What gets downloaded¶
Xol downloads game files to your computer from their original publishers. Nothing is mirrored by Xol. Every file is checked against a checksum before it is used.
Sources¶
| What | From | How it is verified |
|---|---|---|
| Minecraft client, libraries, assets and the log configuration | Mojang's download servers, as listed in Mojang's version manifest (piston-meta.mojang.com) |
SHA-1 of every file, as published by Mojang |
Java runtime (jre-legacy, Java 8, for 1.8.9 and 1.7.10) |
Mojang's Java runtime manifest | SHA-1 of the manifest and of every file in it |
| On Apple Silicon Macs: a native Java 8 (Azul Zulu 8 Community JRE 8.0.504, macOS aarch64), 40,334,100 bytes | Azul's CDN (cdn.azul.com), one fixed address |
SHA-256 fixed inside the launcher, checked on download and again before unpacking |
| On Apple Silicon Macs: LWJGL 2.9.4-nightly-20150209, two class-path jars | libraries.minecraft.net |
SHA-1 fixed inside the launcher |
| On Apple Silicon Macs: the arm64 macOS natives for that LWJGL build, 488,316 bytes | One fixed address on github.com (a release of the MinecraftMachina/lwjgl repository), which GitHub redirects to its file host |
SHA-1 on download, then SHA-256 before every native start. A community build that Xol cannot rebuild; see Apple Silicon |
| Forge 11.15.1.2318 (1.8.9) and Forge 10.13.4.1614 (1.7.10) | maven.minecraftforge.net |
The installer is pinned by SHA-256. Xol reads it as data and extracts the Forge jar from it. The installer is never executed. |
| UniMixins, GTNHLib, Hodgepodge and ArchaicFix, for Xol 1.7.10 | Modrinth's CDN (cdn.modrinth.com) |
Exact version, size and SHA-256 pinned in the profile manifest, cross-checked with Modrinth's API when the manifest was built |
| The Xol client mod | Inside the launcher itself | SHA-256 of the bundled jar must match the manifest before it is copied into the instance |
| OptiFine | Not downloaded by Xol. You download it once from optifine.net, and Xol picks up the finished file and keeps a copy. |
File name, contents and version text, and the SHA-256 of the builds Xol knows. See OptiFine |
| Launcher updates | The Xol service (xol.dev) |
Ed25519-signed release record, then size and SHA-256. See Updates |
| Player heads for the account list | sessionserver.mojang.com for the skin address, then textures.minecraft.net for the skin |
Only those two hosts, over HTTPS. The skin must decode as a Minecraft skin image before it is kept. Refreshed at most once a day. |
Rules every download follows¶
- HTTPS only. A non-HTTPS address is refused.
- Component addresses in a profile manifest must be on a fixed list of hosts. A manifest that names any other host is rejected as a whole.
- Game libraries must come from a fixed list of hosts as well. There is one exception, allowed as an exact address and not as a host: the arm64 natives above.
- A file that does not match its checksum is discarded. The launcher says: "A downloaded file did not match its expected checksum, so it was discarded. Try again; if it keeps happening the download server is serving a bad file."
- Files are written to a temporary name and renamed into place, so an interrupted download never leaves a half-written file under the real name.
- Failed downloads are retried with increasing pauses before the launcher gives up.
- Archives are unpacked with checks against paths that would escape the target folder.
- Mojang's patched log4j configuration is always applied. This closes the Log4Shell hole in these old versions.
Sizes that are known¶
Exact sizes are published only for the pinned 1.7.10 components.
| Component | Version | Size | License |
|---|---|---|---|
| UniMixins | 0.3.1 | 5,519,796 bytes (about 5.3 MB) | LGPL-3.0-only |
| GTNHLib | 0.11.49 | 1,424,501 bytes (about 1.4 MB) | LGPL-3.0-only |
| Hodgepodge | 2.7.208 | 1,191,950 bytes (about 1.1 MB) | LGPL-3.0-only |
| ArchaicFix | 0.8.0 | 293,536 bytes (about 0.3 MB) | LGPL-3.0-only |
The size of the Minecraft files, the assets and the Java runtime depends on what Mojang serves, so it is not quoted here. The launcher shows the byte total while it downloads, and says "This can take a few minutes the first time."
Where the files go¶
Shared files (versions, libraries, assets, Java runtimes) are stored once in the Xol data folder and used by every instance. Worlds and mods are per instance. Resource packs come from your normal Minecraft folder unless you switch that off. The layout is on File locations.
Repair¶
Settings ▸ Instance ▸ Repair re-checks every file Xol installed and restores any that are missing or changed. Your own files are never touched. See Instances.