Hriatna (knowledge base) a ni / Hood hnuaiah chuan

Build chu verify a ni

Open source hian i code hman mek kha code awm tawh kha a nih chauhvin a pui thin tihchhuah a ni. Nymchat hi deterministically-a siam a nih avangin chu chu nangmah ngeiin i check thei a, chhung lam atang pawhin app emaw terminal atang emaw a ni thei.

He page hi awlsam zawk nan machine hmanga lehlin a ni. English original hi a hman dan tur version a ni.

Reproducible builds te pawh a awm

App siam hian a chhuah a build-manifest.json source commit awmna, a HTML, JavaScript leh CSS asset served zawng zawng SHA-256 hash, leh pakhat chauh bundleHash chu asset set zawng zawng chungah chuan.

Output chu source content-ah chauh a innghat — recorded build time pawh hi a ni build a kal lai aiin commit-a timestamp a hmang zawk — chuvangin tu pawhin chutiang bawka rebuilding chu commit hian byte-identical files a hmu a, chutiang bawk chu a ni bundleHash.

Chumi hnuah GitHub Action chuan commit tinte chu independent takin a siam thar leh a, build-provenance a sign bawk hash leh manifest atan attestations a awm a, chuvangin signed record tiing a a awm a bundleHash to a commit in the repository, thil dang atanga siam chhuah deployment a ni.

About dialog hian eng nge a check

Lam header ah chuan check live a run a, i browser ah.

Page-in a kal tak takna asset tin chu a re-fetch a, Web Crypto API hmangin a hash a,... manifest nen a khaikhin a ni. Tichuan — leh hei hi a pawimawh ber chu a ni — a ni a compute leh a bundleHash hashes atang hian chumi chhut chhuah mai mai, atanga ni lo manifest-in a sawi apiang chu, chu chu repository-a signed attestations-ah a zawng chhuak thin GitHub API hmangin a ni.

Chu chu deployment pakhatin a vouching a titawptu chu a ni: modified files te serving together with a matching manifest chu a la fail reng a, a chhan chu recomputed hash hian attestation a nei lo.

Nangmah ngeiin verify rawh

Commit the About dialog hmingte chu siam thar leh la, tehkhin rawh:

git clone https://github.com/Spl0itable/NYM
cd NYM
git checkout <commit shown in the About dialog>
npm ci
npm run build   # prints "Build hash: <bundleHash>"

Printed hash chu About dialog-a awm leh chu commit-a awm nen a inmil vek tur a ni build-provenance run chungchang hi a tawi zawngin. GitHub CLI hmang hian signature chu direct-in i check thei bawk:

gh attestation verify dist/build-manifest.json --repo Spl0itable/NYM

Android leh iOS apps te hi a ni

A chunga check kan tarlan hi web-app check a ni a, a chhan pawh chiang taka sawi theih a ni: native app a chungah pawh chutiang bawk chu a ti thei lo. I phone-a kal chu compiled machine code a ni a, a... source chu repository-ah a awm a, device-a app-in a compute theih engmah hian pakhat chu a inzawm lo mi dangte chu.

Android hian a dawt leh tur tha ber a ti thei. A install tawh .apk tih hi app hian a chhiar theih file a ni leh hash te, leh release chhuah apiang hash chu public a ni tawh: publishing to the Zapstore APK-a SHA-256 leh a signing certificate-a SHA-256 kengin Nostr event-ah a sign. Chuvangin a Android-ah a awm a Lam dialog hian a kalna APK chu a hash a, signed te chu a la chhuak thin events, developer key-in a sign te chauh a vawng a, a khaikhin bawk. A pahnih chu a entir a ni hashes pawh a awm a, chuvangin device atanga check off kha i repeat leh thei ang: published APK download la, run sha256sum a chungah la, chu thilthleng chu nangmah ngei pawhin en rawh.

Google Play atanga app install chu hetiang hian check theih a ni loगूगल प्रत्येक अपलोड के अपनी कुंजी के साथ फिर से साइन करता है और प्रत्येक उपकरण के लिए एक अलग APK बनाता है, इसलिए आपके फोन पर जो आता है वह डेवलपर द्वारा बनाई गई फ़ाइल नहीं है और इसका हैश प्रकाशित किए जा सकने वाले किसी भी चीज़ से मेल नहीं खाता है। ऐप एक प्ले इंस्टॉल को पहचानता है और विफलता की रिपोर्ट करने के बजाय ऐसा कहता है। खुद एक बिल्ड की जांच करने के लिए, सीधे प्रकाशित APK इंस्टॉल करें।

iOS hi check theih a ni lo tak zet a ni. Apple hian download apiang encrypt leh re-sign thin mimal takin, chuvangin i iPhone-a hash computed chu i iPhone tan chauh a ni a, engmah a inmil lo khawi hmunah pawh tihchhuah a ni. About dialog hian he thu hi a sawi chiang zawk a, thlamuanthlak tak a lantir lo status awmzia nei lo. Apple hardware-a verify theih Nymchat i duh chuan web hmang rawh app, a file kal zawng zawng a check vek thin.

A warrant canary a ni

Warrant canary chu thuchhuah, schedule ruat sa anga tihchhuah, developer-in a neih a ni lo sorkar thupek thup an dawng a, an puan khap a ni — a National Security Letter, FISA thupek a ni. Developer chu ngawi reng turin nawr theih a ni chutiang thupek chu, mahse dawt sawi tura nawr luih theih a ni lo va, chuvangin canary going stale or disappearing chu a ni amah ngei pawh signal a ni.

A nung a ni canary.json repository root-ah a awm a, direct-a lak chhuah a ni GitHub atanga lo chhuak a nih avangin a history hi deployed site-in a sawi apiang atanga innghat lovin audit theih a ni. About dialog hian a color-code a:

A freshness anchor chu a rawn lang ta

Signed canary hian a sign lai hian Bitcoin block height leh hash thar ber a embed a ni. Chu hash chu block awm hma khan hriat theih a ni lo a, hei hian canary chu a nihzia a tilang chiang hle sign a ni hnuah thla tam tak hmaa bulk-a pre-signed ai chuan point in time bik a ni. About dialog hian anchor chu block explorer nen a link a, chuvang chuan i check thei ang.