How we source & verify server jars

Sources by server software

Generated live from the database. "Official" means the file is served by the project itself (or its own build server/maven/GitHub); "community mirror" means a third party hosts it.

How syncing works

• Every server type is re-read from its upstream API at least once an hour; Mojang's version list is checked every few minutes so new snapshots appear quickly.
• Only real changes are recorded: a new version or build appears in the public sync log, and the page's "last updated" date (and sitemap date) moves only then.
• Nothing is deleted when an upstream drops a version; the page stays for people who still need it.

Checksums

• Published by the upstream: SHA-256 from PaperMC (Paper, Folia, Velocity, Waterfall), GitHub release digests (Leaf, PocketMine-MP, PowerNukkitX), and the Forge, NeoForge and Quilt maven repositories; SHA-1 from Mojang (it is part of Mojang's download URL); MD5 from Purpur.
• Computed by MCJarHub: for files whose source publishes no checksum (community mirrors, the Fabric launcher) we download the file, compute SHA-256 and SHA-1, and label them "computed by MCJarHub".
• If a hash changes: a file must not change under the same name and URL. If an upstream or mirror reports a different checksum for a URL we already know, or a re-check downloads different bytes, the stored value is kept, the change is flagged for a human to review, and nothing is overwritten silently.

Why some files come from a mirror

Spigot and CraftBukkit are only distributed by SpigotMC as the BuildTools program (their pages show the BuildTools command first). BungeeCord, Leaves and several hybrids have no stable per-version download URL. For those we link mcjars.app — an open-source aggregator that hosts prepared builds — or GetBukkit, say so on the page, and show our own SHA-256 of the file. If you prefer, every such page links the official project too.