a139084ad6
Some checks are pending
CodeQL / Analyze (cpp) (push) Waiting to run
CodeQL / Analyze (actions) (push) Waiting to run
Build Desktop / Configure (push) Waiting to run
Build Desktop / Debian 13 (push) Blocked by required conditions
Build Desktop / Debian 12 (push) Blocked by required conditions
Build Desktop / Fedora 44 (push) Blocked by required conditions
Build Desktop / Fedora 43 (push) Blocked by required conditions
Build Desktop / Servatrice_Debian 12 (push) Blocked by required conditions
Build Desktop / Ubuntu 24.04 (push) Blocked by required conditions
Build Desktop / Ubuntu 26.04 (push) Blocked by required conditions
Build Desktop / Arch (push) Blocked by required conditions
Build Desktop / Ubuntu 26.04 cover (push) Blocked by required conditions
Build Desktop / macOS 13 Intel (push) Blocked by required conditions
Build Desktop / macOS 14 (push) Blocked by required conditions
Build Desktop / macOS 15 (push) Blocked by required conditions
Build Desktop / macOS 26 Debug (push) Blocked by required conditions
Build Desktop / Windows 10 (push) Blocked by required conditions
Build Desktop / Prune caches (push) Waiting to run
Build Docker / Servatrice (arm) (push) Waiting to run
Build Docker / Servatrice (x86) (push) Waiting to run
Build Docker / Publish multi-platform Servatrice image (push) Blocked by required conditions
* [Security] Add challenge-response auth with scrypt verifiers and stop storing plaintext passwords Challenge-response authentication: the client derives a scrypt verifier (RFC 7914, EVP_PBE_scrypt, N=32768, r=8, p=1) and authenticates with HMAC-SHA256(key, nonce), so neither the password nor its hash is transmitted. The stored format becomes "$scrypt$<n>$<r>$<p>$<salt>$<verifier>" and Response_PasswordSalt now carries the cost parameters. Strict servers only accept scrypt verifiers; legacy accounts are migrated after a successful login. Fix #344 for challenge-response servers: a saved profile stores the derived verifier under the password key instead of the plaintext password. The connect dialog loads it without revealing it, autoconnect passes it through, the change-password dialog no longer prefills the old password field with it, and the client only persists the verifier when "Save password" is checked. Took 3 minutes Took 1 minute Took 10 seconds Took 7 minutes * [Security] Harden credential format acceptance and challenge nonce validation * [Security] Refuse KDF downgrade; trim profile name and warn on silent credential drop * [Security] Add SupportsAll ServerOptions enumerator to fix enum validation assert The server advertised both SupportsPasswordHash (1) and SupportsChallengeResponseAuth (2) via a bitwise-OR that produced the value 3, which no enumerator declared. Protobuf's proto2 enum validation rejects the value in _internal_set_server_options, crashing servatrice on the debug assertion. Add a SupportsAll = 3 enumerator with an identical wire value so the bitmask reads unchanged while the value is now a documented, valid member of the enum. * [Security] Normalize username when issuing challenge nonce cmdRequestPasswordSalt bound the challenge nonce to the raw, un-simplified username while cmdLogin verifies it against the simplified name. A user who typed leading or trailing whitespace in the username box would be silently rejected during challenge-response login even with the correct password. Simplify at the nonce-issuing site so both commands agree on the normalized name. Also drive-by formatting: collapse the now single-expression serverOptions initializer onto one line. * [Security] Keep an encrypted legacy password backup for old-client logins Migrating an account to scrypt stranded pre-challenge clients, which can only present the legacy salt+hash: after migration the server served them a scrypt salt they cannot use, so the only recovery was a password reset. When security/legacy_backup_key is configured (64 hex chars, openssl rand -hex 32), submitPasswordVerifier now seals the legacy credential with AES-256-GCM under that key before overwriting the row, storing it in password_legacy_backup with the time it was last used. Old clients keep working: cmdRequestPasswordSalt serves the backup's 16-char salt in password_salt so they can derive the legacy hash they were always able to compute, while new clients derive the verifier from the new scrypt_salt field, which always carries the verifier salt. The non-challenge login path accepts the plaintext or legacy hash against the decrypted backup and refreshes its window; a migrated row with no usable backup fails closed. Backups age out so a database dump taken after the window closes never carries a crackable legacy hash: getUsableLegacyBackup purges on first use past security/legacy_backup_ttl_days (default 90, clamped 1..3650), and a six-hourly sweep drops backups idle accounts never touch. changeUserPassword clears the backup since a new credential invalidates it. Without a configured key nothing is sealed or purged, so a temporarily missing key cannot destroy existing backups. The AAD is the simplified user name on both sides, sealing the blob to its row so it cannot be moved between accounts. Sealing failures degrade to the previous lockout behaviour rather than blocking migration. The columns extend the unmerged 0036->0037 migration, so the schema version stays 37. * [Security] Address review: proto compat, plaintext verify, AAD case, strict scope Fix the two blockers and follow-ups from the 2026-10-16 review: - Advertise challenge-response in a new supports_challenge_response field instead of the ServerOptions enum and drop SupportsAll: proto2 enums are closed, so already-released clients parsed server_options = 3 as NoOptions and fell back to plaintext passwords. server_options stays exactly SupportsPasswordHash on the wire; old clients ignore the new field. - Verify a plaintext password directly against a migrated scrypt row with verifyPassword() so email changes (cmdAccountEdit) and old clients sending password keep working without a legacy backup key. Pre-hashed values are still checked against the backup, and its TTL window is refreshed only when the backup is what actually matched. - Use the stored row name as the AES-GCM AAD on both seal and open so a login whose case differs from the stored name (utf8mb4_unicode_ci) still opens its backup. - Require challenge-response in strict mode only for registered SQL accounts (userExists gate), leaving guest/unregistered logins and none/password auth methods unaffected. - Document in servatrice.ini.example that a captured legacy hash can take over a not-yet-migrated account and that strict only constrains registered SQL accounts. Schema version is 38. * [Security] Raise legacy backup TTL default to 180 days Gives operators and slow-to-upgrade users a longer downgrade window for pre-challenge clients before unused encrypted legacy password backups age out. * [Security] Fix servatrice.cpp formatting per clang-format-18 * [Security] Add missing forward declaration for Command_SubmitPasswordVerifier The cmdSubmitPasswordVerifier declaration references the proto-generated type, which otherwise does not name a type in this header and breaks every C++ build. --------- Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de> Co-authored-by: BruebachL <bruebachl@cockatrice.example> |
||
|---|---|---|
| .ci | ||
| .github | ||
| .tx | ||
| cmake | ||
| cockatrice | ||
| doc | ||
| libcockatrice_card | ||
| libcockatrice_deck_list | ||
| libcockatrice_filters | ||
| libcockatrice_interfaces | ||
| libcockatrice_models | ||
| libcockatrice_network | ||
| libcockatrice_protocol | ||
| libcockatrice_rng | ||
| libcockatrice_settings | ||
| libcockatrice_utility | ||
| oracle | ||
| servatrice | ||
| tests | ||
| tools | ||
| vcpkg@9e593bb18e | ||
| .clang-format | ||
| .cmake-format.json | ||
| .dockerignore | ||
| .gitignore | ||
| .gitmodules | ||
| CMakeLists.txt | ||
| docker-compose.yml | ||
| docker-compose.yml.windows | ||
| Dockerfile | ||
| Doxyfile | ||
| format.sh | ||
| gcovr.cfg | ||
| iwyu.sh | ||
| LICENSE | ||
| qt6.imp | ||
| README.md | ||
| shell.nix | ||
| vcpkg.json | ||
Cockatrice | Download | Related | Community | Contribute | Build | Run
To get started with Cockatrice ⇢ view our webpage
To get support, or suggest changes to the app ⇢ file an issue (How?) To help with development ⇢ learn how to contribute
Cockatrice
Cockatrice is an open-source, multiplatform application for playing tabletop card games over a network. The program's server design prevents users from manipulating the game for unfair advantage. The client also provides a single-player mode, which allows users to brew while offline.
This project uses C++ and the Qt libraries.
Download 
Downloads are available for stable releases and the current beta version in development.
There is no strict release schedule for either of them.
Latest stable release:
Latest beta version:
While incorporating the latest fixes and features, beta builds may not be stable or contain new bugs! Please report any findings and open new issues when testing them!
Related Repositories
- Magic-Token: File with MtG token data for use in Cockatrice
- Magic-Spoiler: Code to generate MtG spoiler data from MTGJSON for use in Cockatrice
- cockatrice.github.io: Code of the official Cockatrice webpage
- io.github.Cockatrice.cockatrice: Configuration of our Linux
flatpakpackage hosted at Flathub - Webatrice: Web client for Cockatrice servers (TypeScript / React)
Community Resources 
Join our Discord community to connect with other project contributors (#dev channel) or fellow users of the app. Come here to talk about the application, features, or just to hang out.
Important
For support regarding specific servers, please contact that server's admin/mods and use their dedicated communication channels rather than contacting the team building the software.
Contribute
Code | Documentation | Translation
Repository Activity
Code
To contribute code to the project, please review our guidelines first.
We maintain two tags for contributors to easier find issues to potentially work on:
Issues tagged in this way provide a simple way to get started. They don't require much experience to be worked on.
This tag is used for issues that we are looking for somebody to pick up. Often this is for feature suggestions we support, but don't have the time to work on ourselves.
For both tags, we're willing to provide help to contributors in showing them where and how they can make changes, as well as code reviews for submitted changes.
We'll happily advice on how best to implement a feature, or we can show you where the codebase is doing something similar before you get too far along - put a note on an issue you want to discuss more on!
You can also have a look at our Todo List in our Code Documentation or search the repo for \todo comments.
Documentation 
There are various places where useful information for different needs are maintained:
- Official Code Documentation
- Official Wiki
Community supported - Official Webpage
- Official README
This file - Official CONTRIBUTING
Cockatrice tries to use the Google Developer Documentation Style Guide to ensure consistent documentation. We encourage you to improve the documentation by suggesting edits based on this guide.
Translation 
Cockatrice uses Transifex to manage translations. You can help us bring Cockatrice and Oracle to your language and just adjust single wordings right from within your browser by visiting our Transifex project page. The Webatrice web client manages its own translations in its repo.
Check out our Translator FAQ for more information about getting involved, and join a group of hundreds of others!
Build 
Dependencies: (for minimum versions search our CMake file)
Oracle can optionally use some packages to load compressed card files:
Basic compilation steps:
mkdir build
cd build
cmake ..
make
You can then
- Create a Cockatrice installation inside the
releasefolder:make install - Or make an installation package specific to your system:
make package
Note
Detailed compiling instructions can be found in the Cockatrice wiki at Compiling Cockatrice
The following flags (with their non-default values) can be passed to cmake:
| Flag | Description |
|---|---|
-DWITH_SERVER=1 |
Build Servatrice server |
-DWITH_CLIENT=0 |
Don't build Cockatrice client |
-DWITH_ORACLE=0 |
Don't build Oracle card database tool |
-DCMAKE_BUILD_TYPE=Debug |
Compile in debug mode Enables extra logging output, debug symbols, and much more verbose compiler warnings |
-DWARNING_AS_ERROR=0 |
Don't treat compilation warnings as errors in debug mode |
-DUPDATE_TRANSLATIONS=1 |
Configure make to update the translation .ts files for new strings in the source codeNote: make clean will remove the .ts files |
-DTEST=1 |
Enable regression tests Note: make test to run tests, googletest will be downloaded if not available |
Tip
Build code documentation (Doxygen) according to our configuration into
/docs:doxygen Doxyfile
Run
Cockatrice is the game client
Oracle fetches card data
Servatrice is the server
Docker
You can build an image & deploy a Servatrice (Cockatrice server) container using Docker and our Dockerfile yourself.
For more details, look into our wiki section on Setting up Servatrice.
You'll also find more hints on our pre-build image there, or the docker-compose file which will configure and run both a MySQL server and Servatrice.
License 
Cockatrice is free software, licensed under the GPLv2.