Update plugin fabric-loom to v1.17.9

Reviewed-on: #6

.gitea/workflows/dev-verify.yml

@@ -12,18 +12,26 @@ on:
 jobs:
   verify:
     runs-on: ubuntu-latest
+    container:
+      image: gradle:8.14.5-jdk21
+    env:
+      GITEA_TOKEN: ${{ github.token }}
+      GITEA_API_URL: ${{ github.server_url }}/api/v1
+      GITEA_REPO: ${{ github.repository }}
+      GITEA_REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
     steps:
-      - name: Check out
+      - name: Prepare source
-        uses: actions/checkout@v4
+        shell: bash
+        run: |
+          set -euo pipefail
 
-      - name: Set up Java
+          if [ ! -f build.gradle ]; then
-        uses: actions/setup-java@v4
+            git -c http.extraHeader="Authorization: token ${GITEA_TOKEN}" \
-        with:
+              clone --depth 1 "${GITEA_REPO_URL}" .
-          distribution: temurin
+          fi
-          java-version: 21
 
       - name: Verify
         shell: bash
         run: |
           set -euo pipefail
-          bash ./gradlew --no-daemon compileClientJava
+          gradle --no-daemon compileClientJava

.gitea/workflows/main-release.yml

@@ -1,4 +1,4 @@
-name: Main Release
+name: Build and Release
 
 on:
   push:
@@ -6,6 +6,7 @@ on:
       - main
     tags:
       - "v*"
+  pull_request:
   workflow_dispatch:
 
 permissions:
@@ -14,47 +15,151 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
+    container:
+      image: gradle:8.14.5-jdk21
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - minecraft_version: "1.21.1"
+            yarn_mappings: "1.21.1+build.3"
+            fabric_version: "0.116.10+1.21.1"
+          - minecraft_version: "1.21.2"
+            yarn_mappings: "1.21.2+build.1"
+            fabric_version: "0.106.1+1.21.2"
+          - minecraft_version: "1.21.3"
+            yarn_mappings: "1.21.3+build.2"
+            fabric_version: "0.114.1+1.21.3"
+          - minecraft_version: "1.21.4"
+            yarn_mappings: "1.21.4+build.8"
+            fabric_version: "0.119.4+1.21.4"
+          - minecraft_version: "1.21.5"
+            yarn_mappings: "1.21.5+build.1"
+            fabric_version: "0.128.2+1.21.5"
+          - minecraft_version: "1.21.6"
+            yarn_mappings: "1.21.6+build.1"
+            fabric_version: "0.128.2+1.21.6"
+          - minecraft_version: "1.21.7"
+            yarn_mappings: "1.21.7+build.8"
+            fabric_version: "0.129.0+1.21.7"
+          - minecraft_version: "1.21.8"
+            yarn_mappings: "1.21.8+build.1"
+            fabric_version: "0.136.1+1.21.8"
+          - minecraft_version: "1.21.9"
+            yarn_mappings: "1.21.9+build.1"
+            fabric_version: "0.134.1+1.21.9"
+          - minecraft_version: "1.21.10"
+            yarn_mappings: "1.21.10+build.3"
+            fabric_version: "0.138.4+1.21.10"
+          - minecraft_version: "1.21.11"
+            yarn_mappings: "1.21.11+build.4"
+            fabric_version: "0.141.3+1.21.11"
+    env:
+      GITEA_TOKEN: ${{ github.token }}
+      GITEA_API_URL: ${{ github.server_url }}/api/v1
+      GITEA_REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
     steps:
-      - name: Check out
+      - name: Prepare source
-        uses: actions/checkout@v4
+        shell: bash
+        run: |
+          set -euo pipefail
 
-      - name: Set up Java
+          if [ ! -f build.gradle ]; then
-        uses: actions/setup-java@v4
+            git -c http.extraHeader="Authorization: token ${GITEA_TOKEN}" \
-        with:
+              clone --depth 1 "${GITEA_REPO_URL}" .
-          distribution: temurin
+          fi
-          java-version: 21
 
       - name: Build
         shell: bash
         run: |
           set -euo pipefail
-          bash ./gradlew --no-daemon build
+
+          echo "Building Minecraft ${{ matrix.minecraft_version }}"
+          gradle --no-daemon clean build \
+            -Pminecraft_version="${{ matrix.minecraft_version }}" \
+            -Pyarn_mappings="${{ matrix.yarn_mappings }}" \
+            -Pfabric_version="${{ matrix.fabric_version }}"
+
+          mkdir -p release-artifacts
+
+          jar_path=""
+          shopt -s nullglob
+          for candidate in build/libs/*.jar; do
+            case "$(basename "${candidate}")" in
+              *-sources.jar|*-dev.jar)
+                continue
+                ;;
+            esac
+
+            jar_path="${candidate}"
+            break
+          done
+
+          if [ -z "${jar_path}" ]; then
+            echo "No build jar found for Minecraft ${{ matrix.minecraft_version }}"
+            exit 1
+          fi
+
+          cp "${jar_path}" "release-artifacts/sign-leak-shield-${{ matrix.minecraft_version }}.jar"
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sign-leak-shield-${{ matrix.minecraft_version }}
+          path: release-artifacts/sign-leak-shield-${{ matrix.minecraft_version }}.jar
+          if-no-files-found: error
+          retention-days: 7
+
+  publish:
+    needs: build
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    container:
+      image: gradle:8.14.5-jdk21
+    env:
+      GITEA_TOKEN: ${{ github.token }}
+      GITEA_API_URL: ${{ github.server_url }}/api/v1
+      GITEA_REPO: ${{ github.repository }}
+      GITEA_REF_NAME: ${{ github.ref_name }}
+      GITEA_SHA: ${{ github.sha }}
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: versioned-jars
+          pattern: sign-leak-shield-*
+          merge-multiple: true
 
       - name: Publish Gitea release
-        if: github.event_name != 'pull_request'
         shell: bash
         run: |
           set -euo pipefail
 
-          jar_path="$(ls -1 build/libs/*.jar | head -n 1)"
+          shopt -s nullglob
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+          jar_paths=(versioned-jars/*.jar)
-            release_tag="${GITHUB_REF_NAME}"
+          if [ "${#jar_paths[@]}" -eq 0 ]; then
-            release_name="${GITHUB_REF_NAME}"
+            echo "No build artifacts were downloaded"
-            prerelease=false
+            exit 1
-          else
-            release_tag="build-${GITHUB_SHA:0:7}"
-            release_name="build-${GITHUB_SHA:0:7}"
-            prerelease=true
           fi
 
-          release_payload="$(printf '{"tag_name":"%s","name":"%s","body":"Automated build for %s.","draft":false,"prerelease":%s}' \
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-            "${release_tag}" "${release_name}" "${release_name}" "${prerelease}")"
+            release_tag="${GITEA_REF_NAME}"
+            release_name="${GITEA_REF_NAME}"
+            prerelease=false
+          else
+            release_tag="build-${GITEA_SHA:0:7}"
+            release_name="build-${GITEA_SHA:0:7}"
+            prerelease=false
+          fi
+
+          release_payload="$(printf '{"tag_name":"%s","name":"%s","body":"Automated parallel build for Minecraft 1.21.1 through 1.21.11.","draft":false,"prerelease":%s}' \
+            "${release_tag}" "${release_name}" "${prerelease}")"
 
           release_json="$(curl -fsS \
-            -H "Authorization: token ${GITHUB_TOKEN}" \
+            -H "Authorization: token ${GITEA_TOKEN}" \
             -H "Content-Type: application/json" \
             -d "${release_payload}" \
-            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases")"
+            "${GITEA_API_URL}/repos/${GITEA_REPO}/releases")"
 
           release_id="$(printf '%s' "${release_json}" | sed -n 's/.*"id":[[:space:]]*\([0-9][0-9]*\).*/\1/p' | head -n 1)"
           if [ -z "${release_id}" ]; then
@@ -63,16 +168,10 @@ jobs:
             exit 1
           fi
 
-          if [[ "${GITHUB_SERVER_URL}" == "https://github.com" ]]; then
+          for jar_path in "${jar_paths[@]}"; do
             curl -fsS \
-              -H "Authorization: token ${GITHUB_TOKEN}" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
-              -H "Content-Type: application/octet-stream" \
-              --data-binary @"${jar_path}" \
-              "https://uploads.github.com/repos/${GITHUB_REPOSITORY}/releases/${release_id}/assets?name=$(basename "${jar_path}")"
-          else
-            curl -fsS \
-              -H "Authorization: token ${GITHUB_TOKEN}" \
               -H "Content-Type: multipart/form-data" \
               -F "attachment=@${jar_path}" \
-              "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/${release_id}/assets?name=$(basename "${jar_path}")"
+              "${GITEA_API_URL}/repos/${GITEA_REPO}/releases/${release_id}/assets?name=$(basename "${jar_path}")"
-          fi
+          done

.github/workflows/dev-verify.yml

@@ -1,29 +0,0 @@
-name: Dev Verify
-
-on:
-  push:
-    branches:
-      - dev
-  pull_request:
-    branches:
-      - dev
-  workflow_dispatch:
-
-jobs:
-  verify:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out
-        uses: actions/checkout@v4
-
-      - name: Set up Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 21
-
-      - name: Verify
-        shell: bash
-        run: |
-          set -euo pipefail
-          bash ./gradlew --no-daemon compileClientJava

.github/workflows/main-release.yml

@@ -1,78 +0,0 @@
-name: Main Release
-
-on:
-  push:
-    branches:
-      - main
-    tags:
-      - "v*"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out
-        uses: actions/checkout@v4
-
-      - name: Set up Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 21
-
-      - name: Build
-        shell: bash
-        run: |
-          set -euo pipefail
-          bash ./gradlew --no-daemon build
-
-      - name: Publish release
-        if: github.event_name != 'pull_request'
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          jar_path="$(ls -1 build/libs/*.jar | head -n 1)"
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-            release_tag="${GITHUB_REF_NAME}"
-            release_name="${GITHUB_REF_NAME}"
-            prerelease=false
-          else
-            release_tag="build-${GITHUB_SHA:0:7}"
-            release_name="build-${GITHUB_SHA:0:7}"
-            prerelease=true
-          fi
-
-          release_payload="$(printf '{"tag_name":"%s","name":"%s","body":"Automated build for %s.","draft":false,"prerelease":%s}' \
-            "${release_tag}" "${release_name}" "${release_name}" "${prerelease}")"
-
-          release_json="$(curl -fsS \
-            -H "Authorization: token ${GITHUB_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "${release_payload}" \
-            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases")"
-
-          release_id="$(printf '%s' "${release_json}" | sed -n 's/.*"id":[[:space:]]*\([0-9][0-9]*\).*/\1/p' | head -n 1)"
-          if [ -z "${release_id}" ]; then
-            echo "Failed to parse release ID from response:"
-            printf '%s\n' "${release_json}"
-            exit 1
-          fi
-
-          if [[ "${GITHUB_SERVER_URL}" == "https://github.com" ]]; then
-            curl -fsS \
-              -H "Authorization: token ${GITHUB_TOKEN}" \
-              -H "Content-Type: application/octet-stream" \
-              --data-binary @"${jar_path}" \
-              "https://uploads.github.com/repos/${GITHUB_REPOSITORY}/releases/${release_id}/assets?name=$(basename "${jar_path}")"
-          else
-            curl -fsS \
-              -H "Authorization: token ${GITHUB_TOKEN}" \
-              -H "Content-Type: multipart/form-data" \
-              -F "attachment=@${jar_path}" \
-              "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/${release_id}/assets?name=$(basename "${jar_path}")"
-          fi

README.md

@@ -4,12 +4,13 @@
 >
 > This mod was built with the help of AI.
 
-![Main Release](https://dock-it.dev/OnniSystems/ModBlockBypass/actions/workflows/main-release.yml/badge.svg?branch=main)
+![Main Release](https://dock-it.dev/OnniSystems/SignShield/actions/workflows/main-release.yml/badge.svg?branch=main)
-![Dev Verify](https://dock-it.dev/OnniSystems/ModBlockBypass/actions/workflows/dev-verify.yml/badge.svg?branch=dev)
 
-This is a Fabric client mod for Minecraft 1.21.1 that defensively patches forced sign-editor translation and keybind leak probes.
+![Dev Verify](https://dock-it.dev/OnniSystems/SignShield/actions/workflows/dev-verify.yml/badge.svg?branch=dev)
 
-Bypass's Anti Mod systems on Donut SMP and otehr like it.
+This is a Fabric client mod for Minecraft 1.21.11 that defensively patches forced sign-editor translation and keybind leak probes.
+
+Bypass's Anti Mod systems on Donut SMP and others like it.
 
 Build:
 
@@ -20,5 +21,5 @@ Build:
 
 Notes:
 
-- The project targets Fabric for Minecraft 1.21.1.
+- The project targets Fabric for Minecraft 1.21.11.
 - The implementation is scoped to forced sign editor traffic and only rewrites matching outgoing sign update packets.

build.gradle

@@ -6,6 +6,7 @@ plugins {
 version = project.mod_version
 group = project.maven_group
 def modVersion = project.version.toString()
+def minecraftVersion = project.minecraft_version.toString()
 
 base {
     archivesName = project.archives_base_name
@@ -40,9 +41,13 @@ dependencies {
 
 processResources {
     inputs.property "version", modVersion
+    inputs.property "minecraft_version", minecraftVersion
 
     filesMatching("fabric.mod.json") {
-        expand "version": modVersion
+        expand([
+                "version": modVersion,
+                "minecraft_version": minecraftVersion
+        ])
     }
 }
 

gradle.properties

@@ -2,14 +2,14 @@ org.gradle.jvmargs=-Xmx2G -Dfile.encoding=UTF-8
 org.gradle.parallel=true
 org.gradle.caching=true
 org.gradle.daemon=true
-org.gradle.configuration-cache=true
+org.gradle.configuration-cache=false
 
-minecraft_version=1.21.1
+minecraft_version=1.21.11
-yarn_mappings=1.21.1+build.3
+yarn_mappings=1.21.11+build.4
 loader_version=0.18.4
-loom_version=1.9.1
+loom_version=1.17.9
-fabric_version=0.116.8+1.21.1
+fabric_version=0.141.3+1.21.11
 
-mod_version=1.0.1
+mod_version=1.0.2
 maven_group=com.example
 archives_base_name=sign-leak-shield

renovate.json

@@ -0,0 +1,3 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+}

src/client/java/com/example/signleakshield/TextSanitizer.java

@@ -7,11 +7,14 @@ import net.minecraft.text.TextContent;
 import net.minecraft.text.TranslatableTextContent;
 
 public final class TextSanitizer {
-    private static final String[] BLACKLISTED_KEY_PARTS = {
+    private static final String[] SUSPICIOUS_KEY_PARTS = {
         "gey.glazed.",
+        "key.meteor-client.",
+        "meteor-client",
         "meteorline",
         "meteorclient",
         "metiorclient",
+        "meteordevelopment.meteorclient",
         "itemscroller",
         "moremousetweaks",
         "invmove",
@@ -36,11 +39,22 @@ public final class TextSanitizer {
         TextContent content = text.getContent();
 
         if (content instanceof TranslatableTextContent translatable) {
-            return isBlacklistedKey(translatable.getKey());
+            if (isBlacklistedKey(translatable.getKey())) {
+                return true;
+            }
+
+            for (Object arg : translatable.getArgs()) {
+                if (isSuspiciousArgument(arg)) {
+                    return true;
+                }
+            }
+
+            return false;
         }
 
         if (content instanceof KeybindTextContent keybind) {
-            return isBlacklistedKey(keybind.getKey());
+            String key = keybind.getKey();
+            return key != null && !VanillaKeybinds.isVanillaKey(key);
         }
 
         for (Text sibling : text.getSiblings()) {
@@ -75,7 +89,8 @@ public final class TextSanitizer {
                 out.append(translatable.getKey());
             }
         } else if (content instanceof KeybindTextContent keybind) {
-            out.append(text.getString());
+            String key = keybind.getKey();
+            out.append(key != null ? key : "");
         } else {
             out.append(text.getString());
         }
@@ -91,7 +106,7 @@ public final class TextSanitizer {
         }
 
         String lower = key.toLowerCase();
-        for (String part : BLACKLISTED_KEY_PARTS) {
+        for (String part : SUSPICIOUS_KEY_PARTS) {
             if (lower.contains(part)) {
                 return true;
             }
@@ -99,4 +114,36 @@ public final class TextSanitizer {
 
         return false;
     }
+
+    private static boolean isSuspiciousArgument(Object arg) {
+        if (arg == null) {
+            return false;
+        }
+
+        if (arg instanceof Text text) {
+            return isSuspicious(text);
+        }
+
+        if (arg instanceof KeybindTextContent keybind) {
+            return !VanillaKeybinds.isVanillaKey(keybind.getKey());
+        }
+
+        if (arg instanceof TranslatableTextContent translatable) {
+            if (isBlacklistedKey(translatable.getKey())) {
+                return true;
+            }
+
+            for (Object nested : translatable.getArgs()) {
+                if (isSuspiciousArgument(nested)) {
+                    return true;
+                }
+            }
+        }
+
+        if (arg instanceof CharSequence sequence) {
+            return isBlacklistedKey(sequence.toString());
+        }
+
+        return false;
+    }
 }

src/client/java/com/example/signleakshield/VanillaKeybinds.java

@@ -0,0 +1,81 @@
+package com.example.signleakshield;
+
+import net.minecraft.client.MinecraftClient;
+import net.minecraft.client.option.GameOptions;
+import net.minecraft.client.option.KeyBinding;
+
+import java.lang.reflect.Field;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+public final class VanillaKeybinds {
+    private static volatile Set<String> vanillaKeys;
+
+    private VanillaKeybinds() {
+    }
+
+    public static boolean isVanillaKey(String key) {
+        if (key == null || key.isEmpty()) {
+            return false;
+        }
+
+        Set<String> keys = vanillaKeys;
+        if (keys == null) {
+            keys = loadVanillaKeys();
+            if (keys != null) {
+                vanillaKeys = keys;
+            }
+        }
+
+        return keys != null && keys.contains(key);
+    }
+
+    private static Set<String> loadVanillaKeys() {
+        MinecraftClient client = MinecraftClient.getInstance();
+        if (client == null || client.options == null) {
+            return null;
+        }
+
+        Set<String> keys = new HashSet<>();
+
+        for (Field field : GameOptions.class.getDeclaredFields()) {
+            Class<?> type = field.getType();
+            if (!KeyBinding.class.isAssignableFrom(type) && !KeyBinding[].class.isAssignableFrom(type)) {
+                continue;
+            }
+
+            try {
+                field.setAccessible(true);
+                Object value = field.get(client.options);
+                collectKeyBindings(keys, value);
+            } catch (IllegalAccessException | RuntimeException ignored) {
+            }
+        }
+
+        return Collections.unmodifiableSet(keys);
+    }
+
+    private static void collectKeyBindings(Set<String> keys, Object value) {
+        if (value instanceof KeyBinding keyBinding) {
+            String translationKey = keyBinding.getTranslationKey();
+            if (translationKey != null && !translationKey.isEmpty()) {
+                keys.add(translationKey);
+            }
+            return;
+        }
+
+        if (value instanceof KeyBinding[] keyBindings) {
+            for (KeyBinding keyBinding : keyBindings) {
+                if (keyBinding == null) {
+                    continue;
+                }
+
+                String translationKey = keyBinding.getTranslationKey();
+                if (translationKey != null && !translationKey.isEmpty()) {
+                    keys.add(translationKey);
+                }
+            }
+        }
+    }
+}

src/client/java/com/example/signleakshield/mixin/ClientConnectionMixin.java

@@ -89,21 +89,33 @@ public abstract class ClientConnectionMixin {
 
         Text[] textLines;
         textLines = signPacket.isFront() ? captured.getFront() : captured.getBack();
+        String[] originalResponse = signPacket.getText();
 
         String line1 = TextSanitizer.sanitize(textLines[0]);
         String line2 = TextSanitizer.sanitize(textLines[1]);
         String line3 = TextSanitizer.sanitize(textLines[2]);
         String line4 = TextSanitizer.sanitize(textLines[3]);
+        String[] returnedResponse = new String[] { line1, line2, line3, line4 };
 
         SignLeakShieldTraceLog.info(
-            "Blocked forced sign translation event at %s front=%s: got=%s, returned=%s",
+            "Blocked forced sign translation event at %s front=%s: receivedSign=%s, unmodifiedResponse=%s, returned=%s",
             pos,
             signPacket.isFront(),
-            Arrays.toString(signPacket.getText()),
+            describeTextLines(textLines),
-            Arrays.toString(new String[] { line1, line2, line3, line4 })
+            Arrays.toString(originalResponse),
+            Arrays.toString(returnedResponse)
         );
 
         ExploitState.clearForcedOpen();
         return new UpdateSignC2SPacket(pos, signPacket.isFront(), line1, line2, line3, line4);
     }
+
+    private static String describeTextLines(Text[] lines) {
+        String[] values = new String[lines.length];
+        for (int i = 0; i < lines.length; i++) {
+            values[i] = lines[i] != null ? lines[i].getString() : "";
+        }
+
+        return Arrays.toString(values);
+    }
 }

src/main/resources/fabric.mod.json

@@ -23,7 +23,7 @@
   ],
   "depends": {
     "fabricloader": ">=0.18.4",
-    "minecraft": "1.21.1",
+    "minecraft": "${minecraft_version}",
     "java": ">=21",
     "fabric-api": "*"
   }