Checking a mod before you install it
Anyone can copy a badge image, so here is what to check before you install the file underneath it.
Click the badge
A real badge is a link. Click it and you should land on https://backprobe.org/verify/ followed by the certificate number. If it does not click through, or it takes you anywhere else, you have learned nothing about the file.
The domain
The verification page has to be served from backprobe.org. Read the address bar yourself once the page has loaded.
Lookalike domains are the most common way this gets faked. We will never ask you to verify a certificate on a publisher's own site.
Compare the hash
This is the step that actually proves something. The verification page lists a SHA-256 for the exact file that was reviewed. Hash the file you downloaded and compare the two:
Windows certutil -hashfile yourmod.jar SHA256
macOS shasum -a 256 yourmod.jar
Linux sha256sum yourmod.jarIf the hashes differ, the file you have is not the file we reviewed, even where the certificate itself is genuine. Do not install it.
QR codes
The QR code on a certificate goes to that same verification page, so scan it with any camera app and watch where you land.
If a badge looks wrong
File a report. If a project is showing a badge with no certificate behind it, we want to know.
What the states mean
Reviewed and in good standing. Hash your download and compare it against the verification page before you install.
Reviewed, then lapsed.
Withdrawn, so the badge is no longer any reason to install this build.