Support for SHA-256/SHA-512 hash algorithms in Server Modpack

HMCL Server Modpack Hash Algorithm Support Issue

Summary

HMCL's server modpack implementation currently only supports SHA-1 hash algorithm for file integrity verification. This creates compatibility issues with modern modpack formats (such as Packwiz) that use more secure hash algorithms like SHA-256 and SHA-512.

Problem Description

Current Implementation

In ServerModpackCompletionTask.java, HMCL hardcodes SHA-1 for file verification:

dependencies.add(new FileDownloadTask(
    remoteManifest.getFileApi() + "/overrides/" + file.getPath(),
    actualPath,
    new FileDownloadTask.IntegrityCheck("SHA-1", file.getHash()))
    .withCounter("hmcl.modpack.download"));

Issue

When using Packwiz to generate server manifests, the mod files use SHA-512 hashes (recommended for security):

[download]
url = "https://cdn.modrinth.com/data/gu7yAYhd/versions/Pi7pgf8B/cc-tweaked-1.21.1-fabric-1.116.2.jar"
hash-format = "sha512"
hash = "811704581cf5990c78b6e5f714806d8e8ee1786a3a4e4edf8aca81cea1c2a0099e899b58b9c36bf636d3f3758b1d9293fbe5bc2e6500bab6d15f23d1fc2473cf"

When HMCL downloads these files, it uses SHA-1 to verify against a SHA-512 hash, which always fails.

Security Considerations

SHA-1 has been deprecated for security purposes since 2011 due to collision vulnerabilities. Modern mod distribution platforms like Modrinth have moved to SHA-256/SHA-512.

Suggested Solutions

Option 1: Support Multiple Hash Algorithms (Recommended)

1. Modify FileInformation class to include hash algorithm information:

public static class FileInformation implements Validation {
    private final String path;
    private final String hash;
    private final String hashAlgorithm;  // NEW: "sha1", "sha256", "sha512", etc.
    private final String downloadURL;

    // Constructor and methods...
}

2. Update manifest format to support algorithm prefixes or explicit algorithm field:

{
  "files": [
    {
      "path": "mods/example.jar",
      "hash": "sha512:811704581cf5990c78b6e5f714806d8e8ee1786a3a4e4edf8aca81cea1c2a0099e899b58b9c36bf636d3f3758b1d9293fbe5bc2e6500bab6d15f23d1fc2473cf"
    }
  ]
}

3. Update ServerModpackCompletionTask to detect and use appropriate algorithm:

// Parse hash format if present
String algorithm = "SHA-1";  // default
String checksum = file.getHash();

if (checksum.contains(":")) {
    String[] parts = checksum.split(":", 2);
    algorithm = parts[0].toUpperCase();
    checksum = parts[1];
}

dependencies.add(new FileDownloadTask(
    remoteManifest.getFileApi() + "/overrides/" + file.getPath(),
    actualPath,
    new FileDownloadTask.IntegrityCheck(algorithm, checksum))
    .withCounter("hmcl.modpack.download"));

Option 2: Auto-calculate Missing Hash Format

1. Maintain backward compatibility by attempting multiple hash algorithms:
2. Add hash algorithm detection based on hash length:
   • 32 chars → MD5
   • 40 chars → SHA-1
   • 64 chars → SHA-256
   • 128 chars → SHA-512

Option 3: Migration Path

1. Phase 1: Support both prefixed and non-prefixed hashes
2. Phase 2: Deprecate non-prefixed hashes
3. Phase 3: Make hash algorithm mandatory

Benefits of Implementation

1. Security: Aligns with modern cryptographic standards
2. Compatibility: Works with Packwiz and other modern modpack tools
3. Future-proof: Easily add new hash algorithms as needed
4. Backward compatible: Existing SHA-1 manifests continue to work

Implementation Priority

1. High - Security improvement
2. High - Tool compatibility (Packwiz, Modrinth)
3. Medium - Future maintenance

Related Code Locations

• ServerModpackCompletionTask.java: Line with hardcoded "SHA-1"
• FileInformation.java: Hash field definition
• ModpackConfiguration.java: File validation logic
• DigestUtils.java: Hash calculation utilities

Testing Strategy

1. Create test modpacks with different hash formats
2. Verify backward compatibility with existing manifests
3. Test error handling for unsupported algorithms
4. Performance testing for large files with different algorithms

Would you like me to submit a pull request with the implementation?

Start with the hardcoded SHA-1 use in ServerModpackCompletionTask.java, then trace FileInformation.java, ModpackConfiguration.java, and DigestUtils.java to understand how hashes are represented and validated. Compare the proposed algorithm formats and use test modpacks to verify supported algorithms, backward compatibility, and handling of unsupported algorithms.