Cobble downloads

cobbled, the server runner

The whole product without a window. It builds a pack, boots the server, and tells you whether a player could actually join. It needs Java 21 and nothing else.

Using it

Unpack the archive for your platform and run the binary from a terminal. There is no installer and nothing is written outside the directory you point it at.

Build a world 
# macOS and Linux. Use the archive for your own platform.
tar -xzf cobbled-<target>.tar.gz
./cobbled search 1.21.1 fabric performance --oss
./cobbled build ./server 1.21.1 fabric @performance
./cobbled verify 127.0.0.1 25565 240
What verify answers 
# the verifier answers one question honestly: can a player join?
{"ok":true,"host":"127.0.0.1","port":25565,"ready_ms":4634,"motd":"cobble fabric fixture"}

A successful TCP connection is not proof. In this project's own measurements a dial succeeded at 0 ms on every run, while the server needed another 5 to 13 seconds before it could answer a ping. A verifier that trusts a dial reports success at the exact moment a player would be dropped. So verify waits for a real ping and reports the time that took.

Builds

loading release

  • Loading releases.

How your computer will treat these

Checking what this release publishes.

The evidence

These two commands were run against the macOS archive downloaded from the link above, not against a local build. This is their output.

Checked on the shipped file 
$ codesign -dv ./cobbled
Signature=adhoc
TeamIdentifier=not set

$ spctl -a -vv -t execute ./cobbled
./cobbled: rejected

Signature=adhoc means the binary carries a signature that identifies nobody. TeamIdentifier=not set means no developer account stands behind it. rejected is Gatekeeper's answer when you ask whether it would let the file run.

If you decide to run it anyway, the narrow way is to clear the quarantine flag on that one file, with xattr -d com.apple.quarantine ./cobbled. That applies to that file and nothing else. Do not turn Gatekeeper off for your whole machine to run a tool you got from a web page. That includes this one.

Checking what you downloaded

A .sha256 file sits beside each download at the same address. Add the suffix to the download URL to fetch it, then compare it against the file you have.

Compare the hash 
# macOS
shasum -a 256 cobbled-<target>.tar.gz

# Linux
sha256sum cobbled-<target>.tar.gz

# Windows PowerShell
Get-FileHash cobbled-x86_64-pc-windows-msvc.zip -Algorithm SHA256

A matching hash tells you the file arrived intact from the same place the list came from. It is not a signature and it is not a safety check. It cannot tell you anything about who built the file.