Fix OutOfBoundsException when parsing a single letter path component

packwiz-installer-bootstrap relies on reading the manifest; breaking this means the update will run on every launch!

build.gradle.kts

@@ -22,7 +22,7 @@ repositories {
 }
 
 val r8 by configurations.creating
-val shrinkJarOutput by configurations.creating {
+val distJarOutput by configurations.creating {
 	isCanBeResolved = false
 	isCanBeConsumed = true
 
@@ -104,15 +104,27 @@ val shrinkJar by tasks.registering(JavaExec::class) {
 	)
 }
 
+// MANIFEST.MF must be one of the first 2 entries in the zip for JarInputStream to see it
+// Gradle's JAR creation handles this whereas R8 doesn't, so the dist JAR is repacked
+val distJar by tasks.registering(Jar::class) {
+	from(shrinkJar.map { zipTree(it.outputs.files.singleFile) })
+	archiveClassifier.set("all-repacked")
+	manifest {
+		from(shrinkJar.map { zipTree(it.outputs.files.singleFile).matching {
+			include("META-INF/MANIFEST.MF")
+		}.singleFile })
+	}
+}
+
 artifacts {
-	add("shrinkJarOutput", shrinkJar) {
+	add("distJarOutput", distJar) {
 		classifier = "dist"
 	}
 }
 
 // Used for vscode launch.json
 val copyJar by tasks.registering(Copy::class) {
-	from(shrinkJar)
+	from(distJar)
 	rename("packwiz-installer-(.*)\\.jar", "packwiz-installer.jar")
 	into(layout.buildDirectory.dir("dist"))
 	outputs.file(layout.buildDirectory.dir("dist").map { it.file("packwiz-installer.jar") })
@@ -130,12 +142,11 @@ githubRelease {
 	draft(true)
 	token(findProperty("github.token") as String?)
 	releaseAssets(layout.buildDirectory.dir("dist").map { it.file("packwiz-installer.jar") }.get())
-	dryRun(project.findProperty("release") != "true")
 }
 
 tasks.githubRelease {
 	dependsOn(copyJar)
-	enabled = project.hasProperty("github.token")
+	enabled = project.hasProperty("github.token") && project.findProperty("release") == "true"
 }
 
 tasks.publish {
@@ -156,7 +167,7 @@ tasks.compileTestKotlin {
 }
 
 val javaComponent = components["java"] as AdhocComponentWithVariants
-javaComponent.addVariantsFromConfiguration(shrinkJarOutput) {
+javaComponent.addVariantsFromConfiguration(distJarOutput) {
 	mapToMavenScope("runtime")
 	mapToOptional()
 }

src/main/kotlin/link/infra/packwiz/installer/LauncherUtils.kt

@@ -50,7 +50,20 @@ class LauncherUtils internal constructor(private val opts: UpdateManager.Options
 			"net.minecraftforge" to "forge",
 			"net.fabricmc.fabric-loader" to "fabric",
 			"org.quiltmc.quilt-loader" to "quilt",
-			"com.mumfrey.liteloader" to "liteloader")
+			"com.mumfrey.liteloader" to "liteloader"
+		)
+		// MultiMC requires components to be sorted; this is defined in the MultiMC meta repo, but they seem to
+		// be the same for every version so they are just used directly here
+		val componentOrders = mapOf(
+			"net.minecraft" to -2,
+			"org.lwjgl" to -1,
+			"org.lwjgl3" to -1,
+			"net.minecraftforge" to 5,
+			"net.fabricmc.fabric-loader" to 10,
+			"org.quiltmc.quilt-loader" to 10,
+			"com.mumfrey.liteloader" to 10,
+			"net.fabricmc.intermediary" to 11
+		)
 		val modLoadersClasses = modLoaders.entries.associate{(k,v)-> v to k}
 		val loaderVersionsFound = HashMap<String, String?>()
 		val outdatedLoaders = mutableSetOf<String>()
@@ -92,6 +105,15 @@ class LauncherUtils internal constructor(private val opts: UpdateManager.Options
 		}
 
 		if (manifestModified) {
+			// Sort manifest by component order
+			val sortedComponents = components.sortedWith(nullsLast(compareBy {
+				if (it.isJsonObject) {
+					componentOrders[it.asJsonObject["uid"]?.asString]
+				} else { null }
+			}))
+			components.removeAll { true }
+			sortedComponents.forEach { components.add(it) }
+
 			// The manifest has been modified, so before saving it we'll ask the user
 			// if they wanna update it, continue without updating it, or exit
 			val oldVers = loaderVersionsFound.map { Pair(it.key, it.value) }

src/main/kotlin/link/infra/packwiz/installer/target/path/PackwizPath.kt

@@ -43,9 +43,11 @@ abstract class PackwizPath<T: PackwizPath<T>>(path: String? = null) {
 				} else {
 					canonicalised += componentNorm
 					// Don't allow volume letters (allows traversal to the root on Windows)
-					if (componentNorm[0] in 'a'..'z' || componentNorm[0] in 'A'..'Z') {
-						if (componentNorm[1] == ':') {
-							throw RequestException.Validation.PathContainsVolumeLetter(path)
+					if (componentNorm.length == 2) {
+						if (componentNorm[0] in 'a'..'z' || componentNorm[0] in 'A'..'Z') {
+							if (componentNorm[1] == ':') {
+								throw RequestException.Validation.PathContainsVolumeLetter(path)
+							}
 						}
 					}
 				}