View Jar Signing

View Jar Signing

This mod enables the ability to view JAR signing info in NeoForge built-in mod list screen.

It is highly recommended that you have some understanding of JAR signing related details, and its caveats in a modding environment.

If you have doubts about a particular signed mod, please verify it using jarsigner beforehand. This mod only exposes the result produced by NeoForge and does not perform any JAR verification.

How to read its output

Only signed mod will have signing information displayed.

Status: self-explanatory [see note]

Leaf signer fingerprint: SHA256 fingerprint for the first signer's leaf certificate.

Signer(s) Format: <CodeSignerN>.<CertificateN> [Type]: <Signer Info> (CertAlg)

• CodeSigner - Signer that present in the manifest.
• Certificate - Certificate in signer's certificate path.
• Type: CA- Certificate Authority Self- Self-signed.
• Signer Info: distinguished name information.
• CertAlg - algorithm name that used to create the certificate.

* will prefixed for each leaf signer's certificate, except for JAR that has only one signer certificate.

By default, only leaf certificate will be shown. Configuration is provided to enable listing of all certificate chain.

Note

This mod mixin and uses some internal NeoForge and SecureJarHandler APIs to obtain, display the signers' certificate details. Therefore, stability of this mod is not guaranteed.

• It only verifies .class files, other files is ignored.
• Mod can be modified in runtime and still be valid, since verification take place in actual JAR file.
• Minecraft will always show Invalid status since its installation occurred during install-time.

Background

The display is mostly based on NeoForge's ModListScreen.

---

It is first introduced in 1.16 but disabled in mod list screen due to it not perform actual checks, shortly after implemented. https://github.com/MinecraftForge/MinecraftForge/issues/7500

In 1.17 onwards, verification of .class is performed. https://github.com/neoforged/NeoForge/blob/1.17.x/fmlloader/src/main/java/net/minecraftforge/fml/loading/moddiscovery/AbstractJarFileLocator.java#L57

In 1.21, it remains unchanged, although it has moved to a different package. https://github.com/neoforged/FancyModLoader/blob/1.21.1/loader/src/main/java/net/neoforged/fml/loading/moddiscovery/ModFile.java#L152-L153