Isisekelo solwazi / Ngaphansi kwesigqoko

Ukuqinisekisa isakhiwo

Umthombo ovulekile usiza kuphela uma ikhodi oyisebenzisayo kuyikhodi ebikade ikhona eshicilelwe. I-Nymchat yakhiwe ngokunqunywa ukuze ukwazi ukuzihlolela ngokwakho, ngaphakathi uhlelo lokusebenza noma kutheminali.

Leli khasi lihunyushwe ngomshini ukuze kube lula. IsiNgisi sangempela inguqulo esebenzayo.

Ukwakhiwa kabusha

Ukwakha uhlelo lokusebenza kukhipha a build-manifest.json equkethe ukuzibophezela komthombo, a I-SHA-256 hash yayo yonke i-HTML enikeziwe, i-JavaScript ne-CSS, kanye neyodwa bundleHash phezu kwaleyo mpahla yonke.

Okukhiphayo kuncike kuphela kokuqukethwe komthombo - ngisho nesikhathi sokwakha esirekhodiwe yisona isitembu sesikhathi sika-commit kunesikhathi okwaqala ngaso ukwakha - ngakho-ke noma ubani owakha kabusha okufanayo commit ithola amafayela afanayo nge-byte futhi okufanayo bundleHash.

Isenzo se-GitHub sibe sesiphinda sakha kabusha ukuzibophezela ngakunye ngokuzimela futhi sisayine ubufakazi bokwakha ubufakazi be-hashi ne-manifest, ngakho-ke kukhona irekhodi esayiniwe elihlanganisa a bundleHash ukuzibophezela endaweni yokugcina, ekhiqizwe enye into ngaphandle kwe- ukuthunyelwa.

Okuhlolwayo ibhokisi elithi Mayelana

Mayelana kunhlokweni kuqhuba isheke bukhoma, esipheqululini sakho.

Iphinda ilande impahla ngayinye ikhasi elisebenza ngayo, isheshise nge-Web Crypto API, kanye kuqhathaniswa ne-manifest. Bese - futhi lena yingxenye ebalulekile - yona ubala kabusha i bundleHash kusukela emahhashi yona kubalwe nje, hhayi kusukela noma yini efunwa yi-manifest, futhi ibheka lokho kubufakazi obusayiniwe benqolobane ngokusebenzisa i-GitHub API.

Yilokho okuvimba ukuthunyelwa ekuziqinisekiseni ngokwako: ukusebenzisa amafayela aguquliwe kanye i-manifest efanayo isahluleka, ngoba i-hash eyenziwe kabusha ayinabo ubufakazi.

Ukuziqinisekisa ngokwakho

Yakha kabusha amagama engxoxo ye-About bese uqhathanisa:

git clone https://github.com/Spl0itable/NYM
cd NYM
git checkout <commit shown in the About dialog>
npm ci
npm run build   # prints "Build hash: <bundleHash>"

I-hashi ephrintiwe kufanele ifane kokubili okukungxoxo ye-About kanye naleyo ekuleso sibopho ukwakha-provenance run summary. Ungabheka futhi isiginesha ngqo nge-GitHub CLI:

gh attestation verify dist/build-manifest.json --repo Spl0itable/NYM

Izinhlelo zokusebenza ze-Android ne-iOS

Isheke elingenhla ukuhlola uhlelo lokusebenza lwewebhu, futhi isizathu kufanele sishiwo ngokusobala: uhlelo lokusebenza lwendabuko ayikwazi ukwenza into efanayo ngokwayo. Okusebenza ocingweni lwakho kuhlanganiswe ikhodi yomshini, hhayi i umthombo endaweni yokugcina, futhi akukho lutho uhlelo lokusebenza olungaluhlanganisa kudivayisi oluhlobene nokukodwa okunye.

I-Android ingenza into elandelayo engcono kakhulu. Okufakiwe .apk yifayela uhlelo lokusebenza olungafundwa kanye ne-hash, kanye ne-hash yakho konke ukukhishwa okushicilelwe isivele isesidlangalaleni: ukushicilelwa ku- Zapstore isayina umcimbi we-Nostr ophethe i-SHA-256 ye-APK kanye nesitifiketi sayo sokusayina i-SHA-256. Ngakho i Android Mayelana Ingxoxo isheshisa i-APK eqalisa kuyo, ilanda labo abasayiniwe imicimbi, igcina kuphela leyo esayinwe ukhiye wonjiniyela, futhi iqhathaniswe. Ibonisa kokubili namahashi, ukuze ukwazi ukuphinda ukuhlola idivayisi: landa i-APK eshicilelwe, sebenzisa sha256sum kuyo, futhi ubheke umcimbi ofanayo nawe.

Uhlelo lokusebenza olufakwe ku-Google Play alikwazi ukubhekwa ngale ndlela, futhi lokhu akuyona umzekelo ukuthi yini akuyona. I-Google re-ukubhalisa yonke ukulayishwa nge-key yayo yayo yakhelwe i-APK eyahlukile kumadivayisi ngalinye, ngakho-ke okuholela ku-smartphone yakho akuyona ifayela we-developer eyenziwe futhi i-hash yayo akuyona noma iyiphi na. I-app ibonise ukulayishwa kwe-Play futhi ibonise ngakho-ke kuncike ukuphazamiseka. Ukuhlola ukulayisha wena, ukulayisha i-APK eyenziwe ngqo.

I-iOS ayikwazi ukubhekwa nhlobo. I-Apple ibhala ngemfihlo futhi isayinde kabusha ukulanda ngakunye ngabanye, ngakho-ke i-hashi ekhompuyutha ku-iPhone yakho ihlukile ku-iPhone yakho futhi ayifani nalutho ishicilelwe noma yikuphi. Ibhokisi le-About lisho lokhu ngokuqondile esikhundleni sokubonisa okuqinisekisayo isimo esingasho lutho. Uma ufuna i-Nymchat ongayiqinisekisa ku-Apple hardware, sebenzisa iwebhu app, ehlola wonke amafayela asebenzayo.

I-warrant canary

I-warrant canary yisitatimende, esishicilelwe ohlelweni olumisiwe, unjiniyela analo hhayi bathole umyalelo kahulumeni oyimfihlo abanqatshelwe ukudalula - a Incwadi Yezokuphepha Kazwelonke, i-oda le-FISA. Umthuthukisi angaphoqeleka ukuthi athule mayelana umyalo onjalo, kodwa awukwazi ukuphoqelelwa ukuba uqambe amanga, ngakho-ke i-canary idala noma inyamalala ngokwayo isignali.

Ihlala phakathi canary.json empandeni yenqolobane futhi ilandwa ngokuqondile kusuka ku-GitHub, ngakho-ke umlando wayo ungacwaningwa ngokuzimela kunoma yini eshiwo isiza esisetshenzisiwe. Ibhokisi lengxoxo elimayelana nombala liyayibhala:

Ihange elisha

I-canary esayiniwe ishumeka ukuphakama kwebhulokhi ye-Bitcoin yakamuva kanye ne-hashi ngesikhathi sokusayina. Leyo hashi yayingeke yaziwe ngaphambi kokuba kube khona ibhulokhi, okufakazela ukuthi i-canary yayikhona kusayiniwe ngemva iphoyinti elithile ngesikhathi kunokuba usayine kusengaphambili ngenqwaba ezinyangeni ngaphambili. Ibhokisi elithi Mayelana lixhumanisa ihange kusihloli esivimbayo ukuze usihlole.