Tushen ilimi Karkashin kaho

Tabbatar da ginin

Bude tushen kawai yana taimakawa idan lambar da kuke aiki ita ce lambar da ta kasance aka buga. Nymchat an gina shi da ƙayyadaddun ƙayyadaddun ƙayyadaddun bayanai don haka zaku iya bincika da kanku, daga ciki app ko daga tashar.

An fassara wannan shafin na inji don dacewa. Asalin Ingilishi shine sigar da ke aiki.

Gina mai maimaitawa

Gina app yana fitar da a build-manifest.json dauke da tushen aikatawa, a SHA-256 hash na kowane sabis na HTML, JavaScript da kadarar CSS, da guda ɗaya bundleHash a kan duk abin da aka saita kadari.

Fitarwa ya dogara ne kawai akan abun ciki na tushen - har ma da lokacin ginawa da aka yi rikodin shine aikata tambarin lokaci maimakon lokacin da ginin ya gudana - don haka kowa ya sake gina irin wannan aikata yana samun fayiloli iri ɗaya na byte da iri ɗaya bundleHash.

A GitHub Action sannan ya sake gina kowane alƙawarin kansa kuma yana nuna alamar haɓakawa shaida ga zanta da bayyanannen, don haka akwai sa hannun rikodin ɗaure a bundleHash zuwa aikata a cikin ma'ajiyar, samar da wani abu dabam dabam turawa.

Abin da Game da maganganu ke dubawa

Game da a cikin taken yana gudanar da cak ɗin kai tsaye, a cikin burauzar ku.

Maganar Nymchat Game da maganganu, nuna sigar, gina mutunci da garantin matsayin canary. — Maganar Game da Magana: sigar, gina mutunci, garantin canary da layin kai tsaye zuwa mai haɓakawa.

Yana sake kwato kowane kadari da shafin ke gudana a zahiri, yana hashes tare da API ɗin Crypto Yanar gizo, kuma kwatanta da bayyanuwar. Sa'an nan - kuma wannan shi ne bangaren da ke da mahimmanci - shi yana lissafin bundleHash daga hashes shi kawai lasafta, ba daga duk wani abu da bayyani ya yi iƙirari, kuma yana duban hakan a cikin sa hannun ma'ajiyar bayanan ta hanyar GitHub API.

Wannan shine abin da ke dakatar da turawa daga yin bayyani don kansa: ba da fayilolin da aka gyara tare da Har yanzu bayyani mai daidaitawa ta kasa, saboda zantan da aka ƙididdige ba shi da shaida.

Matsayi	Yana nufin
&duba; Tabbatar da aikace-aikacen hukuma (n/n)	Kowace kadara ta yi daidai, hash ɗin da aka sake ƙididdigewa an tabbatar da shi ta wurin ma'ajiya, kuma Ana ba da shafin daga yankin hukuma.
⚠ Tabbatar da gini · ba aikace-aikacen hukuma ba	Lambar gaskiya ce kuma ta tabbata, amma wannan madubi ne akan wani yanki. Mudubi ba zai iya cire wannan gargaɗin ba tare da gazawar tabbatarwa ba.
✗ Rashin daidaituwa	Kadara ba ta zamewa ga abin da bayyanar ta ce.
✗ Ginin da ba na hukuma ba	Hash ɗin da aka sake ƙididdigewa ba shi da wata shaida daga ma'ajiya - bayyanar da kanta.
⚠ Maganar da ba za a iya kaiwa ba	Ba a iya isa ga GitHub API ba, don haka ba za a iya bincika shaidar ta kowace hanya ba.

Tabbatar da kanku

Sake gina alƙawarin Game da sunaye kuma kwatanta:

git clone https://github.com/Spl0itable/NYM
cd NYM
git checkout <commit shown in the About dialog>
npm ci
npm run build   # prints "Build hash: <bundleHash>"

Hash ɗin da aka buga ya kamata ya dace da wanda ke cikin Game da maganganu da kuma wanda ke cikin wannan ƙaddamarwa gini-provenance run taƙaitaccen bayani. Hakanan zaka iya duba sa hannun kai tsaye tare da GitHub CLI:

gh attestation verify dist/build-manifest.json --repo Spl0itable/NYM

Android da iOS apps

Duban da ke sama bincike ne na aikace-aikacen yanar gizo, kuma dalilin yana da daraja a faɗi a sarari: ƙa'idar ƙasa ba zai iya yi wa kanta abu ɗaya ba. Abin da ke gudana akan wayarka an haɗa lambar injin, ba tushe a cikin ma'ajiya, kuma babu abin da app ɗin zai iya ƙididdigewa akan na'urar da ya danganci ɗaya da sauran.

Android na iya yin abu mafi kyau na gaba. An shigar .apk fayil ne da app zai iya karantawa da hash, kuma zaton kowane sakin da aka buga ya riga ya zama na jama'a: bugawa zuwa ga Zapstore alamar wani taron Nostr wanda ke ɗauke da SHA-256 na apk da SHA-256 ta takardar shaidar sa hannu. Don haka Android Game da dialog ya hashes da apk ɗin da yake gudana daga gare shi, yana ɗaukar waɗanda aka sanya hannu abubuwan da suka faru, suna kiyaye waɗanda maɓallin mai haɓaka ya sa hannu, kuma yana kwatanta. Ya nuna biyu hashes kuma, don haka zaku iya maimaita rajistan na'urar: zazzage apk da aka buga, gudu sha256sum a kai, kuma ku kalli wannan taron da kanku.

Ba za a iya duba ƙa'idar da aka shigar daga Google Play ta wannan hanyar ba, kuma wannan ba ne wani alama da wani abu ba ne. Google re-signs kowane upload tare da hankali da kuma ya gina wani musamman APK don kowane na'urorin, don haka abin da ya fara a kan wayoyinka ba shi ne fayil da masu ci gaba ya samar da da kuma haɗin haƙĩƙa ba tare da wani abu da za a iya buga. A app ya san wani Play install da ya ce shi fiye da ya gabatar da wani gabatarwa. Don duba wani build ku, shigar da APK da aka buga ta hanyar.

Ba za a iya bincika iOS kwata-kwata. Apple yana ɓoyewa kuma yana sake sanya alamar kowane zazzagewa akayi daban-daban, don haka zanta da aka lissafta akan iPhone ɗinku na musamman ne ga iPhone ɗinku kuma bai dace da komai ba buga a ko'ina. Maganar Game da magana ta faɗi wannan kai tsaye maimakon nuna ƙarfafawa matsayin da ke nufin komai. Idan kuna son Nymchat kuna iya tabbatarwa akan kayan aikin Apple, yi amfani da yanar gizo app, wanda ke bincika kowane fayil ɗin da yake gudana.

Abin da babu wannan ya tabbatar

Duba abin da app ke gudanar da kansa ba zai iya tabbatar da cewa app ɗin gaskiya ne - duk wanda ya gyara shi zai iya cire cak din shima. Abin da ya tabbatar shine al'amarin na yau da kullun: cewa kwafin ku shigar shine kwafin da aka buga. Wannan ya cancanci samun saboda ƙimarsa kwatancen jama'a ne, don haka wani wanda ba kai ba zai iya bincika su, kuma ya ƙi yarda.

Garanti canary

Canary garanti sanarwa ce, wacce aka buga akan ƙayyadadden jadawali, wanda mai haɓakawa yake da shi ba sun sami umarnin gwamnati na sirri an hana su bayyana - a Wasikar Tsaro ta Kasa, odar FISA. Ana iya tilasta mai haɓakawa ya yi shiru akai irin wannan odar, amma ba za a iya tilasta yin ƙarya ba, don haka canary ɗin da ke tsayawa ko ɓacewa shine kanta siginar.

Yana zaune a ciki canary.json a tushen ma'ajiyar kuma ana debo kai tsaye daga GitHub, don haka ana iya duba tarihin sa ba tare da duk abin da rukunin da aka tura ya ce ba. The Game da magana kalar-lambobin shi:

Launi	Yana nufin
Kore - duk bayyane	Sa hannu, halin yanzu, da sa hannu ya yi daidai da maɓalli na mai haɓakawa. Ba a karɓi odar sirri ba.
Yellow - dadewa, ko ba duka a bayyane ba	Ba a sabunta ta da kwanan wata da aka bayyana ba, ko ta `allClear` tuta karya ce. Ba za a iya kawar da odar shiru ba.
Ja - sa hannu mara inganci, ko tafi	Sa hannu bai yi daidai da maɓalli na mai haɓakawa ba, ko an cire fayil ɗin gaba ɗaya. Ɗauki wannan a matsayin gargaɗi mai tsanani.

The freshness anga

Canary ɗin da aka sanya hannu ya haɗa sabon tsayin toshe Bitcoin da zanta a lokacin sa hannu. Ba za a iya sanin wannan zance ba kafin katangar ta wanzu, wanda ya tabbatar da canary ya kasance sanya hannu bayan takamaiman batu a cikin lokaci maimakon an riga an sanya hannu a cikin mafi yawan watanni a baya. Maganar Game da Magana tana haɗa anka zuwa mai binciken toshe don ku iya duba ta.