feat: 新增 StarlightSkin 客户端 Mod，让正版客户端显示皮肤站皮肤
- TextureUrlCheckerMixin: 放行 skin.starlight.cool 域名（必需） - YggdrasilMinecraftSessionServiceMixin: 用皮肤站公钥验签，INVALID 改 SIGNED - GameProfileSignatureTrust: 内置公钥 + 运行时从皮肤站拉取兜底 - Minecraft 26.1.2 / Fabric / Java 25
This commit is contained in:
AxTps authored and Ap_Tx committed
commit
0c34fd8806
16 files changed
+840
No files matched your search
@@ -0,0 +1,7 @@
|
||||
.gradle/
|
||||
build/
|
||||
out/
|
||||
run/
|
||||
*.iml
|
||||
.idea/
|
||||
.vscode/
|
||||
@@ -0,0 +1,53 @@
|
||||
# StarlightSkin
|
||||
|
||||
让装了 `authlib-injector`（指向 StarLight 皮肤站）的 Minecraft 客户端能正常显示皮肤站的皮肤。
|
||||
|
||||
- Minecraft 26.1.2 / Fabric
|
||||
- 纯客户端 Mod
|
||||
|
||||
## 原理
|
||||
|
||||
Minecraft 客户端对皮肤 URL 有**硬编码的域名白名单**：
|
||||
|
||||
```java
|
||||
// com.mojang.authlib.yggdrasil.TextureUrlChecker
|
||||
private static final Set<String> ALLOWED_DOMAINS = Set.of("textures.minecraft.net");
|
||||
```
|
||||
|
||||
皮肤站下发的皮肤 URL（`https://skin.starlight.cool/yggdrasil/textures/...`）域名不在白名单里，
|
||||
`isAllowedTextureDomain` 返回 `false`，`unpackTextures` 直接丢弃该皮肤并打印：
|
||||
|
||||
```
|
||||
Textures payload url is invalid: https://skin.starlight.cool/yggdrasil/textures/xxx
|
||||
```
|
||||
|
||||
结果就是所有皮肤站玩家的皮肤都显示成默认皮肤。
|
||||
|
||||
本 Mod 通过两个 Mixin 解决：
|
||||
|
||||
1. **`TextureUrlCheckerMixin`**（必需）
|
||||
注入 `TextureUrlChecker.isAllowedTextureDomain`，在默认判定为 `false` 时，
|
||||
额外放行 `skin.starlight.cool` 域名。
|
||||
|
||||
2. **`YggdrasilMinecraftSessionServiceMixin`**
|
||||
皮肤站用自己私钥对 `textures` 属性签名，客户端默认不信任该公钥（`SignatureState.INVALID`）。
|
||||
本 Mixin 在验签失败时，用皮肤站公钥（内置 / 运行时拉取）重新验签，通过则改为 `SIGNED`。
|
||||
|
||||
## 公钥
|
||||
|
||||
- 内置兜底公钥（来自皮肤站 `https://skin.starlight.cool/yggdrasil` 的 `signaturePublickey`）
|
||||
- 启动时优先从皮肤站拉取，失败则用内置
|
||||
|
||||
## 构建
|
||||
|
||||
```bash
|
||||
# 需要 Java 25
|
||||
./gradlew build
|
||||
```
|
||||
|
||||
产物：`build/libs/starlight-skin-<version>.jar`，放入 `.minecraft/mods/`。
|
||||
|
||||
## 已知约束
|
||||
|
||||
- 皮肤站域名硬编码为 `skin.starlight.cool`（见 `StarlightConstants`）。
|
||||
若换域名，需改 `StarlightConstants.ALLOWED_SKIN_DOMAINS` 并重新构建。
|
||||
@@ -0,0 +1,54 @@
|
||||
plugins {
|
||||
id 'net.fabricmc.fabric-loom' version "${loom_version}"
|
||||
id 'maven-publish'
|
||||
}
|
||||
|
||||
version = project.mod_version
|
||||
group = project.maven_group
|
||||
|
||||
base {
|
||||
archivesName = project.archives_base_name
|
||||
}
|
||||
|
||||
repositories {
|
||||
mavenCentral()
|
||||
maven {
|
||||
name = 'Fabric'
|
||||
url = 'https://maven.fabricmc.net/'
|
||||
}
|
||||
}
|
||||
|
||||
loom {
|
||||
splitEnvironmentSourceSets()
|
||||
mods {
|
||||
"starlight_skin" {
|
||||
sourceSet sourceSets.main
|
||||
sourceSet sourceSets.client
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dependencies {
|
||||
minecraft "com.mojang:minecraft:${project.minecraft_version}"
|
||||
implementation "net.fabricmc:fabric-loader:${project.loader_version}"
|
||||
implementation "net.fabricmc.fabric-api:fabric-api:${project.fabric_api_version}"
|
||||
|
||||
clientImplementation "net.fabricmc.fabric-api:fabric-api:${project.fabric_api_version}"
|
||||
}
|
||||
|
||||
processResources {
|
||||
inputs.property "version", project.version
|
||||
filesMatching("fabric.mod.json") {
|
||||
expand "version": project.version
|
||||
}
|
||||
}
|
||||
|
||||
tasks.withType(JavaCompile).configureEach {
|
||||
it.options.release = 25
|
||||
}
|
||||
|
||||
java {
|
||||
withSourcesJar()
|
||||
sourceCompatibility = JavaVersion.VERSION_25
|
||||
targetCompatibility = JavaVersion.VERSION_25
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
# Gradle 内存
|
||||
org.gradle.jvmargs=-Xmx2G
|
||||
org.gradle.parallel=true
|
||||
|
||||
# Fabric Properties（26.1.2 同 CarpetSLSAddition/turtle-reproduce）
|
||||
minecraft_version=26.1.2
|
||||
loader_version=0.19.5
|
||||
loom_version=1.18-SNAPSHOT
|
||||
fabric_api_version=0.155.3+26.1.2
|
||||
|
||||
# Mod Properties
|
||||
mod_version=1.0.0
|
||||
maven_group=cn.disy920
|
||||
archives_base_name=starlight-skin
|
||||
Vendored
BIN
Binary file not shown.
+9
@@ -0,0 +1,9 @@
|
||||
distributionBase=GRADLE_USER_HOME
|
||||
distributionPath=wrapper/dists
|
||||
distributionUrl=https\://services.gradle.org/distributions/gradle-9.7.1-bin.zip
|
||||
networkTimeout=10000
|
||||
retries=0
|
||||
retryBackOffMs=500
|
||||
validateDistributionUrl=true
|
||||
zipStoreBase=GRADLE_USER_HOME
|
||||
zipStorePath=wrapper/dists
|
||||
@@ -0,0 +1,248 @@
|
||||
#!/bin/sh
|
||||
|
||||
#
|
||||
# Copyright © 2015 the original authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# https://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
#
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
#
|
||||
|
||||
##############################################################################
|
||||
#
|
||||
# gradlew start up script for POSIX generated by Gradle.
|
||||
#
|
||||
# Important for running:
|
||||
#
|
||||
# (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
|
||||
# noncompliant, but you have some other compliant shell such as ksh or
|
||||
# bash, then to run this script, type that shell name before the whole
|
||||
# command line, like:
|
||||
#
|
||||
# ksh gradlew
|
||||
#
|
||||
# Busybox and similar reduced shells will NOT work, because this script
|
||||
# requires all of these POSIX shell features:
|
||||
# * functions;
|
||||
# * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
|
||||
# «${var#prefix}», «${var%suffix}», and «$( cmd )»;
|
||||
# * compound commands having a testable exit status, especially «case»;
|
||||
# * various built-in commands including «command», «set», and «ulimit».
|
||||
#
|
||||
# Important for patching:
|
||||
#
|
||||
# (2) This script targets any POSIX shell, so it avoids extensions provided
|
||||
# by Bash, Ksh, etc; in particular arrays are avoided.
|
||||
#
|
||||
# The "traditional" practice of packing multiple parameters into a
|
||||
# space-separated string is a well documented source of bugs and security
|
||||
# problems, so this is (mostly) avoided, by progressively accumulating
|
||||
# options in "$@", and eventually passing that to Java.
|
||||
#
|
||||
# Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
|
||||
# and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
|
||||
# see the in-line comments for details.
|
||||
#
|
||||
# There are tweaks for specific operating systems such as AIX, CygWin,
|
||||
# Darwin, MinGW, and NonStop.
|
||||
#
|
||||
# (3) This script is generated from the Groovy template
|
||||
# https://github.com/gradle/gradle/blob/3d91ce3b8caaf77ad09f381f43615b715b53f72c/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
|
||||
# within the Gradle project.
|
||||
#
|
||||
# You can find Gradle at https://github.com/gradle/gradle/.
|
||||
#
|
||||
##############################################################################
|
||||
|
||||
# Attempt to set APP_HOME
|
||||
|
||||
# Resolve links: $0 may be a link
|
||||
app_path=$0
|
||||
|
||||
# Need this for daisy-chained symlinks.
|
||||
while
|
||||
APP_HOME=${app_path%"${app_path##*/}"} # leaves a trailing /; empty if no leading path
|
||||
[ -h "$app_path" ]
|
||||
do
|
||||
ls=$( ls -ld "$app_path" )
|
||||
link=${ls#*' -> '}
|
||||
case $link in #(
|
||||
/*) app_path=$link ;; #(
|
||||
*) app_path=$APP_HOME$link ;;
|
||||
esac
|
||||
done
|
||||
|
||||
# This is normally unused
|
||||
# shellcheck disable=SC2034
|
||||
APP_BASE_NAME=${0##*/}
|
||||
# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
|
||||
APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
|
||||
|
||||
# Use the maximum available, or set MAX_FD != -1 to use that value.
|
||||
MAX_FD=maximum
|
||||
|
||||
warn () {
|
||||
echo "$*"
|
||||
} >&2
|
||||
|
||||
die () {
|
||||
echo
|
||||
echo "$*"
|
||||
echo
|
||||
exit 1
|
||||
} >&2
|
||||
|
||||
# OS specific support (must be 'true' or 'false').
|
||||
cygwin=false
|
||||
msys=false
|
||||
darwin=false
|
||||
nonstop=false
|
||||
case "$( uname )" in #(
|
||||
CYGWIN* ) cygwin=true ;; #(
|
||||
Darwin* ) darwin=true ;; #(
|
||||
MSYS* | MINGW* ) msys=true ;; #(
|
||||
NONSTOP* ) nonstop=true ;;
|
||||
esac
|
||||
|
||||
|
||||
|
||||
# Determine the Java command to use to start the JVM.
|
||||
if [ -n "$JAVA_HOME" ] ; then
|
||||
if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
|
||||
# IBM's JDK on AIX uses strange locations for the executables
|
||||
JAVACMD=$JAVA_HOME/jre/sh/java
|
||||
else
|
||||
JAVACMD=$JAVA_HOME/bin/java
|
||||
fi
|
||||
if [ ! -x "$JAVACMD" ] ; then
|
||||
die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
|
||||
|
||||
Please set the JAVA_HOME variable in your environment to match the
|
||||
location of your Java installation."
|
||||
fi
|
||||
else
|
||||
JAVACMD=java
|
||||
if ! command -v java >/dev/null 2>&1
|
||||
then
|
||||
die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
|
||||
|
||||
Please set the JAVA_HOME variable in your environment to match the
|
||||
location of your Java installation."
|
||||
fi
|
||||
fi
|
||||
|
||||
# Increase the maximum file descriptors if we can.
|
||||
if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
|
||||
case $MAX_FD in #(
|
||||
max*)
|
||||
# In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
|
||||
# shellcheck disable=SC2039,SC3045
|
||||
MAX_FD=$( ulimit -H -n ) ||
|
||||
warn "Could not query maximum file descriptor limit"
|
||||
esac
|
||||
case $MAX_FD in #(
|
||||
'' | soft) :;; #(
|
||||
*)
|
||||
# In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
|
||||
# shellcheck disable=SC2039,SC3045
|
||||
ulimit -n "$MAX_FD" ||
|
||||
warn "Could not set maximum file descriptor limit to $MAX_FD"
|
||||
esac
|
||||
fi
|
||||
|
||||
# Collect all arguments for the java command, stacking in reverse order:
|
||||
# * args from the command line
|
||||
# * the main class name
|
||||
# * -classpath
|
||||
# * -D...appname settings
|
||||
# * --module-path (only if needed)
|
||||
# * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
|
||||
|
||||
# For Cygwin or MSYS, switch paths to Windows format before running java
|
||||
if "$cygwin" || "$msys" ; then
|
||||
APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
|
||||
|
||||
JAVACMD=$( cygpath --unix "$JAVACMD" )
|
||||
|
||||
# Now convert the arguments - kludge to limit ourselves to /bin/sh
|
||||
for arg do
|
||||
if
|
||||
case $arg in #(
|
||||
-*) false ;; # don't mess with options #(
|
||||
/?*) t=${arg#/} t=/${t%%/*} # looks like a POSIX filepath
|
||||
[ -e "$t" ] ;; #(
|
||||
*) false ;;
|
||||
esac
|
||||
then
|
||||
arg=$( cygpath --path --ignore --mixed "$arg" )
|
||||
fi
|
||||
# Roll the args list around exactly as many times as the number of
|
||||
# args, so each arg winds up back in the position where it started, but
|
||||
# possibly modified.
|
||||
#
|
||||
# NB: a `for` loop captures its iteration list before it begins, so
|
||||
# changing the positional parameters here affects neither the number of
|
||||
# iterations, nor the values presented in `arg`.
|
||||
shift # remove old arg
|
||||
set -- "$@" "$arg" # push replacement arg
|
||||
done
|
||||
fi
|
||||
|
||||
|
||||
# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
|
||||
DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
|
||||
|
||||
# Collect all arguments for the java command:
|
||||
# * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
|
||||
# and any embedded shellness will be escaped.
|
||||
# * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
|
||||
# treated as '${Hostname}' itself on the command line.
|
||||
|
||||
set -- \
|
||||
"-Dorg.gradle.appname=$APP_BASE_NAME" \
|
||||
-jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
|
||||
"$@"
|
||||
|
||||
# Stop when "xargs" is not available.
|
||||
if ! command -v xargs >/dev/null 2>&1
|
||||
then
|
||||
die "xargs is not available"
|
||||
fi
|
||||
|
||||
# Use "xargs" to parse quoted args.
|
||||
#
|
||||
# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
|
||||
#
|
||||
# In Bash we could simply go:
|
||||
#
|
||||
# readarray ARGS < <( xargs -n1 <<<"$var" ) &&
|
||||
# set -- "${ARGS[@]}" "$@"
|
||||
#
|
||||
# but POSIX shell has neither arrays nor command substitution, so instead we
|
||||
# post-process each arg (as a line of input to sed) to backslash-escape any
|
||||
# character that might be a shell metacharacter, then use eval to reverse
|
||||
# that process (while maintaining the separation between arguments), and wrap
|
||||
# the whole thing up as a single "set" statement.
|
||||
#
|
||||
# This will of course break if any of these variables contains a newline or
|
||||
# an unmatched quote.
|
||||
#
|
||||
|
||||
eval "set -- $(
|
||||
printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
|
||||
xargs -n1 |
|
||||
sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
|
||||
tr '\n' ' '
|
||||
)" '"$@"'
|
||||
|
||||
exec "$JAVACMD" "$@"
|
||||
Vendored
+82
@@ -0,0 +1,82 @@
|
||||
@rem
|
||||
@rem Copyright 2015 the original author or authors.
|
||||
@rem
|
||||
@rem Licensed under the Apache License, Version 2.0 (the "License");
|
||||
@rem you may not use this file except in compliance with the License.
|
||||
@rem You may obtain a copy of the License at
|
||||
@rem
|
||||
@rem https://www.apache.org/licenses/LICENSE-2.0
|
||||
@rem
|
||||
@rem Unless required by applicable law or agreed to in writing, software
|
||||
@rem distributed under the License is distributed on an "AS IS" BASIS,
|
||||
@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
@rem See the License for the specific language governing permissions and
|
||||
@rem limitations under the License.
|
||||
@rem
|
||||
@rem SPDX-License-Identifier: Apache-2.0
|
||||
@rem
|
||||
|
||||
@if "%DEBUG%"=="" @echo off
|
||||
@rem ##########################################################################
|
||||
@rem
|
||||
@rem gradlew startup script for Windows
|
||||
@rem
|
||||
@rem ##########################################################################
|
||||
|
||||
@rem Set local scope for the variables, and ensure extensions are enabled
|
||||
setlocal EnableExtensions
|
||||
|
||||
set DIRNAME=%~dp0
|
||||
if "%DIRNAME%"=="" set DIRNAME=.
|
||||
@rem This is normally unused
|
||||
set APP_BASE_NAME=%~n0
|
||||
set APP_HOME=%DIRNAME%
|
||||
|
||||
@rem Resolve any "." and ".." in APP_HOME to make it shorter.
|
||||
for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
|
||||
|
||||
@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
|
||||
set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
|
||||
|
||||
@rem Find java.exe
|
||||
if defined JAVA_HOME goto findJavaFromJavaHome
|
||||
|
||||
set JAVA_EXE=java.exe
|
||||
%JAVA_EXE% -version >NUL 2>&1
|
||||
if %ERRORLEVEL% equ 0 goto execute
|
||||
|
||||
echo. 1>&2
|
||||
echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
|
||||
echo. 1>&2
|
||||
echo Please set the JAVA_HOME variable in your environment to match the 1>&2
|
||||
echo location of your Java installation. 1>&2
|
||||
|
||||
"%COMSPEC%" /c exit 1
|
||||
|
||||
:findJavaFromJavaHome
|
||||
set JAVA_HOME=%JAVA_HOME:"=%
|
||||
set JAVA_EXE=%JAVA_HOME%/bin/java.exe
|
||||
|
||||
if exist "%JAVA_EXE%" goto execute
|
||||
|
||||
echo. 1>&2
|
||||
echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
|
||||
echo. 1>&2
|
||||
echo Please set the JAVA_HOME variable in your environment to match the 1>&2
|
||||
echo location of your Java installation. 1>&2
|
||||
|
||||
"%COMSPEC%" /c exit 1
|
||||
|
||||
:execute
|
||||
@rem Setup the command line
|
||||
|
||||
|
||||
|
||||
@rem Execute gradlew
|
||||
@rem endlocal doesn't take effect until after the line is parsed and variables are expanded
|
||||
@rem which allows us to clear the local environment before executing the java command
|
||||
endlocal & "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %* & call :exitWithErrorLevel
|
||||
|
||||
:exitWithErrorLevel
|
||||
@rem Use "%COMSPEC%" /c exit to allow operators to work properly in scripts
|
||||
"%COMSPEC%" /c exit %ERRORLEVEL%
|
||||
@@ -0,0 +1,16 @@
|
||||
pluginManagement {
|
||||
repositories {
|
||||
maven {
|
||||
name = 'Fabric'
|
||||
url = 'https://maven.fabricmc.net/'
|
||||
}
|
||||
mavenCentral()
|
||||
gradlePluginPortal()
|
||||
}
|
||||
|
||||
plugins {
|
||||
id 'net.fabricmc.fabric-loom' version providers.gradleProperty("loom_version").get()
|
||||
}
|
||||
}
|
||||
|
||||
rootProject.name = 'StarlightSkin'
|
||||
@@ -0,0 +1,181 @@
|
||||
package cn.disy920.starlightskin;
|
||||
|
||||
import com.mojang.authlib.properties.Property;
|
||||
import com.mojang.authlib.yggdrasil.ServicesKeyInfo;
|
||||
import com.mojang.authlib.yggdrasil.YggdrasilServicesKeyInfo;
|
||||
import org.slf4j.Logger;
|
||||
import org.slf4j.LoggerFactory;
|
||||
|
||||
import java.io.InputStream;
|
||||
import java.net.HttpURLConnection;
|
||||
import java.net.URI;
|
||||
import java.nio.charset.StandardCharsets;
|
||||
import java.util.Base64;
|
||||
import java.util.concurrent.atomic.AtomicReference;
|
||||
import java.util.regex.Matcher;
|
||||
import java.util.regex.Pattern;
|
||||
|
||||
/**
|
||||
* 持有 StarLight 皮肤站的 profile 签名公钥，并用它对玩家的 textures 属性验签。
|
||||
*
|
||||
* 逻辑：Minecraft 客户端默认只信任 Mojang 的 ServicesKeySet。皮肤站用自己的私钥对
|
||||
* textures 属性签名，客户端验不过 → SignatureState.INVALID → 皮肤被丢弃。
|
||||
* 这里把皮肤站公钥也纳入信任，验签通过即认为 SIGNED。
|
||||
*/
|
||||
public final class GameProfileSignatureTrust {
|
||||
private static final Logger LOGGER = LoggerFactory.getLogger("StarlightSkin");
|
||||
|
||||
/**
|
||||
* 内置兜底公钥（来自皮肤站 /yggdrasil 的 signaturePublickey）。
|
||||
* 与客户端 authlib-injector 的 prefetched 数据一致，离线也能用。
|
||||
*/
|
||||
private static final String BUILTIN_PUBLIC_KEY =
|
||||
"-----BEGIN PUBLIC KEY-----\n" +
|
||||
"MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsFNdNxlaTYk/mu2D8ZWmAYNOAc9Qz4V6\n" +
|
||||
"1ZzkwqCELxmKJ1gtCCK5mN8ZXFOhBmnZj1wtENllqwyvOwr09Oa5HUCAv/HqvL7mSexl+ZixLicc\n" +
|
||||
"25+YgsxgL0SUqPdWb0IPyIQapPwgdmXfiPyaAadOGbHIxoFyKMIR/yYWAC8ksCpxySFv+5VuUM4p\n" +
|
||||
"K2Jxjz9n/lCs8c7gTFrk+FjxJPGGXFuKLeouBAbAEDisxT+BSE1pEy+eTABMBBLWX2MFkrMNMS5p\n" +
|
||||
"iUDHHw8pdLRc4RCVH9dyiMClfF8dV0Duc7A1EtImllR/DF4GyYMGt8rHnofJGcBmvkVacN4upK4w\n" +
|
||||
"JkHyY2FEIelZlcEwwLOWX8rb8WhOowZ48VfiqxdJLPEF7etEKU1fKFe4JtnBXRQhwHCu8qvuIzcl\n" +
|
||||
"9MRWEC6QLOL5B2ZJL0f2fA0rFnQY3ds1P/nFsSTwU6j/TpipVm/zhB8kNCunG7KAUm1OGRcgbV4c\n" +
|
||||
"yjhfaXxObLhD/O5Z0QF2j5IAbYOxuo54Oq7wt7S352nsStX11JsOp2KmC2iTh/T2SFHaXzLpjEOy\n" +
|
||||
"kd7+FfaStt0s7fTctEDddL+fE0Qxg9ABFE0wq5iCiGXwZKqC9rfGFzYbvoFoc7KQMR6CrojCo0Kj\n" +
|
||||
"pE5HAOJ2nzVEZL85Stz8O4ACupYwVaSmBPC8ONz+cPsCAwEAAQ==\n" +
|
||||
"-----END PUBLIC KEY-----\n";
|
||||
|
||||
private static final Pattern PUBKEY_PATTERN =
|
||||
Pattern.compile("\"signaturePublickey\"\\s*:\\s*\"((?:\\\\.|[^\"\\\\])*)\"");
|
||||
|
||||
private static final AtomicReference<ServicesKeyInfo> KEY_INFO = new AtomicReference<>();
|
||||
private static volatile boolean initialized = false;
|
||||
|
||||
private GameProfileSignatureTrust() {
|
||||
}
|
||||
|
||||
/** 初始化：先尝试拉取皮肤站公钥，失败则用内置公钥。幂等。 */
|
||||
public static synchronized void init() {
|
||||
if (initialized) {
|
||||
return;
|
||||
}
|
||||
initialized = true;
|
||||
|
||||
ServicesKeyInfo info = null;
|
||||
|
||||
String fetched = fetchPublicKey();
|
||||
if (fetched != null) {
|
||||
info = parseKey(fetched);
|
||||
if (info != null) {
|
||||
LOGGER.info("[StarlightSkin] 已从皮肤站获取签名公钥");
|
||||
}
|
||||
}
|
||||
|
||||
if (info == null) {
|
||||
info = parseKey(BUILTIN_PUBLIC_KEY);
|
||||
if (info != null) {
|
||||
LOGGER.info("[StarlightSkin] 使用内置签名公钥");
|
||||
}
|
||||
}
|
||||
|
||||
if (info == null) {
|
||||
LOGGER.error("[StarlightSkin] 无法初始化皮肤站公钥，皮肤签名信任将不可用");
|
||||
} else {
|
||||
KEY_INFO.set(info);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* 用皮肤站公钥验证 textures 属性签名。
|
||||
*
|
||||
* @param property 待验证的属性
|
||||
* @return 验签通过返回 true
|
||||
*/
|
||||
public static boolean validates(Property property) {
|
||||
if (property == null || !property.hasSignature()) {
|
||||
return false;
|
||||
}
|
||||
ServicesKeyInfo info = KEY_INFO.get();
|
||||
if (info == null) {
|
||||
return false;
|
||||
}
|
||||
try {
|
||||
return info.validateProperty(property);
|
||||
} catch (Throwable t) {
|
||||
LOGGER.warn("[StarlightSkin] 验签异常", t);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/** 从皮肤站拉取 signaturePublickey 字符串；失败返回 null。 */
|
||||
private static String fetchPublicKey() {
|
||||
HttpURLConnection conn = null;
|
||||
try {
|
||||
conn = (HttpURLConnection) URI.create(StarlightConstants.YGGDRASIL_URL).toURL().openConnection();
|
||||
conn.setRequestMethod("GET");
|
||||
conn.setRequestProperty("Accept", "application/json");
|
||||
conn.setConnectTimeout(5000);
|
||||
conn.setReadTimeout(5000);
|
||||
|
||||
if (conn.getResponseCode() != 200) {
|
||||
LOGGER.warn("[StarlightSkin] 拉取公钥失败，HTTP {}", conn.getResponseCode());
|
||||
return null;
|
||||
}
|
||||
|
||||
String body;
|
||||
try (InputStream in = conn.getInputStream()) {
|
||||
body = new String(in.readAllBytes(), StandardCharsets.UTF_8);
|
||||
}
|
||||
|
||||
Matcher m = PUBKEY_PATTERN.matcher(body);
|
||||
if (!m.find()) {
|
||||
LOGGER.warn("[StarlightSkin] 响应中未找到 signaturePublickey");
|
||||
return null;
|
||||
}
|
||||
// 解 JSON 字符串转义（\n -> 换行）
|
||||
return unescapeJsonString(m.group(1));
|
||||
} catch (Throwable t) {
|
||||
LOGGER.warn("[StarlightSkin] 拉取公钥异常，将使用内置公钥", t);
|
||||
return null;
|
||||
} finally {
|
||||
if (conn != null) {
|
||||
conn.disconnect();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/** 将 PEM 文本解析为 ServicesKeyInfo。 */
|
||||
private static ServicesKeyInfo parseKey(String pem) {
|
||||
try {
|
||||
String base64 = pem
|
||||
.replace("-----BEGIN PUBLIC KEY-----", "")
|
||||
.replace("-----END PUBLIC KEY-----", "")
|
||||
.replaceAll("\\s", "");
|
||||
byte[] der = Base64.getDecoder().decode(base64);
|
||||
return YggdrasilServicesKeyInfo.parse(der);
|
||||
} catch (Throwable t) {
|
||||
LOGGER.error("[StarlightSkin] 公钥解析失败", t);
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
private static String unescapeJsonString(String s) {
|
||||
StringBuilder sb = new StringBuilder(s.length());
|
||||
for (int i = 0; i < s.length(); i++) {
|
||||
char c = s.charAt(i);
|
||||
if (c == '\\' && i + 1 < s.length()) {
|
||||
char n = s.charAt(++i);
|
||||
switch (n) {
|
||||
case 'n' -> sb.append('\n');
|
||||
case 'r' -> sb.append('\r');
|
||||
case 't' -> sb.append('\t');
|
||||
case '"' -> sb.append('"');
|
||||
case '\\' -> sb.append('\\');
|
||||
case '/' -> sb.append('/');
|
||||
default -> sb.append(n);
|
||||
}
|
||||
} else {
|
||||
sb.append(c);
|
||||
}
|
||||
}
|
||||
return sb.toString();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,50 @@
|
||||
package cn.disy920.starlightskin;
|
||||
|
||||
import java.net.URI;
|
||||
import java.util.Locale;
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* StarLight 皮肤站相关常量与工具方法。
|
||||
*
|
||||
* <p>独立于 Mixin 类，避免字段被合并进目标类造成污染。
|
||||
*/
|
||||
public final class StarlightConstants {
|
||||
|
||||
/** 皮肤站 yggdrasil 元数据地址。 */
|
||||
public static final String YGGDRASIL_URL = "https://skin.starlight.cool/yggdrasil";
|
||||
|
||||
/** 额外允许的皮肤 URL 域名（与皮肤站 skinDomains 对应）。 */
|
||||
public static final Set<String> ALLOWED_SKIN_DOMAINS = Set.of(
|
||||
"skin.starlight.cool"
|
||||
);
|
||||
|
||||
private StarlightConstants() {
|
||||
}
|
||||
|
||||
/**
|
||||
* 判断给定皮肤 URL 是否属于本模组放行的域名。
|
||||
*
|
||||
* @param url 皮肤 URL
|
||||
* @return 属于放行域名返回 true
|
||||
*/
|
||||
public static boolean isAllowedSkinUrl(String url) {
|
||||
if (url == null) {
|
||||
return false;
|
||||
}
|
||||
try {
|
||||
URI uri = new URI(url).normalize();
|
||||
String scheme = uri.getScheme();
|
||||
if (scheme == null || !(scheme.equals("http") || scheme.equals("https"))) {
|
||||
return false;
|
||||
}
|
||||
String host = uri.getHost();
|
||||
if (host == null) {
|
||||
return false;
|
||||
}
|
||||
return ALLOWED_SKIN_DOMAINS.contains(host.toLowerCase(Locale.ROOT));
|
||||
} catch (Throwable t) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
package cn.disy920.starlightskin;
|
||||
|
||||
import net.fabricmc.api.ClientModInitializer;
|
||||
|
||||
public class StarlightSkinClient implements ClientModInitializer {
|
||||
|
||||
@Override
|
||||
public void onInitializeClient() {
|
||||
// 异步初始化公钥，避免阻塞游戏启动。
|
||||
Thread t = new Thread(GameProfileSignatureTrust::init, "StarlightSkin-KeyInit");
|
||||
t.setDaemon(true);
|
||||
t.start();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
package cn.disy920.starlightskin.mixin;
|
||||
|
||||
import cn.disy920.starlightskin.StarlightConstants;
|
||||
import com.mojang.authlib.yggdrasil.TextureUrlChecker;
|
||||
import org.spongepowered.asm.mixin.Mixin;
|
||||
import org.spongepowered.asm.mixin.injection.At;
|
||||
import org.spongepowered.asm.mixin.injection.Inject;
|
||||
import org.spongepowered.asm.mixin.injection.callback.CallbackInfoReturnable;
|
||||
|
||||
/**
|
||||
* Minecraft 客户端硬编码只允许 {@code textures.minecraft.net} 作为皮肤 URL 域名
|
||||
* （见 {@link TextureUrlChecker} 的静态 ALLOWED_DOMAINS）。
|
||||
* 这里在默认判定为不允许时，额外放行 StarLight 皮肤站域名，
|
||||
* 使皮肤站下发的皮肤 URL 能通过校验。
|
||||
*
|
||||
* <p>注意：Mixin 类的字段会被合并进目标类，故域名常量放在 {@link StarlightConstants}，
|
||||
* 避免污染 {@code TextureUrlChecker}。
|
||||
*/
|
||||
@Mixin(value = TextureUrlChecker.class, remap = false)
|
||||
public abstract class TextureUrlCheckerMixin {
|
||||
|
||||
@Inject(
|
||||
method = "isAllowedTextureDomain",
|
||||
at = @At("RETURN"),
|
||||
cancellable = true,
|
||||
remap = false
|
||||
)
|
||||
private static void starlight_skin$allowStarlightDomains(
|
||||
String url,
|
||||
CallbackInfoReturnable<Boolean> cir
|
||||
) {
|
||||
if (Boolean.TRUE.equals(cir.getReturnValue())) {
|
||||
return;
|
||||
}
|
||||
if (StarlightConstants.isAllowedSkinUrl(url)) {
|
||||
cir.setReturnValue(true);
|
||||
}
|
||||
}
|
||||
}
|
||||
+34
@@ -0,0 +1,34 @@
|
||||
package cn.disy920.starlightskin.mixin;
|
||||
|
||||
import cn.disy920.starlightskin.GameProfileSignatureTrust;
|
||||
import com.mojang.authlib.SignatureState;
|
||||
import com.mojang.authlib.properties.Property;
|
||||
import com.mojang.authlib.yggdrasil.YggdrasilMinecraftSessionService;
|
||||
import org.spongepowered.asm.mixin.Mixin;
|
||||
import org.spongepowered.asm.mixin.injection.At;
|
||||
import org.spongepowered.asm.mixin.injection.Inject;
|
||||
import org.spongepowered.asm.mixin.injection.callback.CallbackInfoReturnable;
|
||||
|
||||
/**
|
||||
* 拦截 {@link YggdrasilMinecraftSessionService#getPropertySignatureState(Property)}，
|
||||
* 当默认验签结果为 INVALID 时，尝试用皮肤站公钥重新验签；通过则改为 SIGNED。
|
||||
*/
|
||||
@Mixin(value = YggdrasilMinecraftSessionService.class, remap = false)
|
||||
public abstract class YggdrasilMinecraftSessionServiceMixin {
|
||||
|
||||
@Inject(
|
||||
method = "getPropertySignatureState",
|
||||
at = @At("RETURN"),
|
||||
cancellable = true,
|
||||
remap = false
|
||||
)
|
||||
private void starlight_skin$trustStarlightKey(
|
||||
Property property,
|
||||
CallbackInfoReturnable<SignatureState> cir
|
||||
) {
|
||||
if (cir.getReturnValue() == SignatureState.INVALID
|
||||
&& GameProfileSignatureTrust.validates(property)) {
|
||||
cir.setReturnValue(SignatureState.SIGNED);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"id": "starlight_skin",
|
||||
"version": "${version}",
|
||||
"name": "Starlight Skin",
|
||||
"description": "让 Minecraft 客户端信任 StarLight 皮肤站的 profile 签名公钥，从而正常显示皮肤站皮肤。",
|
||||
"authors": [
|
||||
"AxTps"
|
||||
],
|
||||
"license": "MIT",
|
||||
"environment": "client",
|
||||
"entrypoints": {
|
||||
"client": [
|
||||
"cn.disy920.starlightskin.StarlightSkinClient"
|
||||
]
|
||||
},
|
||||
"mixins": [
|
||||
"starlight_skin.mixins.json"
|
||||
],
|
||||
"depends": {
|
||||
"fabricloader": ">=0.19.5",
|
||||
"minecraft": "~26.1.2",
|
||||
"java": ">=25",
|
||||
"fabric-api": "*"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
{
|
||||
"required": true,
|
||||
"minVersion": "0.8",
|
||||
"package": "cn.disy920.starlightskin.mixin",
|
||||
"compatibilityLevel": "JAVA_25",
|
||||
"mixins": [
|
||||
"YggdrasilMinecraftSessionServiceMixin",
|
||||
"TextureUrlCheckerMixin"
|
||||
],
|
||||
"injectors": {
|
||||
"defaultRequire": 1
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user