native-build: sign only what the plan job outputs; no cache restores in write-token jobs

Security review of #381 (horizon#11859):
- H1: the sign job no longer reads the `plan` artifact, which a build job can replace. It takes the
  set, base and matrix from the plan job's outputs, recomputes every key (`native_build.py
  signable`), derives the file names from key and target, downloads `build-<target>` by exact name
  and refuses anything but that one archive.
- H2: publish.yml and check.yml restore no cache (a restored entry unpacks a tar anywhere on the
  runner, and native builds run on main): the tool is built fresh, files come from a
  `registry-files` release by URL and are checked against their SHA-256 (fetch.sh), so the hourly
  runs still don't count as players' downloads. native-compat.yml's health compile now holds a
  read token; a separate job checks the JSON's shape and uploads it.
- M1: the signer and keys come from a pinned Horizon commit, checked by SHA-256, never HORIZON_REV.
- M2: native_build.py, its test, prebuilt.toml and native-build.yml are Ludovic's in CODEOWNERS.
- M4: plan and sign accept only a set prebuilt.toml lists.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.github/CODEOWNERS

@@ -1,5 +1,12 @@
 # Every change needs a review from one of these before it merges (branch protection:
-# "Require review from Code Owners"). Add trusted contributors to the first line.
-*            @ludovic111 @rdbtCVS
+# "Require review from Code Owners"). The reviewers are the Horizon Team, GitHub team horizon-rust/horizon-team
+# (Ludovic decides who is in it). /.github/ and takedowns stay Ludovic's.
+*            @ludovic111 @horizon-rust/horizon-team
 /.github/    @ludovic111
 /revoked.toml @ludovic111
+# What decides which builds the native-builds environment signs, and under which key (native-build.yml,
+# horizon#11859): the signing key's owner reviews it.
+/scripts/native_build.py      @ludovic111
+/scripts/test_native_build.py @ludovic111
+/prebuilt.toml                @ludovic111
+/.github/workflows/native-build.yml @ludovic111

.github/ISSUE_TEMPLATE/config.yml

@@ -4,5 +4,5 @@ contact_links:
     url: https://playhorizon.dev/mods/submit
     about: Mods, modpacks and resource packs for Horizon. Each submission is reviewed.
   - name: Horizon itself
-    url: https://github.com/ludovic111/horizon/issues
+    url: https://github.com/horizon-rust/horizon/issues
     about: Bugs in the game or the launcher.

.github/ISSUE_TEMPLATE/takedown.yml

@@ -0,0 +1,37 @@
+name: Takedown request (copyright)
+description: A project in the registry uses your work without your permission.
+title: "Takedown: "
+labels: [takedown]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for telling us. A project that uses your work without permission is removed
+        (see [MOD-POLICY.md](https://github.com/horizon-rust/horizon-mods/blob/main/MOD-POLICY.md)).
+        This issue is public: to write privately instead, use [lu4ovic.com](https://lu4ovic.com/#contact).
+  - type: input
+    id: project
+    attributes:
+      label: Project id
+      description: The last part of its page's address, playhorizon.dev/mods/<id>
+    validations:
+      required: true
+  - type: textarea
+    id: work
+    attributes:
+      label: Your work
+      description: What it is, where it is published, and what the project copies from it.
+    validations:
+      required: true
+  - type: input
+    id: contact
+    attributes:
+      label: How to reach you
+      description: An email or profile, if not this GitHub account.
+  - type: checkboxes
+    id: rights
+    attributes:
+      label: Statement
+      options:
+        - label: I own the rights to this work, or I act for whoever does, and I believe this use is not allowed.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -3,6 +3,11 @@
 **Project:** <!-- id, and new project or update -->
 
 - [ ] I made it, or I am allowed to publish it, under the licence the entry names.
+- [ ] If it ports or translates another mod, the original's licence allows it (or its authors agreed), and my page
+      credits and links the original.
+- [ ] It has no code, assets or data from Minecraft, Mojang or Microsoft, and nothing that harms players.
+- [ ] I read and accept the [mod policy](https://github.com/horizon-rust/horizon-mods/blob/main/MOD-POLICY.md): I am this
+      project's author or publisher and responsible for it; the Horizon project is not.
 - [ ] The `source` link has the code this file was built from.
 - [ ] I ran `cargo horizon-mod check <file>` and it passed.
 

.github/workflows/check.yml

@@ -29,13 +29,9 @@ jobs:
         with:
           path: head
           persist-credentials: false
-      - uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/bin
-            ~/.cargo/horizon-rev
-          key: cargo-horizon-mod-${{ env.HORIZON_REV }}
-      # main's scripts, not the pull request's.
+      # main's scripts, not the pull request's. No actions/cache: this job decides whether a submission passes,
+      # and main's cache entries can be written by runs that build other people's code (native-build.yml), so
+      # the tool is built fresh and the files are checked against their SHA-256 (fetch.sh).
       - run: base/scripts/install-tool.sh
       - name: Who submitted it
         id: author
@@ -60,6 +56,8 @@ jobs:
             | tee -a "$GITHUB_STEP_SUMMARY" || status=1
           echo '```' >> "$GITHUB_STEP_SUMMARY"
           exit $status
+      # Published files come from the registry-files release publish keeps: downloads from a mod's own
+      # release would count as a player's.
       - name: Download its files
         run: base/scripts/fetch.sh head
       - name: Check each new file

.github/workflows/native-build.yml

@@ -0,0 +1,269 @@
+# Prebuilt native builds (horizon#11859): the game compiled for one exact set of registry native mods, signed, so
+# players' launchers download it instead of compiling for 30 to 60 minutes.
+# - Every day after the Nightly, `dispatch` starts one run per set of prebuilt.toml on the newest Nightly. A run
+#   builds ONE set, and only a set prebuilt.toml lists (`plan` and `sign` both refuse any other).
+# - On GitHub's runners only:
+#   plan  (no secrets): resolves the Nightly and each mod against the published index (newest unrevoked version,
+#         not broken_on that commit), computes each target's request key as the launcher does, leaves out what is
+#         published, downloads the mods' files and the launcher release named by vars.NATIVE_BUILD_LAUNCHER and
+#         checks that release's signed SHA256SUMS against Horizon's release keys (pinned below, by SHA-256).
+#   build (no secrets, a token that can only read, no cache): runs that launcher headless
+#         (`native-build --prebuilt-out`): its pinned Rust, the Nightly's source, the release profile, the same
+#         pins, hook points and left-out mods as a player's build. A mod crate's build script runs here, so this
+#         job is UNTRUSTED: with the runner's own token it can replace any artifact of the run (`plan` included)
+#         and write cache entries on main.
+#   sign  (environment `native-builds`, main only): trusts nothing a build job could touch. What it signs comes
+#         from the plan job's OUTPUTS only (no later job can change them); it recomputes each key from the base,
+#         the mods and the target, derives every file name from key and target, downloads `build-<target>` by
+#         its exact name and refuses anything in it but that one archive. It runs only Horizon's
+#         tools/ci/sign_native_build.sh (sha256sum and OpenSSL) at a pinned commit, checked by SHA-256 before
+#         the key is in reach. A build can only ever be signed as its own set's.
+# Caches: no job here restores one, and no job of horizon-mods that holds a write token may restore one either
+# (publish.yml, native-compat.yml): the build job above can write cache entries on main, and restoring an entry
+# unpacks a tar anywhere on the runner.
+name: native-build
+on:
+  schedule:
+    - cron: "30 19 * * *"
+  workflow_dispatch:
+    inputs:
+      mods:
+        description: "One set of prebuilt.toml, exactly as listed (`id` or `id@version`, space-separated). Empty: every set (one run each)"
+        default: ""
+      base:
+        description: "The Nightly: `latest` or nightly-<date>-<short>"
+        default: latest
+      targets:
+        description: "`all`, or target triples separated by commas"
+        default: all
+permissions:
+  contents: read
+concurrency:
+  group: native-build-${{ inputs.mods || 'dispatch' }}-${{ inputs.base || 'latest' }}
+  cancel-in-progress: false
+env:
+  # A launcher release with `native-build --prebuilt-out` (Horizon #11859), e.g. [email protected].
+  LAUNCHER: ${{ vars.NATIVE_BUILD_LAUNCHER }}
+  # The Horizon commit this workflow takes its signer and keys from: its own pin, never vars.HORIZON_REV (shared with
+  # publish and the checks) and never a branch. Each file is checked against its SHA-256 here before it is used.
+  # Moving the pin means reviewing the files' diff and updating the three hashes (`sha256sum`).
+  SIGN_REV: c794b87841b58f72ade9842b46757d843246054c
+  SIGN_SCRIPT_SHA256: 95ebefe4b0beeb1b4282a09352260c48f1793b13e370414e91175aa789fc2278   # tools/ci/sign_native_build.sh
+  SIGN_KEYS_SHA256: f75dc6fe23343a4e97fe2453853e67f20ddcce1bc1f2c240a56b8b6d6681f611     # crates/horizon-release-sign/native-build-keys.txt
+  RELEASE_KEYS_SHA256: bb1f43a3eb14a2c0d89d7d823a3352dd4b7ac01f50d55451e282ea178fb61f6f  # crates/horizon-release-sign/release-keys.txt
+  # The largest archive signed: the launcher refuses bigger ones before checking (launcher/src/native_prebuilt.rs).
+  MAX_ARCHIVE: "536870912"
+jobs:
+  dispatch:
+    # Idle until a launcher with native-build --prebuilt-out is released and named.
+    if: (github.event_name == 'schedule' || inputs.mods == '') && vars.NATIVE_BUILD_LAUNCHER != ''
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: One run per set
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BASE: ${{ inputs.base || 'latest' }}
+        run: |
+          python3 scripts/native_build.py sets | while read -r set; do
+            echo "native-build: $set"
+            gh workflow run native-build.yml --repo "$GITHUB_REPOSITORY" --ref main -f mods="$set" -f base="$BASE"
+          done
+  plan:
+    if: github.event_name == 'workflow_dispatch' && inputs.mods != ''
+    runs-on: ubuntu-latest
+    # The sign job reads these, never the `plan` artifact: build jobs can replace an artifact, not a job's outputs.
+    outputs:
+      matrix: ${{ steps.plan.outputs.matrix }}
+      any: ${{ steps.plan.outputs.any }}
+      tag: ${{ steps.plan.outputs.tag }}
+      base: ${{ steps.plan.outputs.base }}
+      mods: ${{ steps.plan.outputs.mods }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - run: python3 -m unittest scripts/test_native_build.py
+      - id: plan
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          MODS: ${{ inputs.mods }}
+          BASE: ${{ inputs.base }}
+          TARGETS: ${{ inputs.targets }}
+        run: python3 scripts/native_build.py plan --mods "$MODS" --base "$BASE" --targets "$TARGETS" --out plan
+      - name: The launcher, checked against Horizon's release keys
+        if: steps.plan.outputs.any == 'true'
+        run: |
+          set -euo pipefail
+          [ -n "$LAUNCHER" ] || { echo "::error::vars.NATIVE_BUILD_LAUNCHER names no launcher release"; exit 1; }
+          mkdir -p plan/launcher && cd plan/launcher
+          base="https://github.com/horizon-rust/horizon/releases/download/$LAUNCHER"
+          curl -sSfLO "$base/SHA256SUMS" && curl -sSfLO "$base/SHA256SUMS.sig"
+          for asset in $(jq -r '.builds[].launcher' ../plan.json | sort -u); do curl -sSfLO "$base/$asset"; done
+          curl -sSfL -o release-keys.txt \
+            "https://raw.githubusercontent.com/horizon-rust/horizon/$SIGN_REV/crates/horizon-release-sign/release-keys.txt"
+          echo "$RELEASE_KEYS_SHA256  release-keys.txt" | sha256sum -c
+          grep -v '^#' release-keys.txt | grep . > keys
+          { printf 'horizon release %s\n' "$LAUNCHER"; cat SHA256SUMS; } > message
+          ok=
+          while read -r key; do
+            { printf '\x30\x2a\x30\x05\x06\x03\x2b\x65\x70\x03\x21\x00'; echo "$key" | base64 -d; } > pub.der
+            while read -r sig; do
+              echo "$sig" | base64 -d > sig.bin
+              openssl pkeyutl -verify -rawin -pubin -keyform DER -inkey pub.der -in message -sigfile sig.bin >/dev/null 2>&1 && ok=1
+            done < SHA256SUMS.sig
+          done < keys
+          [ -n "$ok" ] || { echo "::error::$LAUNCHER: SHA256SUMS isn't signed by a Horizon release key"; exit 1; }
+          sha256sum --ignore-missing -c SHA256SUMS
+          rm -f message pub.der sig.bin keys release-keys.txt SHA256SUMS SHA256SUMS.sig
+      - uses: actions/upload-artifact@v4
+        with:
+          name: plan
+          path: plan
+  build:
+    needs: plan
+    if: needs.plan.outputs.any == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJson(needs.plan.outputs.matrix) }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 180
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: plan
+          path: plan
+      - if: runner.os == 'Linux'
+        # The game's ALSA and udev headers; the launcher links xkbcommon and xcb even headless.
+        run: sudo apt-get update && sudo apt-get install -y libasound2-dev libudev-dev pkg-config libxkbcommon-x11-0 libxcb1
+      - name: Build the set as a player's launcher would
+        env:
+          TARGET: ${{ matrix.target }}
+          KEY: ${{ matrix.key }}
+          LAUNCHER_ASSET: ${{ matrix.launcher }}
+          ARCHIVE: ${{ matrix.archive }}
+          TAG: ${{ needs.plan.outputs.tag }}
+        run: |
+          set -euo pipefail
+          scratch="$RUNNER_TEMP/native"
+          mkdir -p "$scratch/launcher" "$scratch/out"
+          case "$LAUNCHER_ASSET" in
+            *.tar.gz) tar xzf "plan/launcher/$LAUNCHER_ASSET" -C "$scratch/launcher"; launcher="$scratch/launcher/horizon-launcher" ;;
+            *macos*) unzip -q "plan/launcher/$LAUNCHER_ASSET" -d "$scratch/launcher"; launcher="$scratch/launcher/Horizon.app/Contents/MacOS/horizon-launcher" ;;
+            *) unzip -q "plan/launcher/$LAUNCHER_ASSET" -d "$scratch/launcher"; launcher="$scratch/launcher/horizon-launcher.exe" ;;
+          esac
+          export HORIZON_LAUNCHER_HOME="$scratch/home" HORIZON_HOME="$scratch/game" XDG_DATA_HOME="$scratch/data" \
+            XDG_CONFIG_HOME="$scratch/config" HORIZON_LAUNCHER_NO_SELF_UPDATE=1 HORIZON_NO_AUDIO=1
+          py=$(command -v python3 || command -v python)  # Windows runners name it python
+          "$launcher" install "$TAG"
+          "$launcher" native-build --prebuilt-out "$scratch/out/build" --version "$TAG" --profile release \
+            --trust-native-code plan/hnmods
+          got=$("$py" -c 'import hashlib,sys; print(hashlib.sha256(open(sys.argv[1],"rb").read()).hexdigest())' "$scratch/out/build/request.txt")
+          [ "$got" = "$KEY" ] || { echo "::error::the launcher built request $got, the plan asked for $KEY"; exit 1; }
+          mkdir -p dist
+          tar czf "dist/$ARCHIVE" -C "$scratch/out/build" .
+          ls -l dist
+      - uses: actions/upload-artifact@v4
+        with:
+          name: build-${{ matrix.target }}
+          path: dist/${{ matrix.archive }}
+          if-no-files-found: error
+  sign:
+    needs: [plan, build]
+    if: always() && needs.plan.outputs.any == 'true'
+    runs-on: ubuntu-latest
+    environment: native-builds
+    permissions:
+      contents: write
+      actions: read
+    env:
+      # Job outputs of plan, the only input of this job besides the archives themselves.
+      BASE: ${{ needs.plan.outputs.base }}
+      TAG: ${{ needs.plan.outputs.tag }}
+      MODS: ${{ needs.plan.outputs.mods }}
+      MATRIX: ${{ needs.plan.outputs.matrix }}
+      GH_REPO: ${{ github.repository }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            scripts/native_build.py
+            prebuilt.toml
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+          path: registry
+      - name: The signer, at its pinned commit and hashes
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/signer" && cd "$RUNNER_TEMP/signer"
+          raw="https://raw.githubusercontent.com/horizon-rust/horizon/$SIGN_REV"
+          curl -sSfL -o sign_native_build.sh "$raw/tools/ci/sign_native_build.sh"
+          curl -sSfL -o native-build-keys.txt "$raw/crates/horizon-release-sign/native-build-keys.txt"
+          printf '%s  %s\n' "$SIGN_SCRIPT_SHA256" sign_native_build.sh "$SIGN_KEYS_SHA256" native-build-keys.txt | sha256sum -c
+      - name: What to sign, recomputed from the plan job's outputs
+        run: |
+          set -euo pipefail
+          # Checks the mods are a prebuilt.toml set and every row's key is that set's for its target; prints
+          # "<key> <target>". Fails the job on any mismatch.
+          python3 -I registry/scripts/native_build.py signable > "$RUNNER_TEMP/rows"
+          cat "$RUNNER_TEMP/rows"
+      - name: Each target's build, by its exact artifact name
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          while read -r key target <&3; do
+            name="${key:0:16}-$target.tar.gz"
+            dir="$RUNNER_TEMP/builds/$target"
+            mkdir -p "$dir"
+            if ! gh run download "$GITHUB_RUN_ID" --name "build-$target" --dir "$dir"; then
+              echo "::warning::$target: no build"
+              continue
+            fi
+            # Exactly one regular file, named from the key and target; anything else in the artifact is refused.
+            listing=$(cd "$dir" && find . -mindepth 1 -printf '%y %P\n')
+            if [ "$listing" != "f $name" ]; then
+              echo "::error::$target: build-$target holds something other than $name alone:"; echo "$listing"; exit 1
+            fi
+            size=$(stat -c %s "$dir/$name")
+            [ "$size" -le "$MAX_ARCHIVE" ] || { echo "::error::$target: $name is $size bytes, over $MAX_ARCHIVE"; exit 1; }
+            echo "$target: $name, $size bytes, sha256 $(sha256sum < "$dir/$name" | cut -d' ' -f1)"
+          done 3< "$RUNNER_TEMP/rows"
+      - name: Sign, then publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+          NATIVE_BUILD_SIGNING_KEY: ${{ secrets.NATIVE_BUILD_SIGNING_KEY }}
+          NATIVE_BUILD_SIGNING_KEY_NEXT: ${{ secrets.NATIVE_BUILD_SIGNING_KEY_NEXT }}
+        run: |
+          set -euo pipefail
+          signer="$RUNNER_TEMP/signer"
+          # Checked again in the step that holds the key: nothing between the steps may have changed them.
+          (cd "$signer" && printf '%s  %s\n' "$SIGN_SCRIPT_SHA256" sign_native_build.sh "$SIGN_KEYS_SHA256" native-build-keys.txt \
+            | sha256sum -c --quiet)
+          release="native-builds-${BASE:0:12}"
+          if ! gh release view "$release" >/dev/null 2>&1; then
+            gh release create "$release" --prerelease --latest=false --title "Prebuilt native builds on $TAG" \
+              --notes "The game built with registry native mods on Horizon $BASE, signed by native-build.yml (horizon#11859). The Horizon launcher downloads and checks these; nothing here is for downloading by hand."
+          fi
+          missing=0
+          while read -r key target <&3; do
+            dir="$RUNNER_TEMP/builds/$target"
+            name="${key:0:16}-$target.tar.gz"
+            sig="${key:0:16}-$target.sig"
+            if [ ! -f "$dir/$name" ]; then missing=1; continue; fi
+            NATIVE_BUILD_KEYS="$signer/native-build-keys.txt" bash "$signer/sign_native_build.sh" "$key" "$target" "$dir/$name"
+            # The signature last: the launcher looks for it first, so a half-uploaded build is never offered.
+            gh release upload "$release" "$dir/$name"
+            gh release upload "$release" "$dir/$sig"
+          done 3< "$RUNNER_TEMP/rows"
+          exit $missing

.github/workflows/native-compat.yml

@@ -0,0 +1,130 @@
+# Native mods on the newest Nightly, as players' launchers build them (scripts/native_compat.py):
+# - on a pull request, each new native-mod version, applied together with the most downloaded native mods
+#   and compiled (`cargo check`); its support modules' names against every registry mod's;
+# - every day after the Nightly, every native mod's newest version, applied, then the rest compiled
+#   (`cargo check`): the ones horizon-mixins refuses alone and the ones whose own code doesn't compile go
+#   to the `native-health` release, which publish adds to the index (`broken_on`) so the launcher warns
+#   before an install.
+# Both compile other people's crates, whose build scripts run: those jobs hold a token that can only read and
+# run main's script, never the pull request's. The daily result goes to the release from a separate job that
+# runs nothing of theirs and restores no cache (a build can write cache entries on main).
+name: native-compat
+on:
+  pull_request:
+    branches: [main]
+    paths: ["mods/*.toml"]
+  schedule:
+    - cron: "40 18 * * *"
+  workflow_dispatch:
+    inputs:
+      horizon:
+        description: "Horizon commit, or `latest` (the newest Nightly)"
+        default: latest
+      upload:
+        description: "Publish the result (native-health release); `false` for a trial run"
+        default: "true"
+permissions:
+  contents: read
+concurrency:
+  group: native-compat-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+env:
+  # The Rust the launcher builds native mods with (Horizon's launcher/src/rust_toolchain.rs).
+  RUST: "1.99.1"
+jobs:
+  check:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          path: base
+      - uses: actions/checkout@v4
+        with:
+          path: head
+          persist-credentials: false
+      - name: Does it change a native mod?
+        id: native
+        run: |
+          if [ -n "$(python3 base/scripts/native_compat.py new base head)" ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+      - if: steps.native.outputs.changed == 'true'
+        run: rustup toolchain install $RUST --profile minimal && rustup default $RUST
+      - if: steps.native.outputs.changed == 'true'
+        run: sudo apt-get update && sudo apt-get install -y libasound2-dev libudev-dev pkg-config
+      - if: steps.native.outputs.changed == 'true'
+        name: On the newest Nightly, with the popular native mods
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          set -o pipefail
+          python3 base/scripts/native_compat.py check base head | tee -a "$GITHUB_STEP_SUMMARY"
+  health:
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    # Each mod horizon-mixins refuses costs one more apply of the whole set.
+    timeout-minutes: 300
+    # Read only: every registry native mod's build script runs in this job.
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - run: python3 -m unittest discover -s scripts -p 'test_*.py'
+      - run: rustup toolchain install $RUST --profile minimal && rustup default $RUST
+      - run: sudo apt-get update && sudo apt-get install -y libasound2-dev libudev-dev pkg-config
+      # Yesterday's dependencies, checked, and horizon-mixins: only Horizon's own crates and the mods compile again.
+      # Safe only because this job holds nothing: it builds untrusted code anyway.
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            native/target/compat/cargo
+            native/target/horizon-mixins
+          key: native-health-${{ env.RUST }}-${{ github.run_id }}
+          restore-keys: native-health-${{ env.RUST }}-
+      - name: Every native mod's newest version on the newest Nightly
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          HORIZON: ${{ inputs.horizon || 'latest' }}
+        run: |
+          set -o pipefail
+          python3 scripts/native_compat.py health --horizon "$HORIZON" --out native-health.json | tee -a "$GITHUB_STEP_SUMMARY"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: native-health
+          path: native-health.json
+          if-no-files-found: error
+  health-publish:
+    needs: health
+    if: inputs.upload != 'false'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      GH_REPO: ${{ github.repository }}
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: native-health
+          path: health
+      - name: Keep it for publish
+        run: |
+          set -euo pipefail
+          # Data from a job that ran other people's code: only the one file, only the shape publish reads.
+          [ "$(cd health && find . -mindepth 1 -printf '%y %P\n')" = "f native-health.json" ]
+          jq -e '(.horizon | type == "string" and test("^[0-9a-f]{40}$"))
+            and (.broken | type == "object")
+            and ([.broken | to_entries[] | (.key | test("^[a-z0-9_-]+$")) and (.value.version | type == "string")] | all)' \
+            health/native-health.json > /dev/null
+          gh release view native-health >/dev/null 2>&1 \
+            || gh release create native-health --prerelease --title "Native mods' health" \
+                 --notes "native-health.json: the native mods that don't apply on the newest Nightly (native-compat.yml). publish adds them to the index as broken_on."
+          gh release upload native-health health/native-health.json --clobber

.github/workflows/native.yml

@@ -0,0 +1,119 @@
+# Horizon's own native mods (native/<name>/): each changed folder's tests and .hnmod, and the game with it applied
+# on the Horizon it was tested on; every mod together, as a player's set. Every Monday, all of them on the newest
+# Nightly, to catch a change of the hook points early.
+name: native
+on:
+  pull_request:
+    branches: [main]
+    paths: ["native/**", ".github/workflows/native.yml"]
+  push:
+    branches: [main]
+    paths: ["native/**", ".github/workflows/native.yml"]
+  schedule:
+    - cron: "17 5 * * 1"
+  workflow_dispatch:
+    inputs:
+      horizon:
+        description: "Horizon commit, tag, or `latest` (the newest Nightly); empty: the mods' tested commit"
+        default: latest
+permissions:
+  contents: read
+concurrency:
+  group: native-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+env:
+  # The Rust the launcher builds native mods with (launcher/src/rust_toolchain.rs).
+  RUST: "1.99.1"
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      mods: ${{ steps.mods.outputs.mods }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - id: mods
+        env:
+          BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+          EVENT: ${{ github.event_name }}
+        run: |
+          all=$(ls -d native/*/compatibility.json | cut -d/ -f2 | jq -R . | jq -sc .)
+          if [ "$EVENT" = schedule ] || [ "$EVENT" = workflow_dispatch ] || [ -z "$BASE" ] \
+             || ! git cat-file -e "$BASE" 2>/dev/null; then
+            echo "mods=$all" >> "$GITHUB_OUTPUT"; exit 0
+          fi
+          changed=$(git diff --name-only "$BASE" HEAD)
+          # The shared tools or this workflow: every mod.
+          if grep -qE '^(native/tools/|\.github/workflows/native\.yml)' <<< "$changed"; then
+            echo "mods=$all" >> "$GITHUB_OUTPUT"; exit 0
+          fi
+          mods=$(grep -oE '^native/[^/]+/' <<< "$changed" | cut -d/ -f2 | sort -u \
+            | while read -r m; do [ -f "native/$m/compatibility.json" ] && echo "$m"; done | jq -R . | jq -sc .)
+          echo "mods=$mods" >> "$GITHUB_OUTPUT"
+  mod:
+    needs: changes
+    if: needs.changes.outputs.mods != '[]'
+    strategy:
+      fail-fast: false
+      matrix:
+        mod: ${{ fromJson(needs.changes.outputs.mods) }}
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: native/${{ matrix.mod }}
+    steps:
+      - uses: actions/checkout@v4
+      - run: rustup toolchain install $RUST --profile minimal --component rustfmt --component clippy && rustup default $RUST
+      - run: cargo fmt --check
+      - run: cargo clippy --all-targets --locked -- -D warnings
+      - run: cargo test --locked
+      - name: Package the .hnmod and check what it holds
+        working-directory: .
+        run: |
+          python3 native/tools/native.py package ${{ matrix.mod }}
+          python3 - <<'PY'
+          import json, zipfile, glob
+          path, = glob.glob("native/target/*.hnmod")
+          names = zipfile.ZipFile(path).namelist()
+          manifest = json.loads(zipfile.ZipFile(path).read("horizon-native.json"))
+          assert manifest["hooks"] >= 1, manifest
+          bundle = f"mixins/{manifest['id']}/"
+          assert all(n == "horizon-native.json" or n == bundle + "LICENSE" or (n.startswith(bundle) and n.endswith((".rs", ".toml"))) for n in names), names
+          assert bundle + "LICENSE" in names, "the mod's LICENSE travels in its package"
+          print(path, manifest)
+          PY
+      - uses: actions/upload-artifact@v4
+        with:
+          name: hnmod-${{ matrix.mod }}
+          path: native/target/*.hnmod
+  horizon:
+    needs: changes
+    if: needs.changes.outputs.mods != '[]'
+    strategy:
+      fail-fast: false
+      matrix:
+        mod: ${{ fromJson(needs.changes.outputs.mods) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: rustup toolchain install $RUST --profile minimal && rustup default $RUST
+      - run: sudo apt-get update && sudo apt-get install -y libasound2-dev libudev-dev pkg-config
+      - name: Apply on Horizon and check the game
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          HORIZON: ${{ github.event_name == 'schedule' && 'latest' || inputs.horizon || '' }}
+        run: python3 native/tools/native.py check ${{ matrix.mod }} ${HORIZON:+--horizon "$HORIZON"}
+  together:
+    needs: changes
+    if: needs.changes.outputs.mods != '[]'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: rustup toolchain install $RUST --profile minimal && rustup default $RUST
+      - run: sudo apt-get update && sudo apt-get install -y libasound2-dev libudev-dev pkg-config
+      - name: Every native mod applied together, on Horizon
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          HORIZON: ${{ github.event_name == 'schedule' && 'latest' || inputs.horizon || '' }}
+        run: python3 native/tools/native.py check all ${HORIZON:+--horizon "$HORIZON"}

.github/workflows/publish.yml

@@ -1,11 +1,15 @@
 # Merging publishes: each new version's file becomes a release asset
-# (<id>-<version>/<file>), then index.json and the icons go to GitHub Pages
-# (https://ludovic111.github.io/horizon-mods/index.json), which the launcher and
+# (<id>-<version>/<file>), then index.json, the icons and the screenshots go to GitHub
+# Pages (https://horizon-rust.github.io/horizon-mods/index.json), which the launcher and
 # playhorizon.dev/mods read. Nothing is published if any entry fails its checks.
+# Every hour it runs again to refresh each project's `downloads` (GitHub's download
+# counts of its release assets) and `stars` (its source repository's GitHub stars).
 name: publish
 on:
   push:
     branches: [main]
+  schedule:
+    - cron: "23 * * * *"
   workflow_dispatch:
 permissions:
   contents: write
@@ -26,19 +30,21 @@ jobs:
       GH_REPO: ${{ github.repository }}
       HORIZON_REV: ${{ vars.HORIZON_REV || 'main' }}
     steps:
+      # No actions/cache in this job, ever: it holds a write token (releases, Pages), and any run on main can
+      # write cache entries, including native-build.yml's and native-compat.yml's builds of other people's
+      # code. Restoring an entry unpacks a tar anywhere on the runner, so the tool is built fresh (about two
+      # minutes) and the files come from the registry-files release, each checked against its SHA-256.
       - uses: actions/checkout@v4
-      - uses: actions/cache@v4
         with:
-          path: |
-            ~/.cargo/bin
-            ~/.cargo/horizon-rev
-          key: cargo-horizon-mod-${{ env.HORIZON_REV }}
+          persist-credentials: false
       - run: scripts/install-tool.sh
-      - run: scripts/fetch.sh .
+      # FILES_MIRROR_UPLOAD: what isn't in registry-files yet is fetched from its own release once, then kept
+      # there, so these hourly runs don't count as players' downloads.
+      - run: FILES_MIRROR_UPLOAD=1 scripts/fetch.sh .
       - name: Build the index
         run: |
           mkdir -p site
-          cargo horizon-mod registry build . --files files --out site/index.json --generated "$(date -u +%FT%TZ)"
+          cargo horizon-mod registry build . --files files --out site/index.json --site https://horizon-rust.github.io/horizon-mods/ --generated "$(date -u +%FT%TZ)"
       - name: Publish new files as releases
         run: |
           cargo horizon-mod registry list . | while read -r sha id version file; do
@@ -49,9 +55,61 @@ jobs:
             gh release create "$tag" "$dir/$file" --title "$id $version" --latest=false \
               --notes "Reviewed in the registry: mods/$id.toml. SHA-256 $sha."
           done
+      - name: Download counts
+        run: |
+          # Each version's file is the asset at its URL: a project's downloads
+          # are its files' counts, every version together.
+          gh api --paginate "repos/$GH_REPO/releases?per_page=100" \
+            --jq '.[].assets[] | {key: .browser_download_url, value: .download_count}' \
+            | jq -s from_entries > counts.json
+          jq --slurpfile counts counts.json '
+            .projects |= map(
+              ([.versions[].file.url | $counts[0][.] // 0] | add) as $n
+              | if $n > 0 then .downloads = $n else . end)' site/index.json > index.counted.json
+          mv index.counted.json site/index.json
+          jq -r '.projects[] | "\(.id) \(.downloads // 0)"' site/index.json
+      - name: GitHub stars
+        run: |
+          # A project's stars are its source repository's (owner/repo of a
+          # https://github.com/ source, a folder of it or .git included), asked
+          # once per repository. One that can't be read is left out, not zero.
+          jq -r '.projects[].source // empty' site/index.json \
+            | sed -nE 's#^https://github\.com/([A-Za-z0-9-]+)/([A-Za-z0-9._-]+).*#\1/\2#p' \
+            | sed -E 's/\.git$//' | tr 'A-Z' 'a-z' | sort -u \
+            | while read -r repo; do
+                n="$(gh api "repos/$repo" --jq .stargazers_count 2>/dev/null)" || continue
+                echo "{\"key\": \"$repo\", \"value\": $n}"
+              done | jq -s from_entries > stars.json
+          jq --slurpfile stars stars.json '
+            .projects |= map(
+              (first((.source // "") | ascii_downcase
+                | capture("^https://github[.]com/(?<r>[a-z0-9-]+/[a-z0-9._-]+)").r
+                | sub("[.]git$"; "")) // "") as $r
+              | ($stars[0][$r] // 0) as $n
+              | if $n > 0 then .stars = $n else . end)' site/index.json > index.starred.json
+          mv index.starred.json site/index.json
+          jq -r '.projects[] | "\(.id) \(.stars // 0)"' site/index.json
+      - name: Native mods that don't apply on the newest Nightly
+        run: |
+          # native-compat.yml's daily health: the version each names gets `broken_on`, the Horizon
+          # commit horizon-mixins refused it on and its code, so the launcher warns before an install.
+          if gh release download native-health --pattern native-health.json --dir health 2>/dev/null; then
+            jq --slurpfile h health/native-health.json '
+              $h[0] as $health
+              | .projects |= map(. as $p | .versions |= map(
+                  ($health.broken[$p.id] // null) as $b
+                  | if $b != null and $b.version == .version
+                    then .broken_on = [{horizon: $health.horizon, code: $b.code}] else . end))' \
+              site/index.json > index.health.json
+            mv index.health.json site/index.json
+            jq -r '.projects[] | select(.versions[0].broken_on) | "\(.id) \(.versions[0].version): \(.versions[0].broken_on[0].code)"' site/index.json
+          fi
       - name: The site
         run: |
           cp -R icons site/icons
+          # Screenshots are served beside the icons: the index lists them at
+          # <site>screenshots/<id>/<name>.
+          if [ -d screenshots ]; then cp -R screenshots site/screenshots; fi
           cat > site/index.html <<'HTML'
           <!doctype html><meta charset="utf-8"><title>Horizon mods</title>
           <meta http-equiv="refresh" content="0; url=https://playhorizon.dev/mods">

.gitignore

@@ -1,3 +1,5 @@
 /files/
 /site/
 /bootstrap/
+/native/target/
+/native/*/target/

MOD-POLICY.md

@@ -0,0 +1,70 @@
+# Mod policy
+
+This registry lists mods, modpacks and packs for [Horizon](https://github.com/horizon-rust/horizon). This page says
+who makes them, who is responsible for them, and how to have one removed. By submitting to the registry you accept it.
+
+## Who makes the mods
+
+- **Mods made by the Horizon project** are marked **Official**: their author is "Horizon" and their source is in a
+  [horizon-rust](https://github.com/horizon-rust) repository. They are the only mods the Horizon
+  project makes and is responsible for.
+- **Every other mod is made, owned and maintained by its own authors**, named on its page. The Horizon project and
+  its maintainers are not their authors. They don't own these mods, sell them, or license them to you; each mod's
+  licence is the one its authors chose.
+- **A listing is not an endorsement.** Reviewers check that an entry is complete, that its files match their pinned
+  hashes, that it builds or loads against the Horizon version it names, and that nothing obviously harmful is in it.
+  That review is not a legal review, a security audit or a guarantee. Mods are provided as they are, without
+  warranty, by their authors.
+- **Native mods** (built into the game with [horizon-mixins](https://github.com/horizon-rust/horizon-mixins)) run
+  with the same access to your computer as the game. Install them only from authors you trust.
+
+## What authors promise when they submit
+
+Submitting a project, through the form or a pull request, means you confirm that:
+
+1. You made it, or you have the right to publish it, under the licence its entry names.
+2. **If it is a port or a translation of another mod** (for example from Java Edition), the original's licence allows
+   that, or its authors gave you permission. You keep the original's copyright and licence notices, and you credit
+   its authors and link the original on your page. A port of a mod whose licence reserves all rights needs its
+   authors' written permission.
+3. It contains no code, assets or data from Minecraft, Mojang or Microsoft beyond what their
+   [usage guidelines](https://www.minecraft.net/usage-guidelines) and EULA allow. Horizon players bring their own
+   copy of the game.
+4. It contains nothing that harms players: no malware, no stealing of accounts or data, no hidden network access.
+5. The `source` link has the code the published files were built from.
+
+You alone are responsible for what you publish and for any claim about it. The Horizon project may refuse, hide or
+remove any project, at any time, without having to give a reason.
+
+## Licences reviewers can read
+
+Reviewers read a project's source before each version is listed; that is how they check it holds nothing harmful.
+They may only read source under a licence that lets them, so a new project, and every new version of a listed one,
+needs source under one of:
+
+- MIT, MIT-0, BSD-2-Clause, BSD-3-Clause, 0BSD, Apache-2.0, ISC, zlib, Unlicense or CC0-1.0;
+- or any licence, with a written grant from its authors that lets the Horizon reviewers read the source to review it
+  (say so in the pull request, with a link to the grant).
+
+Source under GPL, LGPL, MPL or all rights reserved, without such a grant, can't be reviewed, so it can't be listed or
+updated. The projects already listed under other licences when this rule was written (classic_zoom,
+distant_horizons, fly_speed, serverify) stay listed as they are; their next version needs a licence above or a
+grant. A port also has to follow promise 2 above.
+
+## Copyright and takedowns
+
+If a project in this registry uses your work without your permission:
+
+- [Open a takedown request](../../issues/new?template=takedown.yml) (public), or
+- write privately to the maintainer through [lu4ovic.com](https://lu4ovic.com/#contact).
+
+Say which project, which of your work it uses, and how to reach you. A claim that holds gets the project removed and
+listed in [`revoked.toml`](revoked.toml): the registry stops listing it and the launcher stops offering it and turns
+installed copies off. Clear claims are acted on quickly. The project's author is told, and can answer the claim in the
+same issue.
+
+Authors whose project was removed by mistake can ask for it back in that issue.
+
+## Changes
+
+This policy can change. The version in this repository's `main` branch is the one that applies.

README.md

@@ -1,12 +1,26 @@
 # Horizon mods
 
-The registry of what is made for [Horizon](https://github.com/ludovic111/horizon): mods (`.hmod`), modpacks (`.hpack`)
+The registry of what is made for [Horizon](https://github.com/horizon-rust/horizon): mods (`.hmod`), modpacks (`.hpack`)
 and resource packs, each one reviewed before it is published. Browse them at
 [playhorizon.dev/mods](https://playhorizon.dev/mods) or in the launcher (Mods, then Horizon beside Modrinth).
 
 Players install from here through the launcher, which checks every file's SHA-256 and, when the author signs, its
-signature before the game sees it. Mods run in Horizon's sandbox, with no file, network or clock access, and can only
-do what their page lists.
+signature before the game sees it. Sandboxed `.hmod` mods run in Horizon's sandbox,
+with no file, network or clock access, and can only do what their page lists.
+
+Native source mods (`.hnmod`, kind `native-mod`) are built into an isolated game by
+a launcher with native-mod support. They run with the player’s account permissions.
+Their bundles pin the exact Horizon and Horizon Mixins revisions used for the build.
+Other revisions have not been validated. Registry checks inspect the source bundle and compile it
+on the newest Nightly with the most downloaded native mods (in a job whose token
+can only read) without running it; reviewers must also examine the source and
+pinned-build validation. Publishing these requires the native-mod changes to `cargo-horizon-mod`
+and the launcher to have shipped first.
+
+**Who is responsible.** Except the projects marked Official (made by the Horizon project), everything here is made and
+owned by its own authors, not by the Horizon project or its maintainers. A listing is not an endorsement. See the
+[mod policy](MOD-POLICY.md): what authors promise when they submit (ports of other mods included), the licences
+whose source reviewers can read, and how to have a project taken down.
 
 ## Submit
 
@@ -24,19 +38,21 @@ What the registry takes now: mods, modpacks of registry mods, and resource packs
 shader pack format is out (Iris and OptiFine packs are on Modrinth). Before you submit a mod, run what the checks run:
 
 ```sh
-cargo install --git https://github.com/ludovic111/horizon cargo-horizon-mod
+cargo install --git https://github.com/horizon-rust/horizon cargo-horizon-mod
 cargo horizon-mod check target/horizon-mod/my_mod.hmod
 ```
 
-**Updates** come the same way: the form adds a version to your entry. Only an entry's `owners` publish its updates
-without a reviewer's extra look. A published file never changes: publish a new version.
+**Updates** come the same way: the form adds a version to your entry, and a reviewer reads it before it is
+published. Only an entry's `owners` can add versions, and every version of a native mod is reviewed, owner or
+not: its code runs with the player's account permissions. A published file never changes: publish a new version.
 
 **Signing** is optional and recommended: put your [minisign](https://jedisct1.github.io/minisign/) public key in your
 entry, and every later version must be signed with it, so nobody else can publish an update in your name.
 
 ## Report
 
-Something wrong with a project? [Report it](../../issues/new?template=report.yml). A project that does harm is taken
+Something wrong with a project? [Report it](../../issues/new?template=report.yml). Your work published without your
+permission? [Ask for a takedown](../../issues/new?template=takedown.yml) ([mod policy](MOD-POLICY.md)). A project that does harm is taken
 down in [`revoked.toml`](revoked.toml): the launcher then refuses it and turns installed copies off, telling players
 why.
 
@@ -50,11 +66,33 @@ why.
 | `.github/workflows/check.yml` | A pull request's checks |
 | `.github/workflows/publish.yml` | On merge: releases, then `index.json` on Pages |
 | `.github/workflows/cleanup.yml` | Weekly: staging files nobody needs any more |
+| `.github/workflows/native-compat.yml` | Native mods on the newest Nightly, as the launcher builds them: a pull request's new version applied and compiled with the most downloaded native mods, its module names against every mod's; daily, every mod's newest version, the ones that don't apply marked `broken_on` in the index (`scripts/native_compat.py`) |
+| `.github/workflows/native.yml` | Horizon's native mods: each changed one's tests, `.hnmod` and game check, all of them together, and weekly on the newest Nightly |
+| `native/<name>/` | Horizon's own native mods (Zoom, FPS Counter, Keystrokes, Minimap, Recipes, Coordinates HUD): the source of their `.hnmod` files |
+| `native/tools/` | Shared by them: apply on Horizon, check, build, package, prove (`native/tools/native.py`) |
 | `scripts/` | What the workflows share |
 
 The format of the entries and of `index.json` is
-[docs/api/mod-index.md](https://github.com/ludovic111/horizon/blob/main/docs/api/mod-index.md) in Horizon's repository;
+[docs/api/mod-index.md](https://github.com/horizon-rust/horizon/blob/main/docs/api/mod-index.md) in Horizon's repository;
 the checks are `cargo horizon-mod check` and `cargo horizon-mod registry`, from Horizon at the commit in the
 repository variable `HORIZON_REV` (else `main`).
 
-The index: `https://ludovic111.github.io/horizon-mods/index.json`.
+The index: `https://horizon-rust.github.io/horizon-mods/index.json`.
+
+## Horizon's native mods
+
+`native/<name>/` holds the source of Horizon's official mods, as
+[horizon-mixins](https://github.com/horizon-rust/horizon-mixins) bundles on Horizon's native hook points
+([docs/native-mods.md](https://github.com/horizon-rust/horizon/blob/main/docs/native-mods.md)). Each folder keeps the
+history of the repository it came from. A mod builds on any Horizon whose hook points are at least the version its
+`compatibility.json` names; `horizon_revision` is the commit it was last tested on. `smp` and `voicechat-server`
+are server mods, built into the official server's engine (see their READMEs).
+
+```sh
+python3 native/tools/native.py check zoom          # apply on the tested Horizon and cargo check the game
+python3 native/tools/native.py check all           # every native mod together
+python3 native/tools/native.py package all         # native/target/<id>-<version>.hnmod, for a registry entry
+python3 native/tools/native.py proof zoom --resources /path/to/.local/horizon-client/26.3
+```
+
+To make your own, start from [horizon-native-mod-template](https://github.com/horizon-rust/horizon-native-mod-template).