{"record":{"id":"6505b236960c6c48","repo":"HMCL-dev/HMCL","slug":"current-jar-is-not-verified","errorCode":null,"errorMessage":"Current JAR is not verified","messagePattern":"Current JAR is not verified","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"HMCL/src/main/java/org/jackhuang/hmcl/upgrade/UpdateHandler.java","lineNumber":128,"sourceCode":"            Path downloaded;\n            try {\n                downloaded = Files.createTempFile(\"hmcl-update-\", \".jar\");\n            } catch (IOException e) {\n                LOG.warning(\"Failed to create temp file\", e);\n                return;\n            }\n\n            Task<?> task = new HMCLDownloadTask(version, downloaded);\n\n            TaskExecutor executor = task.executor();\n            Controllers.taskDialog(executor, i18n(\"message.downloading\"), TaskCancellationAction.NORMAL);\n            thread(() -> {\n                boolean success = executor.test();\n\n                if (success) {\n                    try {\n                        if (!IntegrityChecker.isSelfVerified() && !IntegrityChecker.DISABLE_SELF_INTEGRITY_CHECK) {\n                            throw new IOException(\"Current JAR is not verified\");\n                        }\n\n                        var latch = new CountDownLatch(1);\n                        Platform.runLater(() -> {\n                            try {\n                                SettingsManager.savePendingChanges();\n                            } finally {\n                                latch.countDown();\n                            }\n                        });\n\n                        try {\n                            latch.await();\n                        } catch (InterruptedException ignored) {\n                            // Ignore\n                        }\n\n                        try {","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/HMCL-dev/HMCL/blob/24702dc5a0214034f4c27166d5fd30cad08cec19/HMCL/src/main/java/org/jackhuang/hmcl/upgrade/UpdateHandler.java#L110-L146","documentation":"HMCL verifies its own JAR integrity (via IntegrityChecker) before performing an in-place update. In updateFrom, after the update executor succeeds, if the currently running JAR has not passed self-verification and the check is not disabled, the update is aborted with this IOException so a tampered or corrupt build cannot overwrite the installed binary.","triggerScenarios":"Calling updateFrom with a successfully downloaded update while the running HMCL JAR fails IntegrityChecker.isSelfVerified() and the system property HMCL_DISABLE_SELF_INTEGRITY_CHECK (DISABLE_SELF_INTEGRITY_CHECK) is not set.","commonSituations":"Running a locally rebuilt HMCL JAR that was not signed/verified; a modified or corrupted JAR in the install directory; running from a build produced without the integrity-check step; someone patched the JAR manually.","solutions":["Re-download the official HMCL JAR from the official release and run that instead","If you build HMCL yourself, produce it via the official build so IntegrityChecker accepts it","For trusted dev environments only, set the self-integrity-check disable system property (HMCL_DISABLE_SELF_INTEGRITY_CHECK=true) when launching","Verify the JAR was not modified after download (checksum against release)"],"exampleFix":"// before: running a modified HMCL.jar\njava -jar HMCL-modified.jar\n// after: use official jar, or for trusted dev builds\njava -Dhmcl.self.integrity.check.disable=true -jar HMCL-dev.jar","handlingStrategy":"try-catch","validationCode":"if (!IntegrityChecker.isSelfVerified() && !IntegrityChecker.DISABLE_SELF_INTEGRITY_CHECK) {\n    LOG.warning(\"Skipping update: current JAR is not self-verified\");\n    return;\n}","typeGuard":null,"tryCatchPattern":"try {\n    updateHandler.updateFrom(executor);\n} catch (IOException e) {\n    if (e.getMessage().contains(\"not verified\")) {\n        LOG.warning(\"Self-integrity check failed; re-download the official HMCL JAR\", e);\n    }\n}","preventionTips":["Only distribute the official build artifact; local rebuilds fail self-verification","Do not modify or re-zip the HMCL JAR after download","Set HMCL_DISABLE_SELF_INTEGRITY_CHECK only in trusted dev environments","Verify checksum of the JAR at deployment time"],"tags":["integrity","update","security"],"backgroundTag":"checksum-mismatch","analyzedSha":"24702dc5a0214034f4c27166d5fd30cad08cec19","analyzedAt":"2026-09-10T12:36:46.680Z","contentChangedAt":"2026-09-10T12:36:46.680Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}