Turning on "Encrypt Index" option in Export window produces binary that can't be launched

[enxas]

Godot version

v4.1.1.stable.mono.official [bd6af8e0e]

System information

Godot v4.1.1.stable.mono - Windows 10.0.19045 - Vulkan (Forward+) - dedicated NVIDIA GeForce GTX 1660 Ti with Max-Q Design (NVIDIA; 31.0.15.3640) - Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz (12 Threads)

Issue description

When "Encrypt Index" option is enabled in Export window exported binary throws error when launched. Turning "Encrypt Index" off will export properly and exported binary works as expected.

Error: Couldn't load project data at path ".". Is the .pck file missing?
If you've renamed the executable, the associated .pck file should also be renamed to match the executable's name (without the extension).

When binary is launched with --verbose flag, this is full error.

PS C:\Tmp\exported> .\expo.exe --verbose
PS C:\Tmp\exported> ERROR: The MD5 sum of the decrypted file does not match the expected value. It could be that the file is corrupt, or that the provided decryption key is invalid.
   at: (core\io\file_access_encrypted.cpp:94)
ERROR: Can't open encrypted pack directory.
   at: (core\io\file_access_pack.cpp:231)
ERROR: The MD5 sum of the decrypted file does not match the expected value. It could be that the file is corrupt, or that the provided decryption key is invalid.
   at: (core\io\file_access_encrypted.cpp:94)
ERROR: Can't open encrypted pack directory.
   at: (core\io\file_access_pack.cpp:231)
Error: Couldn't load project data at path ".". Is the .pck file missing?
If you've renamed the executable, the associated .pck file should also be renamed to match the executable's name (without the extension).

Steps to reproduce

I have this configured: Editor Settings -> Export -> Window -> C:/tools/rcedit.exe (from https://github.com/electron/rcedit/releases)

1. Generate key and add it to the environment variable like described in Compiling with PCK encryption key.
2. Follow these first 3 commands (Build editor binary, Build export templates) in Compiling with .NET to compile export templates with encryption key. (Use Godot 4.1.1 source code)
3. Create new project with MeshInstance3D and Camera that you gonna export.
4. Click Project -> Export. Add Windows Desktop.
5. In Custom Template section provide path to compiled templates (ex. C:/Godot/Godot-4.1.1/bin/godot.windows.template_debug.x86_64.mono.exe)
6. In Encryption tab turn on "Encrypt Exported PCK", "Encrypt Index" and provide "Encryption Key"
7. Click Export project and try to launch it with --verbose flag.
8. Export again with "Encrypt Index" turned off to make binary launch properly.

My Export settings (mostly default)

Remove .txt extension, couldn't upload this file othervise: export_presets.cfg.txt

Minimal reproduction project

NA

[Calinou]

Does it work if you don't set up rcedit, so that it doesn't modify the executable?

[enxas]

Removing rcedit path from Editor Settings -> Export -> Windows still produces this error. Also unchecking "Modify Resources" doesn't change anything and still produces bad binary as long as "Encrypt Index" is turned on.

[bruvzg]

Usually this error happens when a wrong template is used. Re-check if you have set encryption key env. variable during template build (also check core/script_encryption_key.gen.cpp generated file after the build for the correct key).

[enxas]

File at core/script_encryption_key.gen.cpp contains this: uint8_t script_encryption_key[32]={0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0}; I assume these zeroes mean that encryption key env. variable wasn't properly set?

[bruvzg]

I assume these zeroes mean that encryption key env. variable wasn't properly set?

Yes, zeros mean it's not set, it should be the key in hex format which is read from the SCRIPT_AES256_ENCRYPTION_KEY environment variable.

[enxas]

This is my Windows Terminal Powershell history. I did set the env. variable. Not sure why it didn't work.

Is there scons clean command to clean build artifacts or should I just delete bin directory and start over gain?

Edit: Another question. If encryption key wasn't set properly, then why only "Encrypt Index" option is affected? "Encrypt Exported PCK" option works fine when enabled.

[bruvzg]

Another question. If encryption key wasn't set properly, then why only "Encrypt Index" option is affected? "Encrypt Exported PCK" option works fine when enabled.

Have you selected any files to encrypt ("filters to include" in the export options encryption tab)? Only these files are encrypted, and an error will pop up only when one of the encrypted files is accessed.

[enxas]

Have you selected any files to encrypt ("filters to include" in the export options encryption tab)?

No I haven't. I didn't knew that only explicitly listed files in "filters to include" are encrypted,