FortressGD

Export a Godot game that stock GDRE/KeyDot cannot one-click recover, without maintaining a fork. Designers keep the official Godot editor. Custom export templates are relinked per project in a prebuilt build image, compiled once from a pinned Godot tag plus a small patch quilt. Production exports refuse to ship source, and fortressgd verify fails CI if they did.

What this is not

FortressGD raises the cost of automated recovery. It does not make a local client unextractable: a debugger can still dump decrypted resources from a running game. See the threat model.

Features

Export hygiene

Production presets skip GDScript text, C# source, .pdb symbols, DCC work files and source maps. fortressgd verify lists packed paths and fails CI if anything leaked.

Derived encryption key

The PCK AES-256 key is derived from the project secret (FGD-KDF-1) and stored by code generated per build, so an extractor written for one build is not meant to work on another. The secret itself never ships.

Per-project pack dialect

Pack magic and index field order come from the project secret, so stock GDPC parsers cannot list the pack.

GDScript mangling

Strips comments and debug calls, and renames user identifiers with an HMAC keyed from the project secret.

Supported engine tags: Godot 4.6.2 and 4.7.2 stable. Protected platforms in v1: Windows and Linux (x86_64).

Read next

Getting startedLeak checks with the official editor: no Docker, no custom templates.

Project secretWhere to keep it, what doctor checks, and the rotation runbook.

CI and templatesThe GitHub Action, build images, build times and unpacker fixtures.

Design specHow every part of FortressGD is meant to work.