HMCL-dev/HMCL · error · IOException

Current JAR is not verified

Error message

Current JAR is not verified

What it means

HMCL verifies its own JAR integrity (via IntegrityChecker) before performing an in-place update. In updateFrom, after the update executor succeeds, if the currently running JAR has not passed self-verification and the check is not disabled, the update is aborted with this IOException so a tampered or corrupt build cannot overwrite the installed binary.

Solutions

  1. Re-download the official HMCL JAR from the official release and run that instead
  2. If you build HMCL yourself, produce it via the official build so IntegrityChecker accepts it
  3. For trusted dev environments only, set the self-integrity-check disable system property (HMCL_DISABLE_SELF_INTEGRITY_CHECK=true) when launching
  4. Verify the JAR was not modified after download (checksum against release)

Example fix

// before: running a modified HMCL.jar
java -jar HMCL-modified.jar
// after: use official jar, or for trusted dev builds
java -Dhmcl.self.integrity.check.disable=true -jar HMCL-dev.jar
Defensive patterns

Strategy: try-catch

Validate before calling

if (!IntegrityChecker.isSelfVerified() && !IntegrityChecker.DISABLE_SELF_INTEGRITY_CHECK) {
    LOG.warning("Skipping update: current JAR is not self-verified");
    return;
}

Try / catch

try {
    updateHandler.updateFrom(executor);
} catch (IOException e) {
    if (e.getMessage().contains("not verified")) {
        LOG.warning("Self-integrity check failed; re-download the official HMCL JAR", e);
    }
}

Prevention

When it happens

Trigger: Calling updateFrom with a successfully downloaded update while the running HMCL JAR fails IntegrityChecker.isSelfVerified() and the system property HMCL_DISABLE_SELF_INTEGRITY_CHECK (DISABLE_SELF_INTEGRITY_CHECK) is not set.

Common situations: Running a locally rebuilt HMCL JAR that was not signed/verified; a modified or corrupted JAR in the install directory; running from a build produced without the integrity-check step; someone patched the JAR manually.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of HMCL-dev/HMCL@24702dc5a0 (2026-09-10). Data as JSON: /api/errors/6505b236960c6c48. Report an issue: GitHub.

Appendix: source

Thrown at HMCL/src/main/java/org/jackhuang/hmcl/upgrade/UpdateHandler.java:128

            Path downloaded;
            try {
                downloaded = Files.createTempFile("hmcl-update-", ".jar");
            } catch (IOException e) {
                LOG.warning("Failed to create temp file", e);
                return;
            }

            Task<?> task = new HMCLDownloadTask(version, downloaded);

            TaskExecutor executor = task.executor();
            Controllers.taskDialog(executor, i18n("message.downloading"), TaskCancellationAction.NORMAL);
            thread(() -> {
                boolean success = executor.test();

                if (success) {
                    try {
                        if (!IntegrityChecker.isSelfVerified() && !IntegrityChecker.DISABLE_SELF_INTEGRITY_CHECK) {
                            throw new IOException("Current JAR is not verified");
                        }

                        var latch = new CountDownLatch(1);
                        Platform.runLater(() -> {
                            try {
                                SettingsManager.savePendingChanges();
                            } finally {
                                latch.countDown();
                            }
                        });

                        try {
                            latch.await();
                        } catch (InterruptedException ignored) {
                            // Ignore
                        }

                        try {

View on GitHub (pinned to 24702dc5a0)