JTX SDK Signing Portal

Your licensed SDK build

Customer—

Build—

Topology—

License—

Your signing key is already pinned in this build and in the JTX DLL. The descriptor below is the one committed for your pinned key — downloading it does not re-issue or change it.

Step 1 — Download your signing materials

All downloads are authenticated to your session. Place them together in one signing folder.

Step 2 — Sign your client locally

On your own machine, with your private key that never left it. Use the block that matches your build Topology (shown in the panel above after you sign in). --out must be a directory that does not already exist — the tool creates it, and re-running onto an existing one is refused by design.

First verify the untouched SDK handoff using the independently supplied JTX trust information. Copy its ClientSDK folder into a separate private signing workspace and run the commands from that workspace root. The SDK already contains the signing tool in CustomerSigning/; the separate tool ZIP is optional. Place your rebuilt host and engine copies in the workspace or replace their names below with full paths. Keep your private key outside folders delivered to players.

Create components.json in that workspace root with these six paths. The tool verifies every component against the signed descriptor.

{
  "graphics": "Runtime/JtxGraphicsDX11.dll",
  "integrity": "Runtime/JtxGraphicsDX11.dll.integrity",
  "dependency": "Runtime/tbb.dll",
  "core": "Runtime/JtxCore.dat",
  "classic": "Runtime/JtxClassic.assets",
  "graphicsLayout": "Runtime/JtxGraphicsDX11.dll.layout"
}

If you use Authenticode, apply it to the final binaries first. Run JTX signing last, after all binary changes.

Split build — host + `JtxGameDX11.dll` (the reviewed SDK packages)

python CustomerSigning/jtxhostsign.py sign --profile CustomerSigning/public-profile.json --descriptor Runtime/JtxSdk.integrity --host YourClient.exe --engine JtxGameDX11.dll --key C:/Private/your-publisher.pem --components-manifest components.json --out ./seal
python CustomerSigning/jtxhostsign.py verify-deployment --profile CustomerSigning/public-profile.json --descriptor Runtime/JtxSdk.integrity --host-record ./seal/JtxHost.integrity --host YourClient.exe --host-layout ./seal/YourClient.exe.layout --engine JtxGameDX11.dll --engine-layout ./seal/JtxGameDX11.dll.layout --components-manifest components.json

Monolithic build — single host `.exe`

Use this variant only when your authenticated SDK profile is monolithic (split: false). Omitting engine arguments cannot convert a split SDK into a monolithic one.

python CustomerSigning/jtxhostsign.py sign --profile CustomerSigning/public-profile.json --descriptor Runtime/JtxSdk.integrity --host YourClient.exe --key C:/Private/your-publisher.pem --components-manifest components.json --out ./seal
python CustomerSigning/jtxhostsign.py verify-deployment --profile CustomerSigning/public-profile.json --descriptor Runtime/JtxSdk.integrity --host-record ./seal/JtxHost.integrity --host YourClient.exe --host-layout ./seal/YourClient.exe.layout --components-manifest components.json

This produces a customer-signed JtxHost.integrity + layout records (plus the engine layout for a split build). Ship them next to your binaries; the JTX DLL verifies them before it authorizes protected operation. Before you rely on any download, verify your descriptor against the trusted vendor key from your SDK handoff — a hash shown in the browser is not a trust anchor.

Security: JTX never receives your .exe, your JtxGameDX11.dll, or your private key. The portal only hands you materials you are already licensed for. All signing happens on your machine.

Rotate your signing key (new build required)

Your current key is pinned in your build and cannot be swapped on an existing SDK. To move to a new key, submit your new public key — this queues a new owner-reviewed, matched SDK build; it is not instant and does not change your current build. Never submit a private key.

Customer access