What gets downloaded¶
Xol downloads game files to your computer from their original publishers. Nothing is mirrored by Xol. Every file is checked against a checksum before it is used.
Sources¶
| What | From | How it is verified |
|---|---|---|
| Minecraft client, libraries, assets and the log configuration | Mojang's download servers, as listed in Mojang's version manifest (piston-meta.mojang.com) |
SHA-1 of every file, as published by Mojang |
Java runtime (jre-legacy, Java 8, for 1.8.9 and 1.7.10) |
Mojang's Java runtime manifest | SHA-1 of the manifest and of every file in it |
| Forge 11.15.1.2318 (1.8.9) and Forge 10.13.4.1614 (1.7.10) | maven.minecraftforge.net |
The installer is pinned by SHA-256. Xol reads it as data and extracts the Forge jar from it. The installer is never executed. |
launchwrapper 1.12, for the OptiFine profiles |
libraries.minecraft.net |
Pinned SHA-1 |
| UniMixins, GTNHLib, Hodgepodge and ArchaicFix, for the 1.7.10 profiles with performance mods | Modrinth's CDN (cdn.modrinth.com) |
Exact version, size and SHA-256 pinned in the profile manifest, cross-checked with Modrinth's API when the manifest was built |
| The Xol client mod | Inside the launcher itself | SHA-256 of the bundled jar must match the manifest before it is copied into the instance |
| OptiFine | Not downloaded by Xol. You download it from optifine.net and import the file. |
See OptiFine |
| Launcher updates | The Xol service (xol.dev) |
Ed25519-signed release record, then size and SHA-256. See Updates |
Rules every download follows¶
- HTTPS only. A non-HTTPS address is refused.
- Component addresses in a profile manifest must be on a fixed list of hosts. A manifest that names any other host is rejected as a whole.
- A file that does not match its checksum is discarded. The launcher says: "A downloaded file did not match its expected checksum, so it was discarded. Try again; if it keeps happening the download server is serving a bad file."
- Files are written to a temporary name and renamed into place, so an interrupted download never leaves a half-written file under the real name.
- Failed downloads are retried with increasing pauses before the launcher gives up.
- Archives are unpacked with checks against paths that would escape the target folder.
- Mojang's patched log4j configuration is always applied. This closes the Log4Shell hole in these old versions.
Sizes that are known¶
The source material gives exact sizes only for the pinned 1.7.10 components.
| Component | Version | Size | Licence |
|---|---|---|---|
| UniMixins | 0.3.1 | 5,519,796 bytes (about 5.3 MB) | LGPL-3.0-only |
| GTNHLib | 0.11.49 | 1,424,501 bytes (about 1.4 MB) | LGPL-3.0-only |
| Hodgepodge | 2.7.208 | 1,191,950 bytes (about 1.1 MB) | LGPL-3.0-only |
| ArchaicFix | 0.8.0 | 293,536 bytes (about 0.3 MB) | LGPL-3.0-only |
The size of the Minecraft files, the assets and the Java runtime depends on what Mojang serves and is not stated in Xol's own material, so it is not quoted here. The launcher shows the byte total while it downloads, and says "This can take a few minutes the first time."
Where the files go¶
Shared files (versions, libraries, assets, Java runtimes) are stored once in the Xol data folder and used by every instance. Mods, worlds and settings are per instance. The layout is on File locations.
Repair¶
Settings ▸ Instance ▸ Repair re-checks every file Xol installed and restores any that are missing or changed. Your own files are never touched. See Instances.