View Jar Signing

When the mod is installed, the NeoForge mod list gains the ability to show JAR signing information for each signed mod. Only signed mods display this information. The shown details cover the signer's certificate path, the distinguished name of each entry, the algorithm used to create the certificate, and whether that certificate is a CA, a certificate authority, or self-signed. The SHA256 fingerprint of the first signer's leaf certificate is included, and the certificate chain can be listed through a configuration option.

The mod only exposes the result that NeoForge produces when it verifies JAR files; it does not perform its own checks. Verification covers only .class files, and other files in a JAR are ignored. Because verification runs against the actual JAR file, a mod that was modified at runtime can still report as valid. Minecraft shows an Invalid status when the installation happened at install time, so that status should be read with care. The environment is client-side only, released under All rights reserved and not open source, and files are published for NeoForge across 1.21.1 – 1.21.7 with 0.0.1 for 1.21.7 as the latest file.