiprocessing') {
             if (Get-ChildItem $dist -Recurse -Filter "$bad*") { throw "$bad* im Paket" }
           }

.gitignore

@@ -22,8 +22,13 @@ tools/oo2core*
 .s2tweaker_write_test
 **/.s2tweaker_write_test
 
-# Build artifacts
+# Build artifacts. tools/repak.exe ist seit 05.09.2026 KEIN Repo-Inhalt
+# mehr: ein lokal gebautes Binaerteil trug den Windows-Benutzernamen des
+# Bau-Rechners in sich (Cargo-Pfade). Es entsteht per tools/build_repak.py
+# - reproduzierbar, in der CI vor jedem Bau.
+tools/repak.exe
 build/
+build_check/
 dist/
 __pycache__/
 *.spec

README.md

@@ -17,7 +17,7 @@ Everyone is free to use it. This README tells you everything you need.
 - Generates **`{bpatch}` config patches** (the official patch system since
   game version 1.6): only the values you change are written; everything at
   "(vanilla)" is untouched and cannot conflict with other mods.
-- Packs them with **repak** into `zzz_<Name>_P.pak` (pak V8B, mount point
+- Packs them into `zzz_<Name>_P.pak` with its own pure-Python pak writer (pak V8B, mount point
   `../../../`) — into an `output` folder, or directly into `~mods`.
 - Fully **portable**: settings, cache and output live next to the exe.
 
@@ -57,13 +57,13 @@ built lazily when you expand a category, so startup stays fast.
 
 | Layer | Details |
 |---|---|
-| Network | **None.** Since 1.19.2 the program contains no networking code at all — no `urllib`, no sockets, no HTTP client — and the bundled repak is compiled without its HTTP/TLS stack. Both are enforced on every build ([tests/test_no_network.py](tests/test_no_network.py), [tests/test_no_download.py](tests/test_no_download.py)) and can be verified with one `grep` of this repository. The update check was removed with 1.19.2: Nexus' file submission guidelines prohibit internet-connecting executables "unless where it is crucial" and say "'auto update' functionality does not qualify as crucial". Updating is a manual file swap. |
-| Vanilla data | `repak unpack` of `pakchunk0-Windows.pak` (only the 29 needed GameData files), then `.cfg.bin` → text via the vendored decoder ([s2tweaker/vendor_bin2cfg.py](s2tweaker/vendor_bin2cfg.py)). Cached in `cache/vanilla-<pakSize>-s<schema>/`; a game update changes the fingerprint → automatic re-extraction. |
-| Oodle | The game's config archives are Oodle-compressed, so reading them needs the proprietary `oo2core_9_win64.dll`. The game does **not** ship it (Oodle is linked into the game executable), and **S2Tweaker never downloads it**: a program that pulls a library off the internet and then runs it looks exactly like a dropper, which is one reason scanners flag tools like this. The user places the file once; the tool looks in the usual local spots, always verifies the SHA-256, and says so at startup with a link and a target folder if it is missing. The bundled repak cannot fetch it either - it is built from source with the download function and its HTTP/TLS stack removed ([tools/build_repak.py](tools/build_repak.py)). Packing never needs Oodle. |
+| Network | **None.** Since 1.19.2 the program contains no networking code at all — no `urllib`, no sockets, no HTTP client — and since 1.23.0 there is no bundled helper program at all: pak files are read and written by [s2tweaker/pakfile.py](s2tweaker/pakfile.py) in plain Python. Both are enforced on every build ([tests/test_no_network.py](tests/test_no_network.py), [tests/test_no_download.py](tests/test_no_download.py)) and can be verified with one `grep` of this repository. The update check was removed with 1.19.2: Nexus' file submission guidelines prohibit internet-connecting executables "unless where it is crucial" and say "'auto update' functionality does not qualify as crucial". Updating is a manual file swap. |
+| Vanilla data | The needed GameData files are read straight out of `pakchunk0-Windows.pak` by [pakfile.py](s2tweaker/pakfile.py) (index parsed, only those entries decompressed), then `.cfg.bin` → text via the vendored decoder ([s2tweaker/vendor_bin2cfg.py](s2tweaker/vendor_bin2cfg.py)). Cached in `cache/vanilla-<pakSize>-s<schema>/`; a game update changes the fingerprint → automatic re-extraction. |
+| Oodle | The game's config archives are Oodle-compressed, so reading them needs the proprietary `oo2core_9_win64.dll`. The game does **not** ship it (Oodle is linked into the game executable), and **S2Tweaker never downloads it**: a program that pulls a library off the internet and then runs it looks exactly like a dropper, which is one reason scanners flag tools like this. The user places the file once; the tool looks in the usual local spots, always verifies the SHA-256, and says so at startup with a link and a target folder if it is missing. The DLL is loaded through `ctypes` only after its SHA-256 matched. Packing never needs Oodle. |
 | Ammunition swap | Per weapon, in the overrides tree: `AmmoCaliber` plus the `ProjectilePrototypeSID` of every existing `AmmoTypeProjectiles` slot in `WeaponGeneralSetupPrototypes` — the same struct `MaxAmmo` already lives in, so no new game file and no cache bump. Only existing slots are rewritten, never added or removed (whether `{bpatch}` can grow an array is untested in-game). The sort is read per index, never inferred from position: six sniper rifles carry `Supersonic` on `[0]`. The offered calibers are harvested from the weapon data, so 7.62×39 — real ammunition that no weapon uses and no generator drops — never appears. Nothing is blocked: damage lives on the weapon (`BaseDamage`), the round only multiplies, and that multiplier is 1.0 for every rifle and pistol caliber but 0.084 for 12 gauge, which shotguns offset with a much higher base value. Broken combinations are allowed and labelled with the computed factor. |
 | Parsing | [cfgparse.py](s2tweaker/cfgparse.py) parses GSC's cfg text format (`Name : struct.begin {refkey=...}` … `struct.end`) into a tree; `refkey` inheritance chains are resolved to get effective vanilla values. |
 | Patch output | [emit.py](s2tweaker/emit.py) writes `{bpatch}` structs. Patch files follow the proven convention `<BaseCfg>/<BaseCfg>_patch_<Mod>.cfg` under `Stalker2/Content/GameLite/GameData/`. |
-| Packing | [pakio.py](s2tweaker/pakio.py) stages the files and calls the bundled `tools/repak.exe` (defaults are exactly what the game wants: V8B, mount `../../../`, uncompressed). |
+| Packing | [pakio.py](s2tweaker/pakio.py) stages the files and [pakfile.py](s2tweaker/pakfile.py) writes the pak (exactly what the game wants: V8B, mount `../../../`, uncompressed, SHA-1 per entry). Verified against repak 0.2.3: same index, same entries, same hashes, and repak reads the result. |
 | Key game files | `ObjPrototypes` (player + mutants), `ItemPrototypes`, `TradePrototypes`, `DifficultyPrototypes` (per-difficulty multiplier groups), `EffectPrototypes` (overweight effects), `FloatProviderPrototypes` (scope-sway constant — patched instead of the sway effects so offset-aiming keeps working), `WeaponData/*` (damage, wear, spread, recoil), `CoreVariables` (repair costs, stamina drain), `ObjWeightParamsPrototypes` (carry weight), `ObjHoldBreathParamsPrototypes`, `StashPrototypes` (smart loot in stashes and on bodies), `ItemGeneratorPrototypes` (9.3 MB — the world's loot generators; only `MinCount`/`MaxCount` under `PossibleItems` is scaled, and only on generators that pass a two-stage safety filter, see below), `RelationPrototypes` (faction relations: 582 pair baselines + the RelationVersion counter the patch raises so saves notice changes — research: [docs/FACTION_RELATIONS_RESEARCH.md](docs/FACTION_RELATIONS_RESEARCH.md)). |
 
 Deep research notes with sources, vanilla values and risk analysis:
@@ -163,10 +163,10 @@ s2tweaker/
   gamedata.py           extraction pipeline, parsing, inheritance resolution
   cfgparse.py           GSC cfg text parser
   emit.py               {bpatch} cfg writer
-  pakio.py              repak wrapper (pack/unpack)
+  pakfile.py            pak reader/writer in pure Python (V1-V11 read, V8B write, Oodle via ctypes)
+  pakio.py              pack/unpack/list on top of it, Oodle DLL lookup (never a download)
   game.py               game folder auto-detection (Steam/GOG/Xbox)
   vendor_bin2cfg.py     cfg.bin → cfg decoder (vendored, public domain)
-tools/repak.exe         pak tool (MIT/Apache-2.0, by trumank)
 tools/build_exe.py      assembles the program folder dist/S2Tweaker/ (no PyInstaller)
 tools/launcher.py       shipped as _internal/sitecustomize.py: starts the GUI
 docs/SPEC.md            research: every tweak's mechanism + sources
@@ -184,7 +184,7 @@ python main.py          # run the GUI directly
 build.bat               # or assemble dist/S2Tweaker/ (needs a python.org install)
 ```
 
-`tools/repak.exe` is not the upstream release binary: `python tools/build_repak.py` rebuilds it from source (pinned tag) with the runtime Oodle download removed, so nothing in the shipped folder can fetch anything. The CI does this on every build.
+**There is no repak.exe since 1.23.0.** Until 1.22.0 the folder carried a repak binary compiled from source by the CI, the only unsigned executable in the package. On 2026-09-05 Microsoft's machine-learning engine flagged two such builds as trojans although they differed in 27 bytes of linker timestamp and PDB GUID only. Rather than fight a classifier that dislikes the shape of an unsigned Rust binary, the pak handling moved into Python: [s2tweaker/pakfile.py](s2tweaker/pakfile.py) reads pak versions 1 to 11 (Zlib, Gzip, Oodle) and writes V8B, using nothing but the standard library. [tests/test_pakfile.py](tests/test_pakfile.py) checks it against the real game: the 36 needed files come out byte for byte as repak extracted them, 27 third-party mod paks read identically, and a pak we write has the same index, entries and hashes as repak's.
 
 **There is no PyInstaller since 1.21.0.** `S2Tweaker.exe` is `pythonw.exe`
 from python.org, byte for byte, signed by the Python Software Foundation;
@@ -195,7 +195,7 @@ library as a `.pyc` zip compiled from the same python.org installation —
 without `socket`, `ssl`, `asyncio` and `sqlite3`, and without any OpenSSL
 library, so the package has no networking capability at all. Every DLL,
 PYD and EXE in the folder is signed by the PSF or Microsoft except
-`repak.exe`, which the CI compiles from source.
+nothing - there is no unsigned executable left.
 
 Why: the PyInstaller builds kept tripping antivirus heuristics. 1.20.0 was
 flagged by two engines on VirusTotal although its launcher was byte for

THIRD_PARTY_LICENSES.txt

@@ -42,17 +42,17 @@ as readable source.
 
 
 -------------------------------------------------------------------------
-repak (tools/repak.exe)
+repak (format reference only - no repak code or binary ships since 1.23.0)
 https://github.com/trumank/repak
 Dual licensed MIT OR Apache-2.0; the MIT terms are used here.
 
-MODIFIED BUILD: S2Tweaker does not ship the upstream release binary. It
-builds repak from source (pinned tag, see tools/build_repak.py) with one
-change: the function that downloads the Oodle library at runtime is
-removed, together with its HTTP/TLS stack. The build can therefore use an
-Oodle library that is already on the machine, but can never fetch one.
-Both licences permit modification; this note records that it happened.
--------------------------------------------------------------------------
+NOT BUNDLED ANY MORE: until 1.22.0 S2Tweaker shipped a repak binary
+compiled from source (with its Oodle download removed). Since 1.23.0 the
+pak files are read and written by the tool's own Python module
+(s2tweaker/pakfile.py), which implements the Unreal pak format as repak
+reads and writes it and was verified byte for byte against repak's
+output. The MIT notice below is kept in acknowledgement of that
+reference; no repak code is included.
 
 MIT License
 
@@ -101,10 +101,9 @@ never redistributed by this project.
 That library is required to decompress the game's own .pak archives. Note
 that S.T.A.L.K.E.R. 2 does not ship it as a separate file (Oodle is linked
 into the game executable), so it cannot be taken from the installation.
-S2Tweaker never downloads it, and neither does the bundled repak (see the
-note on the modified build above). The user places the file themselves;
+S2Tweaker never downloads it (and bundles no helper program that could). The user places the file themselves;
 the tool looks for it in the usual local places, verifies it against the
-SHA-256 checksum repak expects, and keeps it in the user's own S2Tweaker
+SHA-256 checksum it expects, and keeps it in the user's own S2Tweaker
 folder ("tools" next to the executable; if that folder is not writable,
 %LOCALAPPDATA%\S2Tweaker\tools is used instead). If it is missing, the
 tool says so at startup and names both the source and the target folder.

docs/CODE_SIGNING_POLICY.md

@@ -40,8 +40,7 @@ machine:
 - `python3XX.dll` and the extension modules in `_internal` are the ones from
   that installation, signed by the Python Software Foundation; the Visual C++
   runtime DLLs are signed by Microsoft. The workflow fails if any DLL, PYD
-  or EXE in the folder is unsigned — with exactly one exception, `repak.exe`
-  (see below).
+  or EXE in the folder is unsigned — without exception since 1.23.0.
 - The tool's own code ships as readable `.py` files in
   `_internal/s2tweaker`, next to the pure-Python libraries it uses
   (customtkinter, darkdetect, packaging). A small start-up module,
@@ -54,7 +53,8 @@ machine:
 
 Each build runs a self-test before it is accepted: a copy of the folder is
 started, imports every bundled module, proves that `socket` and `ssl` are
-absent, runs the bundled `repak.exe` once, builds the main window and tears
+absent, writes and reads back a small pak in pure Python, builds the main
+window and tears
 it down again.
 
 Each release is approved manually.
@@ -64,18 +64,18 @@ Each release is approved manually.
 Two things in the shipped folder are not built from this repository's
 source, and both are stated openly:
 
-- **`repak.exe`** (inside `_internal`) — the pak packer/unpacker by
-  [trumank](https://github.com/trumank/repak), MIT OR Apache-2.0. The
-  release does not use the upstream binary: the workflow compiles repak from
-  source at a pinned tag ([`tools/build_repak.py`](../tools/build_repak.py))
-  with its runtime download function and its whole HTTP/TLS stack removed.
-  It is the only unsigned executable in the folder. Its licence ships with
-  the tool ([THIRD_PARTY_LICENSES.txt](../THIRD_PARTY_LICENSES.txt)).
+- **No repak.exe since 1.23.0.** Until 1.22.0 the folder carried a repak
+  binary compiled from source by the workflow — the only unsigned
+  executable. On 2026-09-05 Microsoft's ML engine flagged two such builds
+  (differing in 27 bytes of timestamp and PDB GUID) as trojans. The pak
+  handling now lives in [`s2tweaker/pakfile.py`](../s2tweaker/pakfile.py),
+  plain Python verified against the game files and against repak's output
+  ([tests/test_pakfile.py](../tests/test_pakfile.py)).
 - **`oo2core_9_win64.dll`** (Oodle, proprietary, by RAD Game Tools /
   Epic Games) — **not** part of the download and never fetched by the tool.
   Reading the game's packed configuration files requires it, so the user
   places that file once, guided by a setup window that names the source and
-  the target folder. The tool verifies it against the SHA-256 checksum repak
+  the target folder. The tool verifies it against the SHA-256 checksum it
   expects. It is never redistributed by this project.
 
 ## Privacy
@@ -85,8 +85,7 @@ and no usage reporting.
 
 Since 1.19.2 it makes **no outbound requests at all**. There is no networking
 code left in the program: no `urllib`, no sockets, no HTTP client. The
-bundled `repak.exe` is compiled from source with its download function and
-its entire HTTP/TLS stack removed, so it cannot make a request either. Since
+tool bundles no helper program that could make a request either. Since
 1.21.0 the package does not even contain Python's `socket` and `ssl` modules.
 These claims are enforced by
 [tests/test_no_network.py](../tests/test_no_network.py),
@@ -115,6 +114,5 @@ tool's own folder on the user's machine.
   the unmodified files from python.org; the Visual C++ runtime DLLs carry
   Microsoft's.
 - S2Tweaker's own code ships as readable Python source and is not signed.
-  `repak.exe` is compiled from source by the workflow and is not signed.
 - No code-signing service is used by this project at present. Should that
   change, the signer and the certificate will be named here.