Maziko a chidziwitso Pansi pa hood

Kutsimikizira kumanga

Open source imangothandiza ngati code yomwe mukuyendetsa ndi code yomwe inali zosindikizidwa. Nymchat imamangidwa motsimikiza kuti mutha kudzifufuza nokha, kuchokera mkati app kapena kuchokera ku terminal.

Tsambali lamasuliridwa pamakina kuti zikhale zosavuta. Chingelezi choyambirira ndi chomwe chimagwira ntchito.

Zomanganso zobwereketsa

Kupanga pulogalamuyi kumatulutsa a build-manifest.json zomwe zili ndi source committ, a SHA-256 hashi pamtundu uliwonse wa HTML, JavaScript ndi CSS, ndi chimodzi bundleHash pa katundu yenseyo.

Zomwe zimatuluka zimangotengera zomwe zidachokera - ngakhale nthawi yojambulidwa yomangidwa ndiyo commit's timestamp m'malo mwa nthawi yomwe ntchitoyo idamangidwa - kotero aliyense amanganso zomwezo commit imapeza mafayilo ofanana ndi omwewo bundleHash.

GitHub Action ndiye imamanganso chilichonse chodziyimira payokha ndikuwonetsa umboni womanga maumboni a hashi ndi chiwonetsero, kotero pali mbiri yosainidwa yomangirira a bundleHash kudzipereka m'malo osungirako zinthu, opangidwa ndi china chake osati kutumiza.

Zomwe dialog ya About imayang'ana

Za pamutu amayendetsa cheke pompopompo, mu msakatuli wanu.

The Nymchat About dialog, kusonyeza Baibulo, pangani umphumphu ndi chilolezo canary status. — The About dialog: version, pangani kukhulupirika, warrant canary ndi mzere wachindunji kwa wopanga mapulogalamu.

Imatengeranso chilichonse chomwe tsamba likuyenda, limathamangitsa ndi Web Crypto API, ndi kufananiza motsutsana ndi chiwonetsero. Ndiye - ndipo ili ndi gawo lomwe likufunika - izi amawerengeranso za bundleHash kuchokera ku ma hashes izo kungowerengera, osati kuchokera chilichonse chomwe chikuwonekera, ndipo chimayang'ana muzotsimikizira zomwe zasainidwa kudzera pa GitHub API.

Izi ndi zomwe zimalepheretsa kutumizidwa kuti zisadziwonetsere zokha: kutumiza mafayilo osinthidwa pamodzi ndi chiwonetsero chofananira chikulepherabe, chifukwa hashi yobwerezedwayo ilibe umboni.

Mkhalidwe	Njira
&onani; Pulogalamu yovomerezeka yovomerezeka (n/n)	Chilichonse chimagwirizana, hashi yobwerezedwanso imatsimikiziridwa ndi malo, ndi tsamba limatumizidwa kuchokera kumalo ovomerezeka.
⚠ Kumanga kotsimikizika · osati pulogalamu yovomerezeka	Khodiyo ndi yowona komanso yotsimikiziridwa, koma ichi ndi galasi pamtundu wina. Kalilore sangathe kuchotsa chenjezoli popanda kutsimikizira kulephera.
✗ Zosiyanasiyana	Chuma sichimafulumira ku zomwe chiwonetserochi chikunena.
✗ Kumanga kosavomerezeka	Hashi yobwerezedwanso ilibe umboni kuchokera kumalo osungirako - kudziwonetsera nokha.
⚠ Zosatheka kuzipeza	GitHub API sinafikiridwe, chifukwa chake umboni sunayang'anitsidwe mwanjira iliyonse.

Kutsimikizira nokha

Manganinso mayina a zokambirana za About ndikuyerekeza:

git clone https://github.com/Spl0itable/NYM
cd NYM
git checkout <commit shown in the About dialog>
npm ci
npm run build   # prints "Build hash: <bundleHash>"

Hashi yosindikizidwa iyenera kufanana ndi yomwe ili mu dialog ya About ndi yomwe ili muzochitazo kumanga-provenance run mwachidule. Mutha kuyang'ananso siginecha mwachindunji ndi GitHub CLI:

gh attestation verify dist/build-manifest.json --repo Spl0itable/NYM

Mapulogalamu a Android ndi iOS

Chekeni pamwambapa ndi cheke cha pulogalamu yapaintaneti, ndipo chifukwa chake ndiyenera kunena momveka bwino: pulogalamu yachibadwidwe sangachite zomwezo kwa iwo okha. Zomwe zimayendera pafoni yanu ndi makina opangidwa ndi makina, osati gwero m'nkhokwe, ndipo palibe chomwe pulogalamuyo ingathe kuwerengera pa chipangizocho chokhudzana ndi chimodzi zina.

Android ikhoza kuchita bwino kwambiri. The anaika .apk ndi fayilo yomwe pulogalamuyi ingawerenge ndi hashi, ndi hashi ya kutulutsidwa kulikonse komwe kwasindikizidwa kuli kale pagulu: kusindikizidwa kwa Zapstore imasaina chochitika cha Nostr chonyamula SHA-256 ya APK ndi SHA-256 ya satifiketi yake yosayina. Choncho a Android Za dialog imathamangitsa APK yomwe ikuchokera, imatenga omwe asainidwa zochitika, zimangosunga zomwe zasainidwa ndi kiyi ya wopanga, ndikufanizira. Izo zikusonyeza awiri ma hashes komanso, kuti mutha kubwereza cheke pa chipangizocho: tsitsani APK yosindikizidwa, thamangani sha256sum pa izo, ndipo yang'anani pa chochitika chomwecho nokha.

Pulogalamu yokhazikitsidwa kuchokera ku Google Play siyingawunikidwe motere, ndipo zimenezo si chizindikiro chakuti pali chilichonse cholakwika. Google imasaina koyambiranso chilichonse chomwe chimatumizidwa pogwiritsa ntchito kiyi yake ndipo imapanga APK yosiyanasiyana kwa chida chilichonse, choncho chomwe chimafika pa foni yanu si fayilo yomwe wopanga pulogalamuyi anapanga ndipo hash yake si yogwirizana ndi chilichonse chomwe chingagawidwe. Pulogalamuyi imazindikira kuti yaimetsedwa kudzera ku Play ndipo imauza choncho m'malo motero kupereka lipoti la kulephera. Kuti mupimire pulogalamuyi nokha, imetsani APK yomwe idagawidwa mwachindunji.

iOS sangathe kufufuzidwa konse. Apple imabisa ndikusayinanso kutsitsa kulikonse payekha, kotero hashi computed pa iPhone wanu ndi wapadera iPhone wanu ndipo chikufanana kanthu zofalitsidwa paliponse. The About dialog ikunena izi momveka bwino m'malo mowonetsa zolimbikitsa udindo umene sutanthauza kanthu. Ngati mukufuna Nymchat mutha kutsimikizira pa hardware ya Apple, gwiritsani ntchito intaneti app, yomwe imayang'ana fayilo iliyonse yomwe ikuyenda.

Zomwe sizikutsimikizira izi

Cheke chomwe pulogalamu imadziyendera yokha sichingatsimikizire kuti pulogalamuyi ndi yowona - aliyense amene wayisintha akhoza kuchotsanso cheke. Chomwe chimatsimikizira ndi nkhani wamba: kuti ndikukopeni inu kuikidwa ndi kopi yomwe idasindikizidwa. Zimenezi n’zofunika chifukwa ndi zimene zimafunika zofananitsa ndi zapagulu, kotero wina kupatula inu mutha kuzifufuza, ndikutsutsa.

Chizindikiro cha canary

Warrant canary ndi mawu, osindikizidwa pa ndandanda yokhazikika, yomwe wopanga ali nayo ayi adalandira lamulo lachinsinsi la boma lomwe saloledwa kuwulula - a Kalata ya National Security, lamulo la FISA. Wopanga mapulogalamu akhoza kukakamizidwa kukhala chete dongosolo loterolo, koma silingakakamizidwe kunama, kotero kuti canary ikupita mochedwa kapena kutha palokha chizindikiro.

Amakhala mkati canary.json pa muzu wa chosungira ndipo amatengedwa mwachindunji kuchokera ku GitHub, kotero mbiri yake imawerengedwa mosadalira chilichonse chomwe tsamba lomwe latumizidwa likunena. The About dialog color-code:

Mtundu	Njira
Green - zonse zomveka	Zosaina, zamakono, ndi siginecha zimagwirizana ndi kiyi ya wopanga. Palibe lamulo lachinsinsi lomwe lalandiridwa.
Yellow - mochedwa, kapena zonse sizimveka bwino	Ilo silinatsitsimutsidwe ndi tsiku lake lotchulidwa, kapena lake `allClear` mbendera ndi zabodza. Lamulo loletsedwa silingathetsedwe.
Chofiira - siginecha yolakwika, kapena yapita	Siginecha siyikugwirizana ndi kiyi ya wopanga, kapena fayilo yachotsedwa kwathunthu. Chitani izi ngati chenjezo lalikulu.

Nangula watsopano

Canary yosainidwa imayika kutalika kwa block block ya Bitcoin ndi hashi panthawi yosayina. Hashi imeneyo sakanadziwika chipikacho chisanakhalepo, zomwe zimatsimikizira kuti canary inali anasaina pambuyo nthawi yeniyeni m'malo mosayina kale m'miyezi yambiri m'mbuyomo. The About dialog imalumikiza nangula ku block explorer kuti muwone.