kahua ʻike / Ma lalo o ka pāpale

Ke hōʻoia nei i ke kūkulu ʻana

Kōkua wale ke kumu wehe inā ʻo ke code āu e holo nei ʻo ia ke code i hana ʻia paʻi ʻia. Kūkulu ʻia ʻo Nymchat me ka deterministically no laila hiki iā ʻoe ke nānā iā ʻoe iho, mai loko o ka app a i ʻole mai kahi pahu.

Ua unuhi ʻia kēia ʻaoʻao no ka maʻalahi. ʻO ka ʻōlelo Pelekane ka mana e pili ana.

Hana hou ʻia

Ke kūkulu ʻana i ka app emit a build-manifest.json i loko o ke kumu commit, a SHA-256 hash o kēlā me kēia HTML lawelawe, JavaScript a me CSS waiwai, a me hoʻokahi bundleHash ma luna o kēlā hoʻonohonoho waiwai holoʻokoʻa.

Hoʻopili wale ka hopena i ka ʻike kumu - ʻo ka manawa kūkulu i hoʻopaʻa ʻia ʻo ia ka commit's timestamp ma mua o ka manawa i holo ai ke kūkulu - no laila ke kūkulu hou nei kekahi commit loaʻa nā faila like-byte a like bundleHash.

A laila kūkulu hou kahi hana GitHub i kēlā me kēia hana kūʻokoʻa a hōʻailona i ka build-provenance nā hōʻike no ka hash a me ka hōʻike, no laila aia kahi moʻolelo i hoʻopaʻa ʻia e hoʻopaʻa ʻia a bundleHash i kahi hana i loko o ka waihona, i hana ʻia e kekahi mea ʻē aʻe ma waho o ka hoʻokomo.

ʻO ka mea e nānā ʻia e ka About

E pili ana ma ke poʻomanaʻo e holo ka nānā ola, ma kāu polokalamu kele pūnaewele.

E kiʻi hou i kēlā me kēia waiwai e holo maoli ana ka ʻaoʻao, hashes me ka Web Crypto API, a hoʻohālikelike i ka hōʻike. A laila - a ʻo kēia ka mea nui - ʻo ia helu hou i ka bundleHash mai nā hashes ia helu wale, aole mai ʻO nā mea a pau i ʻōlelo ʻia, a nānā ʻia i loko o nā hōʻike i kau inoa ʻia e ka waihona ma o ka GitHub API.

ʻO ia ka mea e hoʻōki ai i ka waiho ʻana mai ka hōʻoia ʻana iā ia iho: lawelawe pū me nā faila i hoʻololi ʻia ʻAʻole paʻa ka hōʻike hoʻohālikelike, no ka mea, ʻaʻohe hōʻoia o ka hash i helu hou ʻia.

Ke hōʻoia nei iā ʻoe iho

E kūkulu hou i ka commit i nā inoa kamaʻilio About a hoʻohālikelike:

git clone https://github.com/Spl0itable/NYM
cd NYM
git checkout <commit shown in the About dialog>
npm ci
npm run build   # prints "Build hash: <bundleHash>"

Pono ka hash i pai ʻia me ka mea i loko o ke kamaʻilio About a me ka mea i loko o kēlā hana build-provenance run summary. Hiki iā ʻoe ke nānā pono i ka pūlima me ka GitHub CLI:

gh attestation verify dist/build-manifest.json --repo Spl0itable/NYM

ʻO nā polokalamu Android a me iOS

ʻO ka loiloi ma luna nei he loiloi pūnaewele-app, a ʻo ke kumu kūpono e haʻi maʻalahi: he app maoli ʻAʻole hiki ke hana like iā ia iho. ʻO ka mea e holo nei ma kāu kelepona i hōʻuluʻulu ʻia nā code mīkini, ʻaʻole ka kumu i loko o ka waihona, ʻaʻohe mea e hiki i ka app ke helu ma ka hāmeʻa e pili ana i kekahi i ka ʻē aʻe.

Hiki i ka Android ke hana i ka mea maikaʻi aʻe. ʻO ka mea i kau ʻia .apk he faila hiki ke heluhelu ʻia ka app a me ka hash, a me ka hash o kēlā me kēia hoʻopuka i paʻi ʻia i mua o ka lehulehu: hoʻolaha i ka Zapstore hōʻailona i kahi hanana Nostr e lawe ana i ka SHA-256 o APK a me kāna palapala hōʻailona SHA-256. No laila ka Android E pili ana ʻO ka dialog hashes i ka APK e holo mai ana, e kiʻi i ka poʻe i pūlima nā hanana, mālama wale i nā mea i kau inoa ʻia e ke kī o ka mea hoʻomohala, a hoʻohālikelike. Hōʻike ia i nā mea ʻelua hashes pū kekahi, no laila hiki iā ʻoe ke hana hou i ka nānā ʻana i ka hāmeʻa: hoʻoiho i ka APK i paʻi ʻia, holo sha256sum ma luna o ia mea, a nānā i ka hanana like ia oe iho.

ʻAʻole hiki ke nānā ʻia kahi polokalamu i hoʻokomo ʻia mai Google Play ma kēia ala, a ʻaʻole ia he hōʻike he he ka mea a pau. Ke hoʻohui hou nei ka Google i kēlā me kēia mea i hoʻouna ʻia me kona kī ponoʻī a ke hana nei i kahi APK ʻole ʻia no kēlā me kēia mea hana, no laila ʻaʻole ka faila i hana ʻia e ka mea kūkulu ka mea e loaʻa ana i kou kelekele, a ʻaʻole kūpono ka hash mau i kēlā me kēia mea e hiki ai ke hoʻolathalathia. Ke ʻike nei ka polokalamu i ka hoʻokemaka ʻia ʻana mai ka Play a e hōʻike ia, ma mua o ka hōʻike ʻana i ka hapa ʻia. No ka e nānā ai i kahi hana ʻoiaʻiʻo, hoʻokemaka i ka APK i hoʻolathalathia pololei ʻia.

ʻAʻole hiki ke nānā ʻia ʻo iOS. Hoʻopili a hōʻailona hou ʻo Apple i kēlā me kēia download no laila, ʻokoʻa ka hash i helu ʻia ma kāu iPhone i kāu iPhone a ʻaʻohe mea like paʻi ʻia ma nā wahi a pau. ʻO ke kamaʻilio About e ʻōlelo pololei i kēia ma mua o ka hōʻike ʻana i kahi hōʻoluʻolu kūlana he mea ʻole. Inā makemake ʻoe i kahi Nymchat hiki iā ʻoe ke hōʻoia ma ka ʻenehana Apple, e hoʻohana i ka pūnaewele app, nāna e nānā i kēlā me kēia faila e holo nei.

ʻO ka canary warrant

ʻO ka canary warrant he ʻōlelo ia, i paʻi ʻia ma kahi papa manawa paʻa, i loaʻa i ka mea hoʻomohala ʻaʻole ua loaa ke kauoha malu a ke aupuni, ua papaia lakou e hoike aku - a Leta Palekana Lahui, he kauoha FISA. Hiki ke koi ʻia ka mea hoʻomohala e noho mālie ʻO ia kauoha, akā ʻaʻole hiki ke koi ʻia e wahaheʻe, no laila ke hele a mae a nalo paha ka canary nona iho ka hoailona.

Noho ia ma canary.json ma ke kumu o ka waihona a kii pololei ia mai GitHub, no laila hiki ke hoʻopaʻa ʻia kona mōʻaukala i nā mea a ka pūnaewele i hoʻonohonoho ʻia. ʻO ka About dialog color-codes ia:

ʻO ka heleuma hou

Hoʻokomo ka canary i hoʻopaʻa ʻia i ka kiʻekiʻe o ka poloka Bitcoin hou loa a me ka hash i ka manawa o ke kau inoa ʻana. ʻAʻole hiki ke ʻike ʻia kēlā hash ma mua o ka noho ʻana o ka poloka, kahi e hōʻoiaʻiʻo ai ʻo ia ka canary kakauinoa mahope kahi kiko'ī i ka manawa ma mua o ke kau inoa mua ʻana i nā mahina nui ma mua. Hoʻopili ke kamaʻilio About i ka heleuma i kahi mea ʻimi poloka i hiki iā ʻoe ke nānā iā ia.