Encrypted Linux exports do not run with Linux runtime on Steam Deck

Help
, ,
1

Godot Version

v4.6.2.stable.mono.official [71f334935]

Question

I recently set up my exports (Windows and Linux) to use the Godot binary encryption, and I thought it was working great. I develop under Linux, and all my Linux exports run without a hitch. After uploading the builds to Steam for further testing, I discovered that the export does not execute in the Steam Deck environment (configured to use the native Linux runtime). When I configure the game to use the latest Proton environment (which is a Windows emulation on the Steam Deck), then the game does execute, but with reduced performance.

I was on the fence about using encryption at all, so before I backtrack to no encryption whatsoever, is there a relatively easy way to make this work?

2

I would suggest providing some more details on what you did to set it up, and if it works without encryption

3

Of course. I created a new 256-bit key and followed tutorials from several sources to build custom export templates (one for Windows and one for Linux) from Godot source using the key. The Linux executable and PCK that I built using the custom template ran flawlessly on my Linux dev machine. Using GDRE tools, I verified that the new PCK file was encrypted.

The previous Linux build of the game ran flawlessly on the Steam Deck as well.

I uploaded the encrypted build to Steam and updated the install on the Steam Deck (which runs on Linux) to use the new, encrypted version. Executing the encrypted version via Steam on my Linux desktop works perfectly. Executing the encrypted version via Steam on my Steam Deck fails.

I would note that while the Steam Deck can execute Windows binaries (including encrypted ones) using emulation the performance is poor.

It seems that Godot is using a system library to perform the cryptography, but the necessary binaries are either missing on the Steam Deck, or are incompatible.

4

How you determined this information would be helpful. Do you get any logs? Have you tried running the game within steam’s runtime and if so which ones have you tried? Are you certain your steam depots are set up correctly, if the project doesn’t launch at all through steam then it could be missing the executable path or be assigned to the wrong operating system.

5

This is a native Linux export, so as far as I know, Steam will only run that with Steam Linux Runtime 1.0.

The depot is set up correctly because the correct binaries are winding up where they should be. This was all working perfectly up until I re-built the binaries with encryption. The re-built binaries DO work correctly on my Ubuntu 26.04 desktop development system.

On the Steam Deck, I switched to desktop mode and ran the encrypted binary from the command line:

./<appname>.x86_64: /usr/lib/libm.so.6: version `GLIBC_2.43’ not found (required by ./<appname>.x86_64)

Interestingly, while searching this specific message together with Steam Deck, I arrived right back on this forum 20 days ago, where you had plenty of helpful advice!

There is a solution in that thread, but it may be more trouble than it’s worth, given that this problem is only arising with encrypted builds, which I certainly don’t have to use. It raises another question, though: why are only the encrypted builds failing? I built export templates against the same Godot version that my regular unencrypted exports were using.

6

Stepped away for a hot minute and now I realize that this probably has everything to do with my Linux build environment and nothing to do with whether the export is encrypted or not.

As it says in the Godot docs WARNING, I should be building the Linux export template on a suitably old system, such as Ubuntu 16.04.

I will try this approach and report back tomorrow.

7

Yeah if you are compiling only encrypted builds from source then my advice is sound, you should be compiling against the steam runtimes to run it on steam.

8

Oh hello! That’s my thing! :smiley:

But - yeah - you should take @gertkeno’s word on it and essentially compile whatever you need through something like Distrobox using the OCI image Valve provides. I would personally recommend using the Steam Linux Runtime 4.0 one, as it has - like I pointed out in that post - just about enough tools required to compile Godot or its templates and it’s also more on-par with the recent version of SteamOS.

Just don’t forget to write the export SCRIPT_AES256_ENCRYPTION_KEY=“your_generated_key” command before you start compiling within Distrobox (mind you, as the Godot docs point out, environment variables like that do not persist between terminal sessions, and you’ll be essentially starting up a self-contained terminal session within a different terminal session), and also - I can’t stress this enough - don’t forget to write that generated key for that specific template compile somewhere, because if you’ll use a custom template to export encrypted builds, The Encryption Key field should contain that exact same generated key as the one you compiled the custom export template with.

Good luck!!!

9

Thank you, @polyvishap and @gertkeno! I now have working, encrypted builds running on Windows, Linux (Ubuntu 26.04), and Steam Deck. It was easier than I thought it would be. For posterity, the steps I followed on my Ubuntu 26.04 dev machine:

Install Distrobox

Install Distrobox to your Linux dev machine:

sudo apt install distrobox

Set Up Steam Runtime V4

Build the export templates using Steam OS Runtime version 4:

distrobox create -i registry.gitlab.steamos.cloud/steamrt/steamrt4/sdk steamrt4

Enter the container using the command:

distrobox enter steamrt4

Build From Godot Sources

Before building you must download appropriate sources. For example, building for 4.6.2 stable, download Godot_v4.6.2-stable.zip. Expand the zip, open a terminal from within the source tree and enter the container (see above).

Once open, build the Linux export template:

SCRIPT_AES256_ENCRYPTION_KEY="<AES 256-bit key text>" scons platform=linux module_mono_enabled=yes target=template_release

Then the Windows template. Several steps are required to prepare for a Windows build:

Clone mimalloc source into thirdparty/mimalloc

Install mingw for Linux:

sudo apt install scons mingw-w64 llvm libpcre2-dev zlib1g-dev libfontconfig1-dev

Configure to use posix threads:

sudo update-alternatives --config x86_64-w64-mingw32-g++

Then build the Windows templates:

SCRIPT_AES256_ENCRYPTION_KEY="<AES 256-bit key text>" scons -j$(nproc) platform=windows module_mono_enabled=yes target=template_release  use_llvm=yes lto=full production=yes
10

Hell yeah!!! Glad to read that this helped out! :smiley: