Published client packages for PokéOrigins, and nothing else. There is no source code here; this repository exists so the game client can fetch its own updates without the source repository being public.
Take the package for your machine from the latest release:
| Machine | File |
|---|---|
| Mac, Apple silicon (M1–M4) | porigins-osx-arm64.zip |
| Mac, Intel | porigins-osx-x64.zip |
| Windows | porigins-win-x64.zip |
| Linux | porigins-linux-x64.zip |
Extract it and run POrigins.Client. Nothing else needs installing.
Every platform shows a warning the first time, because these packages are not signed with an Apple or Microsoft code-signing certificate:
- macOS says the app "is damaged". It is not. Run
xattr -dr com.apple.quarantine <extracted folder>once. - Windows shows "Windows protected your PC" — More info → Run anyway.
- Linux needs
chmod +x POrigins.Client.
Check an install with ./POrigins.Client --paths; the last line should read
ALL PATHS OK.
After the first install the client updates itself.
Each release carries manifest.json and a detached manifest.json.sig: a raw
64-byte Ed25519 signature over the exact bytes of the manifest. The client
verifies it against a key compiled into the binary before it applies anything,
and you can verify it yourself with OpenSSL:
printf '302a300506032b6570032100' | xxd -r -p > pub.der
printf '%s' 'ZQUrTgC2TC1LaupLsardvnlpx6j/fmiX2AXegFy96y8=' | base64 -d >> pub.der
openssl pkey -pubin -inform DER -in pub.der -out pub.pem
openssl pkeyutl -verify -pubin -inkey pub.pem -rawin \
-in manifest.json -sigfile manifest.json.sigThe manifest also carries the SHA-256 of every package, so a download can be
checked with shasum -a 256 against it.
Releases are signed on a maintainer's machine with a key that is deliberately not held by any CI system — a compromised build pipeline cannot publish a client anybody will install.