Omusingi gw’okumanya / Wansi wa hood

Okukakasa okuzimba

Open source eyamba yokka singa code gy'oddukanya ye code eyali ebifulumiziddwa. Nymchat ezimbiddwa mu ngeri ya deterministically osobole okukebera ekyo ggwe kennyini, okuva munda mu... app oba okuva ku terminal.

Omuko guno guvvuunuddwa mu kyuma okusobola okugunguyira. Enkyusa y’Olungereza original y’enkyusa ekwata ku nsonga eno.

Ebizimbe ebiddamu okukolebwa

Okuzimba app kifulumya a build-manifest.json erimu ensibuko commit, a SHA-256 hash ya buli kintu kya HTML, JavaScript ne CSS ekiweereddwa, n'ekimu bundleHash ku ekyo kyonna eky’obugagga ekiteekeddwawo.

Ekifulumizibwa kisinziira ku birimu ensibuko byokka — n’obudde bw’okuzimba obuwandiikiddwa bwe bu commit's timestamp okusinga akaseera okuzimba we kwadduka — kale omuntu yenna okuddamu okuzimba kye kimu commit efuna fayiro ezifaanagana ne byte era ze zimu bundleHash.

A GitHub Action olwo eddaamu okuzimba buli commit nga yeetongodde era n'essa emikono ku build-provenance okukakasa kwa hash ne manifest, kale waliwo likodi eriko omukono esiba a bundleHash ku commit mu tterekero, ekoleddwa ekintu ekirala okuggyako okuteekebwa mu nkola.

Ekyo akasengejja Ebikwata ku kye kikebera

Ku mu mutwe eddukanya check live, mu browser yo.

Eddamu okuleeta buli kintu omuko gwe gukola mu butuufu, n’ekikola hash ne Web Crypto API, era ageraageranya n’ekyo ekyeyoleka. Olwo — era kino kye kitundu ekikulu — kyo addamu okubala ku... bundleHash okuva mu hashes kiri just calculated, so si okuva ekintu kyonna manifesito ky’egamba, era n’atunuulira ekyo mu bukakafu obw’etterekero obuteekeddwako omukono okuyita mu GitHub API.

Ekyo kye kiziyiza okuteekebwa mu nkola okwekakasa: okuweereza fayiro ezikyusiddwa wamu ne manifesito y'okukwatagana ekyalemererwa, kubanga hash ezzeemu okubalirirwa terina kukakasa.

Okukikakasa ggwe kennyini

Ddamu okuzimba commit the About dialog amannya era geraageranya:

git clone https://github.com/Spl0itable/NYM
cd NYM
git checkout <commit shown in the About dialog>
npm ci
npm run build   # prints "Build hash: <bundleHash>"

Hash efulumiziddwa erina okukwatagana n'eyo mu kasengejja Ebikwata ku n'eyo eri mu commit eyo okuzimba-ensibuko run mu bufunze. Osobola n'okukebera omukono butereevu ne GitHub CLI:

gh attestation verify dist/build-manifest.json --repo Spl0itable/NYM

Apps za Android ne iOS

Check waggulu ye web-app check, era ensonga esaana okulagibwa mu bulambulukufu: app enzaaliranwa tesobola kwekolera kintu kye kimu. Ekitambula ku ssimu yo ye compiled machine code, so si... ensibuko mu tterekero, era tewali kintu kyonna app ky’esobola kubalirira ku kyuma ekikwatagana n’ekimu ku ebirala.

Android esobola okukola ekintu ekiddako ekisinga obulungi. Abassibwawo .apk ye fayiro app gy’esobola okusoma ne hash, era hash ya buli kufulumizibwa efulumiziddwa eba ya lukale dda: okufulumya eri Zapstore assa omukono ku mukolo gwa Nostr ogutisse SHA-256 eya APK ne satifikeeti yaayo ey’okussa omukono eya SHA-256. Kale aba... Android Ku dialog hashes APK gy'eddukira, ereeta abo abassiddwako omukono ebibaddewo, akuuma ebyo byokka ebissiddwako omukono ekisumuluzo ky'omukozi, era n'egeraageranya. Kiraga ebibiri ebyo hashes nga bwe kiri, osobole okuddamu okukebera okuva ku kyuma: wanula APK efulumiziddwa, dduka sha256sum ku kyo, era ggwe kennyini otunuulire ekintu kye kimu.

App etekeddwa okuva ku Google Play tesobola kukeberebwa mu ngeri eno, kwaye ke ni ibala eyoko nkankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankankan

iOS tesobola kukeberebwa n’akatono. Apple ekwata ensirifu n’okuddamu okussa omukono ku buli lw’ewanula ssekinnoomu, kale hash ebalirirwa ku iPhone yo ya njawulo ku iPhone yo era tekwatagana na kintu kyonna efulumizibwa wonna. Enkolagana ya About kino kyogera butereevu okusinga okulaga okugumya status ekyo tekitegeeza kintu kyonna. Bwoba oyagala Nymchat gyosobola okukakasa ku Apple hardware, kozesa web app, ekola okukebera buli fayiro gy’ekola.

Ekiwandiiko ekiyitibwa warrant canary

Warrant canary ye kiwandiiko, ekifulumizibwa ku nteekateeka etakyukakyuka, omukugu gy’akola ky’alina -li bafunye ekiragiro kya gavumenti eky’ekyama kye bagaaniddwa okwogera — a Ebbaluwa y’ebyokwerinda mu ggwanga, ekiragiro kya FISA. Omukulaakulanya asobola okuwalirizibwa okusirika ku ekiragiro ng’ekyo, naye tekiyinza kuwalirizibwa kulimba, kale canary okugenda stale oba okubula bwe kiri yennyini akabonero.

Kibeera mu... canary.json ku kikolo ky'etterekero era nga kiggyibwa butereevu okuva ku GitHub, kale ebyafaayo byayo bibalirirwa awatali kufaayo ku kyonna omukutu ogussibwa mu nkola kye kyogera. Akasengejja Ebikwata ku langi-koodi kugikola:

Ennanga y’obuggya

Canary essiddwaako omukono eyingiza obuwanvu bwa Bitcoin block obusembyeyo ne hash mu kiseera ky’okussa omukono. Hash eyo teyaliyinza kumanyibwa nga block tennabaawo, ekikakasa nti canary yali yassa omukono oluvannyuma ekiseera ekigere okusinga okuteekebwako omukono mu bungi emyezi egiyise. Ensengeka ya About eyunga anchor ku block explorer osobole okugikebera.