Changes between Initial Version and Version 1 of Mod_Verification_Process

Timestamp:

Dec 24, 2021, 4:07:02 PM (2 years ago)

Author:

Stan

Comment:

Initial version

Mod_Verification_Process

@@ +1 @@
+== Introduction ==
+
+This page aims to describe the verification process mods undergo before being made readily available on [https://0ad.mod.io/ mod.io]. Because we make those mods official by signing them, we have to ensure they are not broken, that they do not contain malicious code, whether they are indeed OOS compatible, and whether we are not needlessly stealing bandwith for big mods.
+
+== Steps ==
+
+=== Mod is downloaded ===
+
+In general this step should go well, since that's  [https://0ad.mod.io/ mod.io]'s responsibility.
+
+=== Mod is extracted ===
+
+==== Directory Structure ====
+
+We need to make sure that the mod as the correct directory structure. E.g. it should be as follows
+{{{
+└───sky_ships.zip
+    │   mod.json
+    │   readme.md
+    │
+    ├───art
+    │   ├───actors
+    │   │   └───structures
+    │   │           argestesion.xml
+    │   │
+    │   └───meshes
+    │       └───structural
+    │               argestesion.dae
+    │
+    └───simulation
+        └───templates
+            └───structures
+                    argestesion.xml
+
+}}}
+
+and not like this:
+{{{
+└───sky_ships.zip
+    └───sky_ships
+        │   mod.json
+        │   readme.md
+        │
+        ├───art
+        │   ├───actors
+        │   │   └───structures
+        │   │           argestesion.xml
+        │   │
+        │   └───meshes
+        │       └───structural
+        │               argestesion.dae
+        │
+        └───simulation
+            └───templates
+                └───structures
+                        argestesion.xml
+}}}
+
+Else it will not work and the game will be confused. On Windows it usually means you generated the zip from outside the folder instead of from inside the folder.
+
+==== mod.json ====
+
+The `mod.json` file is an important part of the verification process. For the sake of the demonstration let's assume we have a mod called `Sky Ships` with a mod.io url `https://0ad.mod.io/sky-ships` and a directory structure like the correct one above.
+
+Now let's assume the `mod.json` file looks like this:
+
+{{{#!json
+{
+        "name": "sky_ships",
+        "version": "1.0.0",
+        "label": "New stuff, new things, and new bugs",
+        "description": "New stuff, new things, and new bugs + more stuff",
+        "dependencies": [
+                "0ad=0.0.25"
+        ]
+}
+}}}
+
+A few things are wrong with this `mod.json`
+
+1. `"name"` should be the same as the `mod.io` url so in this case `sky-ships` and not `sky_ships
+2. `"label"` should be `Sky Ships` not `"New stuff, new things, and new bugs"`
+
+
+**Note**: If you want to be facetious, you'll notice that we reference the `0ad` mod which is in a `public` folder. It should technically be `empires_ascendant` in an `empires_ascendant` folder.
+
+==== OOS Compatibility ====
+
+Since A25 a new flag `"ignoreInCompatibilityChecks"` was introduced. As the name suggests it allows to avoid compatibility checks when playing with other people. However Wildfire Games must make sur it is safe and it won't put other people out of sync.
+
+To do so one might try replaying a match with the mod on, try playing multiplayer, try to rejoin a game to make sure it doesn't affect simulation. If it does, mod will be rejected.
+
+==== Analyzing files ====
+
+It's important to browse the mod to look for suspect JavaScript code and suspect files. You must look at every single file to make sure no malicious code gets through.
+
+You can also compare to vanilla versions files using `git`.
+
+{{{#!sh
+# -d is to generate a patch file
+# -u is to ignore whitespace changes
+$ git diff -du 
+}}}
+
+If a new file contains `Engine.****` calls you need to make sure there is no foul play, it can also be for big random map scripts.
+
+When checking big mods, it might be wiser to diff mods you already checked using the previous version as reference. Even if they have a git repository it's better to check locally, in case files were added manually.
+
+When having mods with lots of texture, it's good to suggest using the archive builder (to turn png/tga files into dds, dae files into psa or pmd and XML files to XMB) This will reduce the download size greatly and increase the performance.
+
+
+==== Signing ==== 
+
+Once the mod is deemed `safe` we use [https://github.com/jedisct1/minisign Minisign] to sign files. For security reasons only one person can sign mods because it's not good to share that private key around given that it works for an entire alpha.
+
+==== Adding Metadata ====
+
+Using the signature file we replace all newlines by `\n` an the tab of the third line by a `\t`. 
+We then add curly braces, and we copy paste the `"depenencies"` tag from the `mod.json`. Then we add "minisigs": [""] around the signature ; and we put everything the metadata field of mod.io.
+
+==== Sending the signature ====
+
+Once all is done we send the signature for completeness or in case the person wants to share the mod through other means.
+
+
+