Skip to content

mod_submission.md

Latest commit

 

History

History
54 lines (36 loc) · 2.73 KB

mod_submission.md

File metadata and controls

54 lines (36 loc) · 2.73 KB
Raw

How to submit a mod for verification

Note before you start

To avoid preventing users connecting to your server requiring a mod that's not been verified yet, we recommand you to update your mod following these steps (let's consider that your server requires a mod with version v0.1.0):

  1. Publish the new version of your mod (v0.2.0 for instance) on the platform of your choice;
  2. Leave your server to use the old version (v0.1.0);
  3. Submit a mod verification request of your new version (v0.2.0);
  4. Switch your server to using v0.2.0 once it has been verified.

Hosting your mod

Criteria

For your mod to be successfully verified, it MUST follow the following set of rules:

  • do not embed malicious code (obviously): your mod is going to be downloaded to people's computers, so it shouldn't do something nasty (e.g. mining some cryptos without users' knowledge);
  • mod archive is hosted: for your mod to be downloadable, it must be hosted somewhere on the Internet, and publicly accessible;
  • source code is public: your mod's Thunderstore webpage should display a link to your source code repository;
  • verified dependencies: if your mod depends on other mods, they're gonna be downloaded to people's computers too, so they have to be verified as well.

Are all of the above criteria OK? Well, time to create a pull request!

After forking this repository, update the verified-mods.json file with content related to your mod:

  • add a new entry if your mod hasn't been verified yet;
  • add a new version entry in your mod's entry otherwise.

In either case, don't forget to add the new archive's checksum and commit hash to the verified-mods.json file.

Hosting your mod

We recommend you host your mod on ModWorkshop.

You can also host it on Thunderstore, in which case using AnActualEmerald's mod template would probably help.

Checksum

To make sure that the mod downloaded by Northstar is the same that has been verified, we use cryptographic hashes of mod archives (think of them as "file signatures"); if the content of the archive is changed, its hash will change too.

There are different hash algorithms; this mod verification mechanism uses the SHA256 algorithm.

To submit your mod for verification, you need to provide the hash for the corresponding zip archive.

On Windows, it's done using the certutil executable (in Powershell or cmd):

certutil -hashfile my_mod_archive.zip SHA256

On Linux, it's even easier:

sha256sum my_mod_archive.zip

Once you're done, submit your pull request! We'll review your mod as soon as possible, so be on the lookout for comments!