[tech] Integrity checks for Gemini pages

[Almaember]

On 19/05/2021 13:13, ew.gemini wrote:
>
> Almaember <almaember@disroot.org> writes:
>
>> On 19/05/2021 09:40, ew.gemini wrote:
>>> Hello almaember,
>>> Almaember <almaember@disroot.org> writes:
>>>
>>>> Hello, everybody!
>>>>
>>>> I know that there is no way in Gemini right now to check the integrity
>>>> of pages. However, it would be nice for this to possible.
>>> Integrity in the sense of "the file remained unchanged in
>>> transit"? TLS should take care of that. In the sense "the file
>>> is the one that the original author intented it to be"?
>>> There are at least two attempts to deal with this:
>>> If you dare to check my capsule at
>>> => gemini://ew.srht.site/
>>> There are two links to openbsd-signify and NetSigil.
>>> When I publish a post, my Makefile takes care to create
>>> corresponding sha256 checksums. They are concatenated into one
>>> file, which is then signed using my gpg key. That's one option.
>>> The same information is packaged differently to
>>> .well-known/signature-bundle. This file is created using
>>> openbds-signify.
>>> There are a few threads on the mailing list, too ...
>>> https://mailing-list-archive.gemi.dev/www/2021/005550.html
>>> https://mailing-list-archive.gemi.dev/www/2021/005374.html
>>> https://mailing-list-archive.gemi.dev/www/2021/005331.html
>>> Also see my first post about experimenting with this:
>>> => gemini://ew.srht.site/en/2020/20201217-towards-a-proper-flightlog-4.gmi
>>>
>>> There are two parts to this, as I see it.
>>> 1.
>>> Create the checksums/signature in some agreed upon format.
>>> Everyone editing a capsule has to do this. While a bit tedious,
>>> it still can be done manually on the shell (unix type
>>> environment assumed).
>>> 2.
>>> Upon user request browsers have to check these agreed upon
>>> locations, download the signed file, possibly download the
>>> public key, cache these things properly and then do the
>>> verification. I am not aware that any gemini browsers have
>>> picked this up. But of course, I would be pleased to be proven
>>> wrong :)
>>>
>>>> snip<
>>> Hope this helps,
>>> ~ew
>>
>> That would be a good (and better than my proposed) way to do it.
>> It would be good to be able to automatically (with minimal user
>> involvement) check the digital signatures of files.
>
> If you like some technical inspiration, you can check out the
> Makefile, that is publishing my capsule at
> https://git.sr.ht/~ew/ew.srht.site/tree/master/item/Makefile
>
>
> Btw you did reply only to me, not the list --- just in case.
>
>
> Cheers,
> ~ew

That's interesting. And I wanted to send it too the list, I clicked on the wrong button though. I will CC this one to the list, since it has the whole conversation as a quote.

Cheers,
~almaember