// OPENBOX DOCS

Enterprise

License, signing, and verification for production use.

Enterprise

Use this page when you need to verify what you are running.

License

OpenBox Game Launcher is released under GNU Affero General Public License v3.0. Source is at vindeckyy/OpenBoxGL and the full text is at LICENSE. Trademark references to LaunchBox, Steam, Heroic, Lutris, RetroArch, and other third party products are used for compatibility description only. See Legal and trademarks and Disclaimer.

Signed releases

Every AppImage release is signed with Ed25519. The installer verifies the release against a pinned public key and a published SHA-256 checksum.

ArtifactWhat it isWhere to find it
OpenBox-x86_64.AppImageRelease binaryReleases
OpenBox-x86_64.AppImage.sigEd25519 signatureSame release assets
openbox-release.pubPinned public keyApplication repository at openbox-release.pub, pinned by SHA-256 in scripts/install.sh
SHA256SUMSChecksums for the releaseSame release assets

Verify path: download the AppImage, the .sig, and the openbox-release.pub you pin, then run the installer with OPENBOX_RELEASE_TAG="v1.3.0" as shown in Downloads. The installer refuses a release when the key, checksum, or signature does not match. See Updating for rollback with OpenBox-x86_64.previous.AppImage.

Build and CI

SignalWhere to check
CI on push, pull request, and weeklyActions
Lint, type, and test gatesmake check and scripts/check_tests.py
Release verificationtest_release_signing.py

The application uses only the Python standard library at runtime. Build tooling is described in Project and policies.

Data and privacy

Library data is local JSON at ~/.local/share/openbox-game-launcher/library.json. Set OPENBOX_DATA_DIR before launch to relocate it. The server binds to 127.0.0.1 on a random port, requires a per launch token on every request, and never listens on the network. No account, no cloud, no telemetry. See Interfaces and data, Data and recovery, and Privacy.

Support and notices