[tech] Integrity checks for Gemini pages

[nervuri]

On Wed, 2021-05-19, ew.gemini wrote:
> Integrity in the sense of "the file remained unchanged in
> transit"? TLS should take care of that.

Not necessarily.  The connection can be dropped before the transfer
completes, or bits in the file can be flipped for various reasons.
I think there is a place for simple, automated integrity checks - not
just in Gemini, but also on the Web (like SRI [1], but applicable to all
links).

For Gemini, I once suggested using the URI fragment for this, as in
"song.mp3#hash:sha256=...", which has the advantage of not requiring
additional network requests.  Adding hashes to all links on your capsule
would not be worth the tedium, but you could use it to protect only a
few larger files.  It could work on links to third-party sites/capsules
as well.  On mismatch, clients would warn that the file either was
changed or wasn't transferred correctly.

Another approach is to use a well-known file, such as
.well-known/SHA256SUMS - like NetSigil [2], but without the signature,
reducing it to just this bit of code:

```
# Remove old SHA256SUMS file
rm -f .well-known/SHA256SUMS
# Generate new SHA256SUMS file
hashes=$(find -type f -printf '%P\n' | sort | xargs sha256sum)
echo "$hashes" > .well-known/SHA256SUMS
```

Doing it this way would require clients to make an extra network request
every once in a while - and most of these requests would fail.  Unusual
requests contribute to client fingerprinting, so this would not be good
for implicit use.  It should only be done on explicit request by the
user.

Signatures are a more complete solution, but they're also more complex -
harder for capsule admins to set up and for clients to support.

We could, as tidux suggests, use magnet (or IPFS) links for large files
instead, as those protocols have integrity checking built-in.  However,
this must be weighed against the added friction, both for server admins
who must install and configure additional software and for visitors who
don't have a BitTorrent or IPFS client installed.

[1] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
[2] https://tildegit.org/nervuri/NetSigil