Pin the exact source of every open-source binary Steam ships:
- 6766 runtime binaries (verified by SHA-256 against their .debs) map to
755 exact Debian/Valve source packages, plus steam-runtime-tools tags
- Valve-built bundled libraries map to upstream tags identified from version
strings: FFmpeg 8.1.2 / 4.3.4, SDL 3.4.0, SDL_image 3.2.0, SDL_ttf 3.1.0,
libvpx v1.10.0-78-g338013712, libaom 3.6.1, libvorbis 1.3.7, libavif 1.0.3/1.0.4
- Inferred (kept decompiled as well): dav1d 1.0.0, and ANGLE / SwiftShader /
Vulkan-ValidationLayers / CEF via Chromium 126.0.6478.183 DEPS
SOURCES.tsv and BINARY_SOURCES.tsv record versions and evidence;
tools/sources.py fetches them into the gitignored sources/ tree.
Decompiled output for exactly-pinned binaries is removed; the proprietary
NVIDIA Cg toolkit binaries stay decompiled.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
tools/verify_runtime.py reads each runtime's package manifest, downloads the
listed packages from repo.steampowered.com (and Debian/Ubuntu fallbacks), plus
pressure-vessel releases and archived scout images, and matches every runtime
ELF by SHA-256. All 6766 unique binaries (16813 incl. duplicates) match exactly;
decomp/runtime/PROVENANCE.tsv records the package, version and URL for each.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
linux32/steamclient.so is the 32-bit build games load via ~/.steam/sdk32.
tools/decompile_batch.sh batches many binaries per Ghidra JVM for the Steam
runtimes, mirroring their paths under decomp/runtime/.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
SalastilandClaude Opus 5.5