Nimdeɛ a wɔde gyina so / Wɔ hood no ase

Sɛ́ wobɛhwɛ sɛ ɔdansi no yɛ nokware

Open source boa sɛ code a woreyɛ no yɛ code a na ɛwɔ hɔ no nkutoo a a wotintimii. Wɔasi Nymchat deterministically sɛnea ɛbɛyɛ a wubetumi ahwɛ sɛ w’ankasa, afi mu app anaasɛ efi terminal bi so.

Wɔde mfiri na ɛkyerɛ krataafa yi ase sɛnea ɛbɛyɛ a ɛbɛyɛ mmerɛw. Engiresi kasa mu mfitiase de no ne nkyerɛase a ɛfa ho.

Nneɛma a wotumi san yɛ bio

Sɛ wokyekye app no ​​a, ɛma a build-manifest.json a ɛwɔ source commit no mu, a SHA-256 hash a ɛwɔ HTML, JavaScript ne CSS agyapade biara a wɔsom, ne biako bundleHash wɔ saa agyapade a wɔahyehyɛ no nyinaa so.

Output no gyina source content no nkutoo so — mpo recorded build time no ne commit's timestamp mmom sen bere a ɔdan no tuu mmirika — enti obiara a ɔresan asi saa ara commit nya fael a ɛne baiti yɛ pɛ ne nea ɛte saa ara bundleHash.

Afei GitHub Adeyɛ bi san kyekye commit biara a ɛde ne ho na ɛde ne nsa hyɛ build-provenance ase adansedie ma hash ne manifest no, enti kyerɛwtohɔ bi a wɔde wɔn nsa ahyɛ aseɛ a ɛkyekyere a bundleHash to a commit wɔ repository no mu, a biribi foforo a ɛnyɛ the deployment a wɔde di dwuma.

Nea About nkɔmmɔbɔ no hwɛ

Fa ho wɔ header no mu no, ɛyɛ check no live, wɔ wo browser no mu.

Ɛsan fa agyapadeɛ biara a krataafa no reyɛ adwuma ankasa, de Web Crypto API no hashes, na de toto nea ɛda adi no ho. Afei — na eyi ne ɔfã a ɛho hia — ɛno san de kɔmputa di dwuma wɔ bundleHash efi hashes no mu ɛno wɔabu akontaa kɛkɛ, ɛnyɛ nea efi mu biribiara a manifest no ka, na ɔhwehwɛ saa wɔ akorae no adansedi nkrataa a wɔde wɔn nsa ahyɛ ase no mu ɛnam GitHub API so.

Ɛno ne nea esiw deployment bi kwan sɛ ɛbɛhyɛ ne ho adanse: ɛsom fael a wɔasesa abom ne a matching manifest da so ara di nkogu, efisɛ hash a wɔasan asusuw ho no nni adanse biara.

W’ankasa wobɛhwɛ sɛ ɛyɛ nokware

San kyekye commit no About dialog din ahorow no na fa toto ho:

git clone https://github.com/Spl0itable/NYM
cd NYM
git checkout <commit shown in the About dialog>
npm ci
npm run build   # prints "Build hash: <bundleHash>"

Ɛsɛ sɛ hash a wɔatintim no ne nea ɛwɔ About dialog no mu ne nea ɛwɔ saa commit no mu no nyinaa hyia build-provenance run nsɛm a wɔaboaboa ano. Wubetumi nso de GitHub CLI ahwɛ nsaano nkyerɛwee no tẽẽ:

gh attestation verify dist/build-manifest.json --repo Spl0itable/NYM

Na tumi krataa no canary

Warrant canary yɛ asɛm bi, a wotintim wɔ nhyehyɛe pɔtee bi so, a nea ɔyɛe no wɔ n nsa kaa aban ahyɛdeɛ bi a ɛwɔ kokoam a wɔabara wɔn sɛ wɔbɛda no adi — a Ɔman Ahobammɔ Krataa, FISA ahyɛde. Wobetumi ahyɛ nea ɔreyɛ no ma wayɛ komm wɔ ho ahyɛde a ɛte saa, nanso wontumi nhyɛ no sɛ onni atoro, enti canary a ɛrekɔ dedaw anaasɛ ɛyera no te saa ankasa ne sɛnkyerɛnne no.

Ɛte mu canary.json wɔ akorae no ntini mu na wɔfa no tẽẽ efi GitHub, enti n’abakɔsɛm yɛ auditable a ɛde ne ho fi nea deployed site no ka biara ho. About nkɔmmɔbɔ no kɔla-kɔde no:

Na freshness anchor no yɛ nea ɛyɛ foforo

Canary a wɔde wɔn nsa ahyɛ aseɛ no de Bitcoin block sorokɔ ne hash a ɛtwa toɔ no hyɛ mu wɔ berɛ a wɔde wɔn nsa ahyɛ aseɛ no. Anka wɔrentumi nhu saa hash no ansa na block no reba, a ɛkyerɛ sɛ na canary no te saa wɔde wɔn nsa ahyɛ ase wie a bere pɔtee bi sen sɛ wobedi kan de wɔn nsa ahyɛ ase wɔ dodow mu asram bi a atwam. About dialog no de anchor no bata block explorer ho sɛnea ɛbɛyɛ a wubetumi ahwɛ mu.