Okubelelwe elwazini / Ngaphantsi kwe-hood

Ukuqinisekisa ulwakhiwo

Umthombo ovulekileyo unceda kuphela ukuba ikhowudi oyisebenzisayo yikhowudi ebiyiyo ipapashiwe. I-Nymchat yakhiwe ngokuzimisela ukuze ukwazi ukujonga ngokwakho, ngaphakathi app okanye kwi-terminal.

Eli phepha liguqulelwe ngoomatshini ukuze kube lula. Uqobo lwesiNgesi yinguqulelo esebenzayo.

Ukwakhiwa kwakhona

Ukwakha i-app kukhupha a build-manifest.json equlathe umthombo wokuzibophelela, a I-SHA-256 hash yayo yonke i-HTML esetyenziswayo, i-JavaScript kunye ne-asethi ye-CSS, kunye nenye bundleHash phezu kwayo yonke loo seti ye-asethi.

Imveliso ixhomekeke kuphela kumxholo womthombo - kwanexesha lokwakha elirekhodiweyo lelo isitampu sexesha lokuzibophelela endaweni yokuqalisa ukwakha - ke nabani na owakha okufanayo I-commit ifumana iifayile ezifanayo ze-byte kwaye ziyafana bundleHash.

Isenzo seGitHub emva koko sakha kwakhona ukuzibophelela ngamnye ngokuzimeleyo kwaye sisayine ubungqina bokwakha ubungqina be-hash kunye ne-manifest, ngoko kukho irekhodi esayiniweyo edibanisa a bundleHash ukuzinikela kwindawo yokugcina, eveliswe yenye into ngaphandle kwe ukusasazwa.

Yintoni ejongwa malunga nencoko yababini

Malunga kwiheda iqhuba itshekhi bukhoma, kwibhrawuza yakho.

Iphinda ithathe i-asethi nganye iphepha elisebenza ngokwenene, likhawuleza nge-Web Crypto API, kunye ithelekisa ngokuchasene nomboniso. Emva koko-kwaye le yinxalenye ebalulekileyo-yona ibuyisela i bundleHash ukusuka kwi-hashes yona kubalwe nje, hayi ukusuka nayiphi na into efunwa yi-manifest, kwaye ijonge loo nto kwindawo yokugcina ubungqina obusayiniweyo ngeGitHub API.

Yiloo nto ethintela ukusasazwa ekuziqinisekiseni ngokwayo: ukukhonza iifayile ezilungisiweyo kunye i-manifest ehambelanayo isasilela, kuba i-hash ebaliweyo ayinabungqina.

Ukuqinisekisa ngokwakho

Yakha kwakhona isibophelelo malunga namagama encoko yababini kwaye uthelekise:

git clone https://github.com/Spl0itable/NYM
cd NYM
git checkout <commit shown in the About dialog>
npm ci
npm run build   # prints "Build hash: <bundleHash>"

I-hash eprintiweyo kufuneka itshatise zombini enye ekwincoko yababini emalunga naleyo ikwizibophelelo ukwakha-provenance run summary. Unokujonga kwakhona utyikityo ngqo ngeGitHub CLI:

gh attestation verify dist/build-manifest.json --repo Spl0itable/NYM

Iiapps ze-Android kunye ne-iOS

Itshekhi engasentla lukhangelo lwe-web-app, kwaye isizathu sifanelekile ukuba sichaze ngokucacileyo: usetyenziso lwemveli ayinakuyenza into enye ngokwayo. Into esebenza kwifowuni yakho iqulunqwe ikhowudi yomatshini, hayi umthombo kwindawo yokugcina, kwaye akukho nto i-app inokuthi idibanise kwisixhobo inxulumene enye enye.

I-Android inokwenza into elandelayo engcono. Ifakiwe .apk yifayile enokuthi ifundwe yi-app kunye ne-hash, kunye ne-hash yalo lonke ukhupho olupapashiweyo sele luluntu: upapasho kwi Zapstore ityikitya umsitho we-Nostr ophethe i-APK ye-SHA-256 kunye nesatifikethi sayo sokusayina i-SHA-256. Ngoko ke Android Malunga Incoko yababini ikhawuleza i-APK esebenza kuyo, ilanda ezo zisayiniweyo iziganeko, igcina kuphela ezo zisayinwe sisitshixo somphuhlisi, kwaye ithelekisa. Ibonisa zombini i-hashes ngokunjalo, ukuze ukwazi ukuphinda ukukhangela kwisixhobo: khuphela i-APK epapashiweyo, sebenzisa sha256sum kuyo, kwaye ujonge isiganeko esifanayo ngokwakho.

Usetyenziso olufakwe kuDlalo lukaGoogle alunakujongwa ngolu hlobo, yaye ke ayinxalenye ukuba nayiphi na into ingxakiweyo. I-Google inqakraza yonke ukulayishwa kunye nenkceda yayo yayo kwaye ibekwe i-APK eyahlukileyo kumadivayisi omnye, ngoko oku kutshintshe kwi-telephone yakho ayikho ifayile owenziwe ngu-developer kwaye i-hash yayo inqakraza nayiphi na into eyenziwa. I-app ibekwe i-Play install kwaye inqakraza ngoko kunokuba ibekwe inkcazelo. Ukuze ufake i-build wena, ufake i-APK ebekwe ngqo.

I-iOS ayinakujongwa kwaphela. I-Apple ifihla kwaye isayine kwakhona ukhuphelo ngalunye ngabanye, ngoko i-hash ekhompyutheni kwi-iPhone yakho yahlukile kwi-iPhone yakho kwaye ihambelana nantoni na ipapashwe naphi na. Incoko yababini emalunga nencoko ithetha oku ngokuthe ngqo kunokuba ibonise uqinisekiso isimo esithetha nto. Ukuba ufuna iNymchat ungaqinisekisa kwihardware yeApple, sebenzisa iwebhu app, ejonga yonke ifayile esebenzayo.

Iwarrant canary

I-warrant canary yingxelo, epapashwe kwishedyuli esisigxina, ukuba umphuhlisi unalo hayi wafumana umyalelo karhulumente oyimfihlo abavumelekanga ukuba baveze - a Ileta yoKhuseleko lweSizwe, umyalelo weFISA. Umphuhlisi unokunyanzeliswa ukuba ahlale ethule malunga Umyalelo onjalo, kodwa awunakunyanzelwa ukuba uxoke, ngoko ke i-canary iya kudala okanye iyanyamalala ngokwayo uphawu.

Ihlala ngaphakathi canary.json kwingcambu yendawo yokugcina kwaye ilandwa ngokuthe ngqo ukusuka kwi-GitHub, ngoko ke imbali yayo iyaphicothwa ngokuzimeleyo nokuba yintoni na indawo esetyenzisiweyo ithi. Umbala wencoko yababini uyikhowudi:

I-ankile entsha

I-canary esayiniweyo ifaka ubude bebhloko yeBitcoin yamva nje kunye ne-hash ngexesha lokusayina. Loo hashi yayingenakukwaziwa ngaphambi kokuba ibhloko ikhona, ebonisa ukuba i-canary yayiyiyo isayiniwe emva indawo ethile ngexesha kunokuba isayinwe kwangaphambili kwiinyanga ezininzi ngaphambili. Incoko yababini emalunga ne-ankile idibanisa umhloli webhloko ukuze ukwazi ukuyijonga.