Game source policy.

Games have no Cargo dependencies. GamePKG injects scoped gamepkg:: functions for input, assets, selected ROMs, saves, drawing, shaders, textures, audio and achievements.

No dependency exceptions

All guest crates are rejected, including former gamepkg-* wrappers. Renaming a crate, making it optional, pinning its version or supplying a path or Git source does not enable it. Build, development, target-specific, workspace, patch, replace and feature sections are rejected. The signed lockfile contains exactly the root package.

There is no approval switch. Legacy approvals are ignored. A creator signature cannot bypass this policy. Host libraries belong to the reviewed player implementation and are separate from game source.

Scoped access

Every packaged Rust file is checked, including unused modules. Aliases, guest macros, indirect calls, unsafe code and ambient filesystem, network and process access are rejected. Games use host-owned virtual paths and permission-checked operations. A signed network = true enables supported HTTPS and TCP/UDP operations without IP or hostname allowlists, including local-network access; network = false disables them.

Linux builds use locked, offline Cargo in an isolated process without the user’s home directory or network access. Wasm execution has memory and time limits. Source checks, build isolation and runtime restrictions work together.

Update an older package

Remove Cargo dependencies, use the injected APIs, reduce the lockfile to the root package, update its hash, increase the game version and sign again with the same creator key. Read the developer instructions for examples and API details.