Nheyo yezivo Pasi pehodhi

Kuongorora chigadzirwa

Vhura sosi inongobatsira chete kana kodhi yauri kuita iri iyo kodhi yaive rakabudiswa. Nymchat inovakwa deterministically saka unogona kutarisa kuti iwe pachako, kubva mukati app kana kubva kune terminal.

Peji ino yakaturikirwa nemuchina kuti zvirerukire. ChiRungu chepakutanga ndiyo shanduro inoshanda.

Reproducible anovaka

Kuvaka iyo app kunoburitsa a build-manifest.json ine source commite, a SHA-256 hashi yeese yakashandiswa HTML, JavaScript uye CSS asset, uye imwe chete bundleHash pamusoro peiyo asset yese.

Izvo zvinobuda zvinoenderana chete neiyo sosi yemukati - kunyangwe yakanyorwa nguva yekuvaka ndiyo commit's timestamp kwete nguva iyo kuvaka kwakatanga - saka chero munhu anovaka zvakafanana commit inowana ma-byte-akafanana mafaera uye zvakafanana bundleHash.

Chiito cheGitHub chinozovakazve chimwe nechimwe chakazvimirira uye chinoratidza kuvaka-provenance humbowo hwehashi uye manifest, saka kune rekodhi yakasainwa inosunga a bundleHash kune kuzvipira mune repository, yakagadzirwa nechimwe chinhu chisiri icho deployment.

Zvinotarisa nezve Dialog

About mumusoro unomhanyisa cheki live, mubrowser yako.

Iyo Nymchat Nezve dialog, inoratidza vhezheni, kuvaka kutendeseka uye waranti canary mamiriro. — The About dialog: vhezheni, kuvaka kutendeseka, warrant canary uye mutsara wakananga kumugadziri.

Iyo inotorazve imwe neimwe asset peji irikumhanya, hashes iyo neWeb Crypto API, uye enzanisa nemanifesiti. Zvino - uye ichi ndicho chikamu chakakosha - icho recomputes the bundleHash kubva kune hashe it kungoverengera, kwete kubva chero chinhu chinodaidzwa nemanifest, uye chinotarisa icho kumusoro muzvinyorwa zvakasainwa kuburikidza neGitHub API.

Ndizvo zvinomisa kutumirwa kubva pakuzvivharira pachako: kushumira mafaera akagadziridzwa pamwe chete ratidziro yekuenzanisa ichiri kutadza, nekuti iyo yakadzokororwa hashi haina humbowo.

Status	Means
&check; App yakasimbiswa yepamutemo (n/n)	Yese asset inowirirana, iyo recomputed bundle hashi inopupurirwa nerepository, uye iyo peji inopihwa kubva kune yepamutemo domain.
⚠ Yakasimbiswa kuvaka · kwete iyo yepamutemo app	Iyo kodhi ndeyechokwadi uye inopupurirwa, asi ichi chionioni pane imwe dura. Girazi harigone kubvisa yambiro iyi pasina kukundikana kutsigira.
✗ Mismatch	Asset haimhanyire kune zvinotaurwa nemanifest.
✗ Kuvaka zvisiri pamutemo	Iyo recomputed bundle hashi haina humbowo kubva kune repository - inozviratidza yega.
⚠ Maonero haasvikiki	Iyo GitHub API haina kukwanisa kusvikwa, saka humbowo hahuna kutariswa neimwe nzira.

Kuzvisimbisa iwe pachako

Vakazve kuzvipira iyo About dialog mazita uye enzanisa:

git clone https://github.com/Spl0itable/NYM
cd NYM
git checkout <commit shown in the About dialog>
npm ci
npm run build   # prints "Build hash: <bundleHash>"

Iyo yakadhindwa hashi inofanirwa kuenderana neiri iri muAbout dialog uye neiyo mune iyo dhizaini kuvaka-provenance run summary. Iwe unogona zvakare kutarisa siginecha zvakananga neGitHub CLI:

gh attestation verify dist/build-manifest.json --repo Spl0itable/NYM

Iyo Android uye iOS maapplication

Cheki iri pamusoro ndeyewebhu-app cheki, uye chikonzero chakakodzera kutaura pachena: app yemuno haigoni kuita chinhu chimwe chete pachezvayo. Izvo zvinomhanya pafoni yako zvakaunganidzwa muchina kodhi, kwete iyo tsime mune repository, uye hapana chinogona kuverengerwa neapp pachigadzirwa chine hukama kune zvimwe.

Android inogona kuita chinhu chinotevera chakanakisa. The yakaiswa .apk ifaira iro app inogona kuverenga uye hashi, uye hashi yekuburitswa kwega kwega yakaburitswa yatove pachena: kutsikisa kune Zapstore inosaina chiitiko cheNostr chakatakura APK's SHA-256 uye chitupa chekusaina cheSHA-256. Saka iyo Android About dialog hashes iyo APK yairi kumhanya kubva, inotora avo vakasaina zviitiko, inochengeta chete iyo yakasainwa nekiyi yemugadziri, uye inoenzanisa. Inoratidza maviri hashes zvakare, saka unogona kudzokorora cheki kubva mudziyo: dhawunirodha iyo yakaburitswa APK, mhanya sha256sum pairi, uye tarisa chiitiko chimwe chete iwe pachako.

App yakaiswa kubva kuGoogle Play haigone kutariswa nenzira iyi, uye izvi hazvisi chiratidzo chekuti pane zvakaipa. Google inozivisa patsva (re-signs) zvakadhakwa zvese nemuchina yayo yechitanda (key) uye inogadzira APK yakasiyana kumudziro wega wega, saka zvakazosvika mufoni yako hazvisi file yakagadzirwa nemuvambi weapp, uye hash yacho haifanani nechimwe chinhu chinogona kudururwa. App inoziva kuti yakaiswa kuburikidza nePlay uye inozviudza pane kuzivisa kuti yakundikana. Kuti uongorore build pachako, isa APK yakadururwa zvakananga.

iOS haigone kutariswa zvachose. Apple encrypts uye isainazve kurodha yega yega mumwe nemumwe, saka hashi yakaverengerwa pa iPhone yako yakasarudzika kune yako iPhone uye inofananidzira hapana rakabudiswa chero kupi zvako. The About dialog inotaura izvi pachena pane kuratidza kusimbisa chinzvimbo chisingarevi chinhu. Kana iwe uchida Nymchat iwe unogona kuona pane Apple hardware, shandisa iyo webhu app, iyo inoongorora mafaera ese ari kushanda.

Izvo hapana chimwe cheizvi chinoratidza

Cheki iyo app inozviitira pachayo haigone kuratidza kuti app ndeyechokwadi - chero akaigadzirisa aigona kubvisa cheki zvakare. Zvazvinoratidza inyaya yakajairika: kuti kopi iwe yakaiswa ndiyo kopi yakabudiswa. Izvozvo zvakakodzera kuva nazvo nokuti zvinokoshesa kuenzanisa kune veruzhinji, saka mumwe munhu asiri iwe unogona kuzvitarisa, uye kusabvumirana.

The warrant canary

Warrant canary chirevo, chakaburitswa pane yakatarwa chirongwa, icho mugadziri anacho kwete vakagamuchira chirevo chehurumende chakavanzika chavanorambidzwa kuburitsa - a Tsamba Yekuchengetedzwa Kwenyika, chirongwa cheFISA. Mugadziri anogona kumanikidzwa kugara akanyarara nezve hurongwa hwakadaro, asi haugone kumanikidzwa kunyepa, saka canary inoenda stale kana kunyangarika pachayo chiratidzo.

Inogara mukati canary.json pamudzi we repository uye inotorwa zvakananga kubva kuGitHub, saka nhoroondo yayo inoongororwa yakazvimiririra pane chero saiti yakatumirwa inotaura. Iyo About dialog color-code iyo:

Color	Means
Girinhi - zvose zvakajeka	Yakasainwa, yazvino, uye siginicha inoenderana nekiyi yemugadziri. Hapana murayiro wakavanzika wakagamuchirwa.
Yero - kunonoka, kana kwete zvese zvakajeka	Harina kumutsiridzwa nezuva raro rakataurwa, kana kuti raro `allClear` mureza ndewenhema. Kurongeka kwakanyarara hakugone kubviswa.
Tsvuku - siginicha isiriyo, kana yaenda	Siginicha haienderane nekiyi yemugadziri, kana kuti faira rabviswa zvachose. Bata izvi seyambiro yakakomba.

The freshness anchor

Iyo yakasainwa canary inonyudza yazvino Bitcoin block urefu uye hashi panguva yekusaina. Iyo hashi haigone kuzivikanwa chivharo chisati chavapo, izvo zvinoratidza kuti canary yaive dzakasaina pashure imwe nguva panguva kwete kufanosaina mumwedzi yakawanda yapfuura. Iyo About dialog inobatanidza anchor kune block explorer kuti iwe ugone kuitarisa.