Omusingi gw’okumanya Wansi wa hood

Okukakasa okuzimba

Open source eyamba yokka singa code gy'oddukanya ye code eyali ebifulumiziddwa. Nymchat ezimbiddwa mu ngeri ya deterministically osobole okukebera ekyo ggwe kennyini, okuva munda mu... app oba okuva ku terminal.

Omuko guno guvvuunuddwa mu kyuma okusobola okugunguyira. Enkyusa y’Olungereza original y’enkyusa ekwata ku nsonga eno.

Ebizimbe ebiddamu okukolebwa

Okuzimba app kifulumya a build-manifest.json erimu ensibuko commit, a SHA-256 hash ya buli kintu kya HTML, JavaScript ne CSS ekiweereddwa, n'ekimu bundleHash ku ekyo kyonna eky’obugagga ekiteekeddwawo.

Ekifulumizibwa kisinziira ku birimu ensibuko byokka — n’obudde bw’okuzimba obuwandiikiddwa bwe bu commit's timestamp okusinga akaseera okuzimba we kwadduka — kale omuntu yenna okuddamu okuzimba kye kimu commit efuna fayiro ezifaanagana ne byte era ze zimu bundleHash.

A GitHub Action olwo eddaamu okuzimba buli commit nga yeetongodde era n'essa emikono ku build-provenance okukakasa kwa hash ne manifest, kale waliwo likodi eriko omukono esiba a bundleHash ku commit mu tterekero, ekoleddwa ekintu ekirala okuggyako okuteekebwa mu nkola.

Ekyo akasengejja Ebikwata ku kye kikebera

Ku mu mutwe eddukanya check live, mu browser yo.

Ensengeka ya Nymchat About, eraga enkyusa, okuzimba obulungi n'okukakasa embeera ya canary. — The About dialog: version, okuzimba obulungi, warrant canary ne layini obutereevu eri omukugu.

Eddamu okuleeta buli kintu omuko gwe gukola mu butuufu, n’ekikola hash ne Web Crypto API, era ageraageranya n’ekyo ekyeyoleka. Olwo — era kino kye kitundu ekikulu — kyo addamu okubala ku... bundleHash okuva mu hashes kiri just calculated, so si okuva ekintu kyonna manifesito ky’egamba, era n’atunuulira ekyo mu bukakafu obw’etterekero obuteekeddwako omukono okuyita mu GitHub API.

Ekyo kye kiziyiza okuteekebwa mu nkola okwekakasa: okuweereza fayiro ezikyusiddwa wamu ne manifesito y'okukwatagana ekyalemererwa, kubanga hash ezzeemu okubalirirwa terina kukakasa.

Ennyimirira	Okutegeeza
&okukebera; App entongole ekakasiddwa (n/n)	Buli kintu kikwatagana, hash ya bundle ezzeemu okubalirirwa ekakasibwa etterekero, . ne omuko guweebwa okuva ku domain entongole.
⚠ Okuzimba okukakasibwa · si app entongole	Code ya ddala era ekakasiddwa, naye eno ndabirwamu ku domain endala. Endabirwamu tesobola kuggyawo kulabula kuno nga teremereddwa kukakasa.
✗ Obutakwatagana	Eky’obugagga tekikola hash ku manifesito ky’eyogera.
✗ Okuzimba okutali kutongole	Hash ya bundle ezzeemu okubalirirwa terina bukakafu okuva mu tterekero — manifest eyeekoledde.
⚠ Ensibuko tesobola kutuukirirwa	GitHub API teyasobodde kutuukirirwa, kale okukakasa tekwasobodde kukeberebwa mu ngeri zombi.

Okukikakasa ggwe kennyini

Ddamu okuzimba commit the About dialog amannya era geraageranya:

git clone https://github.com/Spl0itable/NYM
cd NYM
git checkout <commit shown in the About dialog>
npm ci
npm run build   # prints "Build hash: <bundleHash>"

Hash efulumiziddwa erina okukwatagana n'eyo mu kasengejja Ebikwata ku n'eyo eri mu commit eyo okuzimba-ensibuko run mu bufunze. Osobola n'okukebera omukono butereevu ne GitHub CLI:

gh attestation verify dist/build-manifest.json --repo Spl0itable/NYM

Ekiwandiiko ekiyitibwa warrant canary

Warrant canary ye kiwandiiko, ekifulumizibwa ku nteekateeka etakyukakyuka, omukugu gy’akola ky’alina -li bafunye ekiragiro kya gavumenti eky’ekyama kye bagaaniddwa okwogera — a Ebbaluwa y’ebyokwerinda mu ggwanga, ekiragiro kya FISA. Omukulaakulanya asobola okuwalirizibwa okusirika ku ekiragiro ng’ekyo, naye tekiyinza kuwalirizibwa kulimba, kale canary okugenda stale oba okubula bwe kiri yennyini akabonero.

Kibeera mu... canary.json ku kikolo ky'etterekero era nga kiggyibwa butereevu okuva ku GitHub, kale ebyafaayo byayo bibalirirwa awatali kufaayo ku kyonna omukutu ogussibwa mu nkola kye kyogera. Akasengejja ka Ebikwata ku langi-koodi kugikola:

Erangi	Okutegeeza
Kiragala — byonna bitegeerekeka bulungi	Omukono, ogw'omulembe, n'omukono bikwatagana n'ekisumuluzo ky'omukozi. Tewali kiragiro kya kyama kifunye.
Kyenvu — ebisusse, oba byonna tebitegeerekeka bulungi	Teyazzibwa buggya lunaku lwayo olwalagirwa, oba lwayo `allClear` bendera ya bulimba. Ekiragiro ekisirise tekiyinza kugobwa.
Myuufu — omukono ogutali mutuufu, oba gugenze	Omukono tegukwatagana na kisumuluzo ky'omukozi, oba fayiro eggiddwawo yonna. Kino kitwale ng’okulabula okw’amaanyi.

Ennanga y’obuggya

Canary essiddwaako omukono eyingiza obuwanvu bwa Bitcoin block obusembyeyo ne hash mu kiseera ky’okussa omukono. Hash eyo teyaliyinza kumanyibwa nga block tennabaawo, ekikakasa nti canary yali yassa omukono oluvannyuma ekiseera ekigere okusinga okuteekebwako omukono mu bungi emyezi egiyise. Ensengeka ya About eyunga anchor ku block explorer osobole okugikebera.